)]}'
{
  "commit": "f7068b697f99455e7e6ae6ced27ae7d06fc9e974",
  "tree": "09b649aa62f92932976b1b562f27f7f40ddcc7e5",
  "parents": [
    "82cc3bd8522dda2c840db72698d710834eb1ead0"
  ],
  "author": {
    "name": "Li Daming",
    "email": "d4n.for.sec@gmail.com",
    "time": "Fri May 08 23:58:28 2026 +0800"
  },
  "committer": {
    "name": "David Howells",
    "email": "dhowells@redhat.com",
    "time": "Tue Jun 09 15:01:40 2026 +0100"
  },
  "message": "rxrpc: serialize kernel accept preallocation with socket teardown\n\nrxrpc_kernel_charge_accept() reads rx-\u003ebacklog without any\nsocket/backlog synchronization and passes that raw pointer into\nrxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()\nsets rx-\u003ebacklog \u003d NULL and frees the backlog rings, so a kernel\npreallocation worker can keep using a freed struct rxrpc_backlog\nwhile updating *_backlog_head/tail and array slots.\n\nSerialize the state check and backlog lookup with the socket lock,\nand reject kernel preallocation once teardown has disabled\nlistening or discarded the service backlog.\n\nFixes: 00e907127e6f (\"rxrpc: Preallocate peers, conns and calls for incoming service requests\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Li Daming \u003cd4n.for.sec@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Eric Dumazet \u003cedumazet@google.com\u003e\ncc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\ncc: Jakub Kicinski \u003ckuba@kernel.org\u003e\ncc: Paolo Abeni \u003cpabeni@redhat.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: netdev@vger.kernel.org\ncc: stable@kernel.org\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ee2d1319e69a81d00404a6fd6bedf977016466e1",
      "old_mode": 33188,
      "old_path": "net/rxrpc/call_accept.c",
      "new_id": "47824120f1da18ee5cc8e12d2b6ae2b595c0a0cb",
      "new_mode": 33188,
      "new_path": "net/rxrpc/call_accept.c"
    }
  ]
}