)]}'
{
  "commit": "ec7cb62d18d854ea09df8b7194e7e710985f8b9a",
  "tree": "0e548d50f40aef5ef9e961915355f0a74d1ce948",
  "parents": [
    "2618be7dccf8739b89e1906b64bd8d551af351e6"
  ],
  "author": {
    "name": "Andrey Ryabinin",
    "email": "aryabinin@virtuozzo.com",
    "time": "Wed Feb 22 12:35:27 2017 +0300"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Wed Feb 22 16:14:07 2017 -0500"
  },
  "message": "net/dccp: fix use after free in tw_timer_handler()\n\nDCCP doesn\u0027t purge timewait sockets on network namespace shutdown.\nSo, after net namespace destroyed we could still have an active timer\nwhich will trigger use after free in tw_timer_handler():\n\n    BUG: KASAN: use-after-free in tw_timer_handler+0x4a/0xa0 at addr ffff88010e0d1e10\n    Read of size 8 by task swapper/1/0\n    Call Trace:\n     __asan_load8+0x54/0x90\n     tw_timer_handler+0x4a/0xa0\n     call_timer_fn+0x127/0x480\n     expire_timers+0x1db/0x2e0\n     run_timer_softirq+0x12f/0x2a0\n     __do_softirq+0x105/0x5b4\n     irq_exit+0xdd/0xf0\n     smp_apic_timer_interrupt+0x57/0x70\n     apic_timer_interrupt+0x90/0xa0\n\n    Object at ffff88010e0d1bc0, in cache net_namespace size: 6848\n    Allocated:\n     save_stack_trace+0x1b/0x20\n     kasan_kmalloc+0xee/0x180\n     kasan_slab_alloc+0x12/0x20\n     kmem_cache_alloc+0x134/0x310\n     copy_net_ns+0x8d/0x280\n     create_new_namespaces+0x23f/0x340\n     unshare_nsproxy_namespaces+0x75/0xf0\n     SyS_unshare+0x299/0x4f0\n     entry_SYSCALL_64_fastpath+0x18/0xad\n    Freed:\n     save_stack_trace+0x1b/0x20\n     kasan_slab_free+0xae/0x180\n     kmem_cache_free+0xb4/0x350\n     net_drop_ns+0x3f/0x50\n     cleanup_net+0x3df/0x450\n     process_one_work+0x419/0xbb0\n     worker_thread+0x92/0x850\n     kthread+0x192/0x1e0\n     ret_from_fork+0x2e/0x40\n\nAdd .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge\ntimewait sockets on net namespace destruction and prevent above issue.\n\nFixes: f2bf415cfed7 (\"mib: add net to NET_ADD_STATS_BH\")\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Andrey Ryabinin \u003caryabinin@virtuozzo.com\u003e\nAcked-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b043ec833785c9a670315d7c960faf1e6c85ea46",
      "old_mode": 33188,
      "old_path": "net/dccp/ipv4.c",
      "new_id": "409d0cfd34474812c3bf74f26cd423a3d65ee441",
      "new_mode": 33188,
      "new_path": "net/dccp/ipv4.c"
    },
    {
      "type": "modify",
      "old_id": "cef60a4a28030d2066ba84e0ef195855d0014fbb",
      "old_mode": 33188,
      "old_path": "net/dccp/ipv6.c",
      "new_id": "233b57367758c64c09ed40f7359cb8fcb1918d93",
      "new_mode": 33188,
      "new_path": "net/dccp/ipv6.c"
    }
  ]
}