)]}'
{
  "commit": "cd6f72d7f38e10aa82fcbc745a6a9e58e0d8e366",
  "tree": "e730685bd5337cc2322da7cb0ed0649cd2145ad0",
  "parents": [
    "2edd8339468e4bf0feecb3398aaad25fd7b84286"
  ],
  "author": {
    "name": "Kumar Kartikeya Dwivedi",
    "email": "memxor@gmail.com",
    "time": "Fri Sep 04 10:43:18 2026 +0200"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Fri Sep 04 07:58:36 2026 -0700"
  },
  "message": "bpf: Clear NON_OWN_REF after RCU protection ends\n\nA local kptr load of an object containing a graph node is marked MEM_RCU\nand NON_OWN_REF while protected by RCU. When the last RCU read-side critical\nsection ends, invalidate_rcu_protected_refs() removes MEM_RCU and marks the\npointer PTR_UNTRUSTED, but leaves NON_OWN_REF set.\n\nThe stale flag lets graph kfunc argument checks continue treating the\npointer as a live borrowed reference. In particular, bpf_rbtree_remove()\ncan accept a pointer after its protection ended and return it as a new\nowning reference, even though the object may already have been freed.\n\nClear NON_OWN_REF when an RCU-protected pointer is demoted. A spin lock also\nprovides implicit RCU protection, so invalidate non-owning references before\ndemoting RCU-protected pointers when releasing the lock. Otherwise the\ndemotion would clear the flag before invalidate_non_owning_refs() can find\nand invalidate those aliases.\n\nThe demoted pointer remains available for fault-protected reads. Exempt such\nreads from the allocated-object reference-state assertion; writes through a\nfault-prone pointer are already rejected, and bpf_may_fault_on_deref() makes\nthe surviving loads use BPF_PROBE_MEM.\n\nFixes: 1b12171533a9 (\"bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-6-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3af8bd838b823e4776589ce1a64feda4ff5c014b",
      "old_mode": 33188,
      "old_path": "kernel/bpf/verifier.c",
      "new_id": "9c6ad157a61ecf76f85dec49540a87419afa1897",
      "new_mode": 33188,
      "new_path": "kernel/bpf/verifier.c"
    }
  ]
}