)]}'
{
  "commit": "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc",
  "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d",
  "parents": [
    "235acadd310533ba386ae61ad155b72bee381559",
    "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36"
  ],
  "author": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Wed Jul 08 14:41:04 2026 +0200"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Wed Jul 08 14:41:04 2026 +0200"
  },
  "message": "Merge branch \u0027ipv4-ipv6-fix-uaf-and-memory-leak-in-igmp-mld\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: Fix UAF and memory leak in IGMP/MLD\n\nThis series addresses two potential UAF vulnerabilities\nand memory leaks in the IPv4 IGMP and IPv6 MLD subsystems.\n\nThe first two patches fix a UAF where the packet receive path races with\ndevice teardown. If the device refcount has already hit 0 (but the memory\nis still held by RCU), incoming IGMP/MLD packets trying to schedule delayed\nwork or timers would call refcount_inc() on the 0 refcount, triggering a\nwarning and eventually leading to a UAF when the work runs after the device\nhas been freed. This is fixed by introducing safe hold helpers using\nrefcount_inc_not_zero(). In MLD, we also ensure we only enqueue the skb\nif we successfully acquired the device reference, to avoid leaking skbs\nwhen the device is being destroyed.\n\nThe third patch fixes memory leaks in IPv4 IGMP when timers are deleted or\nstopped. When a timer is deleted (in igmp_mod_timer) or stopped (in\nigmp_stop_timer) and not re-armed, the code dropped the group refcount using\nrefcount_dec(). However, if the group was concurrently removed from the list,\nthis decrement could drop the refcount to 0 without triggering the\ncleanup/free path, leaking the group structure. This is fixed by using\nip_ma_put() instead, and deferring the put until after the lock is released.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260705181756.963063-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": []
}