)]}'
{
  "commit": "cbdc70af0e54813a10cf3c20a015f4b15b902954",
  "tree": "2345f623ec599d2d3d9bc0fc36b5da4f764a1576",
  "parents": [
    "5dbdbea553068df9d4894bb4810abc5902050226"
  ],
  "author": {
    "name": "Tetsuo Handa",
    "email": "penguin-kernel@i-love.sakura.ne.jp",
    "time": "Fri May 22 14:26:30 2020 +1000"
  },
  "committer": {
    "name": "Sasha Levin",
    "email": "sashal@kernel.org",
    "time": "Fri May 22 13:13:57 2020 +0000"
  },
  "message": "umh: fix refcount underflow in fork_usermode_blob().\n\nSince free_bprm(bprm) always calls allow_write_access(bprm-\u003efile) and\nfput(bprm-\u003efile) if bprm-\u003efile is set to non-NULL, __do_execve_file()\nmust call deny_write_access(file) and get_file(file) if called from\ndo_execve_file() path. Otherwise, use-after-free access can happen at\nfput(file) in fork_usermode_blob().\n\n  general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC\n  CPU: 3 PID: 4131 Comm: insmod Tainted: G           O      5.6.0-rc5+ #978\n  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019\n  RIP: 0010:fork_usermode_blob+0xaa/0x190\n\nLink: http://lkml.kernel.org/r/9b846b1f-a231-4f09-8c37-6bfb0d1e7b05@i-love.sakura.ne.jp\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nFixes: 449325b52b7a6208 (\"umh: introduce fork_usermode_blob() helper\")\nCc: \u003cstable@vger.kernel.org\u003e [4.18+]\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\n(cherry picked from commit 3a9183f9c089f5ee0a374a72f291e5d7967c7dd2)\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "77603ceed51f94f9f71c5aee30f8ae9ec5736099",
      "old_mode": 33188,
      "old_path": "fs/exec.c",
      "new_id": "09065a90793be4def89e806460206df12ef2360d",
      "new_mode": 33188,
      "new_path": "fs/exec.c"
    }
  ]
}