)]}'
{
  "commit": "a535a9217ca3f2fccedaafb2fddb4c48f27d36dc",
  "tree": "db54e3f74d16e5de83f164fbc7fdff7b2d47ae87",
  "parents": [
    "fed4626501c871890da287bec62a96e52da1af89"
  ],
  "author": {
    "name": "Samuel Page",
    "email": "sam@bynar.io",
    "time": "Wed Apr 08 15:30:13 2026 +0100"
  },
  "committer": {
    "name": "Marc Kleine-Budde",
    "email": "mkl@pengutronix.de",
    "time": "Thu Apr 09 18:51:42 2026 +0200"
  },
  "message": "can: raw: fix ro-\u003euniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u003euniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u003euniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\nFixes: 514ac99c64b2 (\"can: fix multiple delivery of a single CAN frame for overlapping CAN filters\")\nCc: stable@vger.kernel.org # v4.1+\nAssisted-by: Bynario AI\nSigned-off-by: Samuel Page \u003csam@bynar.io\u003e\nLink: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io\nAcked-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\n[mkl: applied manually]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eee244ffc31ecc0e1cc1aae29cd1d13a4e6b54ca",
      "old_mode": 33188,
      "old_path": "net/can/raw.c",
      "new_id": "58a96e933debb5382e02fccf275cf95dde34edd8",
      "new_mode": 33188,
      "new_path": "net/can/raw.c"
    }
  ]
}