)]}'
{
  "commit": "d748d741920fe3c6946aab70277cdab78736cf70",
  "tree": "568482a4581c888d4dfb56fa49c48337355707e2",
  "parents": [
    "e76a314e50b12491368212b442d0047492103888"
  ],
  "author": {
    "name": "Chengfeng Ye",
    "email": "nicoyip.dev@gmail.com",
    "time": "Tue Aug 04 20:33:30 2026 +0800"
  },
  "committer": {
    "name": "David Howells",
    "email": "dhowells@redhat.com",
    "time": "Wed Sep 02 12:32:38 2026 +0100"
  },
  "message": "afs: Clear stale peer app data after address list changes\n\nafs_fs_probe_fileserver() fetches the current endpoint state under\nserver-\u003efs_lock, but leaves old_alist as NULL.  Consequently,\nafs_set_peer_appdata() treats every address list replacement as initial\nsetup and only binds the new peers; it never unbinds peers removed from\nthe old list.\n\nAn address refresh can therefore proceed as follows.  CPU 0 replaces\nserver S\u0027s list and drops Pold without clearing Pold-\u003eapp_data.  The\nserver destroyer then clears only S\u0027s current peers and lets S reach its\nRCU callback.  After the callback frees S, CPU 1 handles a callback\nthrough an RxRPC connection that still pins Pold, reads Pold-\u003eapp_data,\nand calls afs_use_server() on the freed object.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in afs_find_server+0x3c/0xa0\n  Read of size 4 at addr ffff8881013e1af0 by task krxrpcio/7001/74\n  Call Trace:\n   afs_find_server+0x3c/0xa0\n   afs_rx_new_call+0x15c/0x390\n   rxrpc_new_incoming_call+0x97c/0x1730\n   rxrpc_input_packet.constprop.0+0xd03/0xec0\n   rxrpc_io_thread+0x967/0x1640\n  Allocated by task 93:\n   afs_lookup_server+0x1a7/0x14c0\n   afs_alloc_server_list+0x43f/0xb60\n   afs_create_volume+0x923/0x1490\n   afs_get_tree+0x1c6/0x10a0\n  Freed by task 0:\n   kfree+0x131/0x3c0\n   rcu_core+0x50a/0x1850\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x71/0xa10\n   afs_put_server+0x213/0x2b0\n\nPreserve old-\u003eaddresses for the peer app-data update so that removed\npeers are cleared before the endpoint state is replaced.  Also advance\nboth cursors when the old and new lists share a peer; activating the\nold/new comparison without this would otherwise loop forever on the\nshared entry.\n\nFixes: 40e8b52fe8c8 (\"afs: Use the per-peer app data provided by rxrpc\")\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Qi Zhang \u003cmarsy12010123@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: linux-afs@lists.infradead.org\ncc: linux-fsdevel@vger.kernel.org\ncc: stable@vger.kernel.org\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "63bf096b721aa53351984d1070fe9453a0f08678",
      "old_mode": 33188,
      "old_path": "fs/afs/addr_list.c",
      "new_id": "73195d76b481a201d4b632647149fe2ab77154dc",
      "new_mode": 33188,
      "new_path": "fs/afs/addr_list.c"
    },
    {
      "type": "modify",
      "old_id": "a91ad1938d0788e0940189b258b2cbbe07ac4829",
      "old_mode": 33188,
      "old_path": "fs/afs/fs_probe.c",
      "new_id": "8c62334dbfe72d1adc7f18c50d1b5c13c9ee1f84",
      "new_mode": 33188,
      "new_path": "fs/afs/fs_probe.c"
    }
  ]
}