)]}'
{
  "commit": "ef1548adada51a2f32ed7faef50aa465e1b4c5da",
  "tree": "ae40c70c8dd5ef9c28a4f53742245354c48c945a",
  "parents": [
    "058f2e4da79b23afb56ce3d03d907d6cdd36f2b8"
  ],
  "author": {
    "name": "Eric W. Biederman",
    "email": "ebiederm@xmission.com",
    "time": "Fri Jun 12 09:42:03 2020 -0500"
  },
  "committer": {
    "name": "Eric W. Biederman",
    "email": "ebiederm@xmission.com",
    "time": "Fri Jun 12 14:13:33 2020 -0500"
  },
  "message": "proc: Use new_inode not new_inode_pseudo\n\nRecently syzbot reported that unmounting proc when there is an ongoing\ninotify watch on the root directory of proc could result in a use\nafter free when the watch is removed after the unmount of proc\nwhen the watcher exits.\n\nCommit 69879c01a0c3 (\"proc: Remove the now unnecessary internal mount\nof proc\") made it easier to unmount proc and allowed syzbot to see the\nproblem, but looking at the code it has been around for a long time.\n\nLooking at the code the fsnotify watch should have been removed by\nfsnotify_sb_delete in generic_shutdown_super.  Unfortunately the inode\nwas allocated with new_inode_pseudo instead of new_inode so the inode\nwas not on the sb-\u003es_inodes list.  Which prevented\nfsnotify_unmount_inodes from finding the inode and removing the watch\nas well as made it so the \"VFS: Busy inodes after unmount\" warning\ncould not find the inodes to warn about them.\n\nMake all of the inodes in proc visible to generic_shutdown_super,\nand fsnotify_sb_delete by using new_inode instead of new_inode_pseudo.\nThe only functional difference is that new_inode places the inodes\non the sb-\u003es_inodes list.\n\nI wrote a small test program and I can verify that without changes it\ncan trigger this issue, and by replacing new_inode_pseudo with\nnew_inode the issues goes away.\n\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/000000000000d788c905a7dfa3f4@google.com\nReported-by: syzbot+7d2debdcdb3cb93c1e5e@syzkaller.appspotmail.com\nFixes: 0097875bd415 (\"proc: Implement /proc/thread-self to point at the directory of the current thread\")\nFixes: 021ada7dff22 (\"procfs: switch /proc/self away from proc_dir_entry\")\nFixes: 51f0885e5415 (\"vfs,proc: guarantee unique inodes in /proc\")\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f40c2532c057699773a2631838d7494778e190cc",
      "old_mode": 33188,
      "old_path": "fs/proc/inode.c",
      "new_id": "28d6105e908e4c3f47803b519e9e68d6a8f3c7da",
      "new_mode": 33188,
      "new_path": "fs/proc/inode.c"
    },
    {
      "type": "modify",
      "old_id": "ca5158fa561c0d6fc20fe048073d61547725da0f",
      "old_mode": 33188,
      "old_path": "fs/proc/self.c",
      "new_id": "72cd69bcaf4ad977ab7c3b134d91cfaaeee34026",
      "new_mode": 33188,
      "new_path": "fs/proc/self.c"
    },
    {
      "type": "modify",
      "old_id": "ac284f409568ceb2b8f8f0559ccf55db4bad7d3b",
      "old_mode": 33188,
      "old_path": "fs/proc/thread_self.c",
      "new_id": "a553273fbd41758df711b85c9647134b9eb1c631",
      "new_mode": 33188,
      "new_path": "fs/proc/thread_self.c"
    }
  ]
}