)]}'
{
  "commit": "0b381e18d49e18be054ef6553d9301889e98a3da",
  "tree": "288cc729c754f28eb59608ac8c85b6fb1ded3b50",
  "parents": [
    "1b929c02afd37871d5afb9d498426f83432e71c2"
  ],
  "author": {
    "name": "Hang Zhang",
    "email": "zh.nvgt@gmail.com",
    "time": "Thu Dec 29 22:35:28 2022 -0800"
  },
  "committer": {
    "name": "Helge Deller",
    "email": "deller@gmx.de",
    "time": "Thu Jan 05 12:36:42 2023 +0100"
  },
  "message": "fbdev: fbmem: prevent potential use-after-free issues with console_lock()\n\nIn do_fb_ioctl(), user specified \"fb_info\" can be freed in the callee\nfbcon_get_con2fb_map_ioctl() -\u003e set_con2fb_map() -\u003e\ncon2fb_release_oldinfo(), this free operation is protected by\nconsole_lock() in fbcon_set_con2fb_map_ioctl(), it also results in\nthe change of certain states such as \"minfo-\u003edead\" in matroxfb_remove(),\nso that it can be checked to avoid use-after-free before the use sites\n(e.g., the check at the beginning of matroxfb_ioctl()). However,\nthe problem is that the use site is not protected by the same locks\nas for the free operation, e.g., \"default\" case in do_fb_ioctl()\ncan lead to \"matroxfb_ioctl()\" but it\u0027s not protected by console_lock(),\nwhich can invalidate the aforementioned state set and check in a\nconcurrent setting.\n\nPrevent the potential use-after-free issues by protecting the \"default\"\ncase in do_fb_ioctl() with console_lock(), similarly as for many other\ncases like \"case FBIOBLANK\" and \"case FBIOPAN_DISPLAY\".\n\nSigned-off-by: Hang Zhang \u003czh.nvgt@gmail.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3a6c8458eb8d5349c84230f4a9b8e30b5a20882a",
      "old_mode": 33188,
      "old_path": "drivers/video/fbdev/core/fbmem.c",
      "new_id": "4e5121b1b576383b5159eb1e62886d8b53d728a4",
      "new_mode": 33188,
      "new_path": "drivers/video/fbdev/core/fbmem.c"
    }
  ]
}