)]}'
{
  "commit": "11eb85ec42dc8c7a7ec519b90ccf2eeae9409de8",
  "tree": "a88ca07a4de1b08600afabe48fb8b92b15b5cc28",
  "parents": [
    "18f81241b74fb49d576c83fbbab9a0b6e3bb20d4"
  ],
  "author": {
    "name": "Dan Carpenter",
    "email": "dan.carpenter@oracle.com",
    "time": "Wed Jan 15 20:49:04 2020 +0300"
  },
  "committer": {
    "name": "Johan Hedberg",
    "email": "johan.hedberg@intel.com",
    "time": "Sun Jan 26 10:34:17 2020 +0200"
  },
  "message": "Bluetooth: Fix race condition in hci_release_sock()\n\nSyzbot managed to trigger a use after free \"KASAN: use-after-free Write\nin hci_sock_bind\".  I have reviewed the code manually and one possibly\ncause I have found is that we are not holding lock_sock(sk) when we do\nthe hci_dev_put(hdev) in hci_sock_release().  My theory is that the bind\nand the release are racing against each other which results in this use\nafter free.\n\nReported-by: syzbot+eba992608adf3d796bcc@syzkaller.appspotmail.com\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5756b124c2cb06f376231dbd8d8add605bd017d7",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_sock.c",
      "new_id": "9c4a093f89607620f7d4c0c633f3bec84f10f751",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_sock.c"
    }
  ]
}