)]}'
{
  "commit": "a9ce4053dc945c5372dedba5017ee675b30dc0c5",
  "tree": "fc018e933608c0e7689f4aabfd134b99060fcfab",
  "parents": [
    "f6fb2ac5e19ae4b66112a698050db80e51f841c3"
  ],
  "author": {
    "name": "Mark Amirkan",
    "email": "markdamirkan@gmail.com",
    "time": "Sun Sep 13 17:14:09 2026 -0700"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Wed Sep 16 17:26:40 2026 -0700"
  },
  "message": "net: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb\u0027s frag_list.  On the last descriptor, lan743x_rx_trim_skb()\nlinearizes the head and frees the fragment skb metadata.\n\nThe checksum-success path then writes ip_summed through the local skb\npointer, which still points to the final fragment.  This causes a\nuse-after-free write when a packet spans more than one receive buffer.\n\nSet ip_summed on the surviving head skb instead.  Multi-buffer receive\ncan occur after a live MTU increase because existing ring entries keep\ntheir old buffer size until they are replenished.\n\nA KUnit test invoking lan743x_rx_process_buffer() with a two-buffer\npacket produced a one-byte KASAN use-after-free write before this change.\nThe same test passed after the change.  The driver object also builds\nwith W\u003d1.  This was not tested on physical LAN743x hardware.\n\nFixes: cd6910501cfd (\"net: lan743x: Add support for Rx IP \u0026 TCP checksum offload\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mark Amirkan \u003cmarkdamirkan@gmail.com\u003e\nReviewed-by: Chenguang Zhao \u003czhaochenguang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260913-b4-send-lan743x-uaf-v1-1-73d563d08ba9@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "24ae56a3c9ed763379de1bc6cf8fb914b537df34",
      "old_mode": 33188,
      "old_path": "drivers/net/ethernet/microchip/lan743x_main.c",
      "new_id": "82d3ec20ba259c9b45b3331914d5e2d44d116983",
      "new_mode": 33188,
      "new_path": "drivers/net/ethernet/microchip/lan743x_main.c"
    }
  ]
}