)]}' { "commit": "1b1499a817c90fd1ce9453a2c98d2a01cca0e775", "tree": "4d49ead6174f2e3dfbf98a98cfd502079c1bdd73", "parents": [ "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a" ], "author": { "name": "Lin Ma", "email": "linma@zju.edu.cn", "time": "Thu Oct 07 19:44:30 2021 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 08 17:24:32 2021 +0100" }, "message": "nfc: nci: fix the UAF of rf_conn_info object\n\nThe nci_core_conn_close_rsp_packet() function will release the conn_info\nwith given conn_id. However, it needs to set the rf_conn_info to NULL to\nprevent other routines like nci_rf_intf_activated_ntf_packet() to trigger\nthe UAF.\n\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@canonical.com\u003e\nSigned-off-by: Lin Ma \u003clinma@zju.edu.cn\u003e\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "a2e72c0038050dee96fbb865b3df504d31338249", "old_mode": 33188, "old_path": "net/nfc/nci/rsp.c", "new_id": "b911ab78bed9aa14e30ea670e978987d7f827bd1", "new_mode": 33188, "new_path": "net/nfc/nci/rsp.c" } ] }