)]}'
{
  "commit": "dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
  "tree": "1f58134fa408ab99f8f6e1eed438061ceb8c2902",
  "parents": [
    "e01780ea4661172734118d2a5f41bc9720765668"
  ],
  "author": {
    "name": "Chen Ridong",
    "email": "chenridong@huawei.com",
    "time": "Fri Jan 10 06:16:39 2025 +0000"
  },
  "committer": {
    "name": "Herbert Xu",
    "email": "herbert@gondor.apana.org.au",
    "time": "Sun Jan 19 12:44:28 2025 +0800"
  },
  "message": "padata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u003ework)\n...\n\n\t\t\t\t\u003ckworker context\u003e\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u003ckworker context\u003e\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027\ninto the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish.\n\nFixes: bbefa1dd6a6d (\"crypto: pcrypt - Avoid deadlock by using per-instance padata queues\")\nSigned-off-by: Chen Ridong \u003cchenridong@huawei.com\u003e\nAcked-by: Daniel Jordan \u003cdaniel.m.jordan@oracle.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "de2c02a81469ca13159479f51fd2430ee9b758a7",
      "old_mode": 33188,
      "old_path": "kernel/padata.c",
      "new_id": "418987056340ea430c8330397d606e881eddb3af",
      "new_mode": 33188,
      "new_path": "kernel/padata.c"
    }
  ]
}