)]}'
{
  "commit": "ceac0de741bfb47ca255eee075257b3bb31f0651",
  "tree": "5f3a412a5da309ca190ee87af037f44955ea17bb",
  "parents": [
    "2842ce397dd09882530b42f7fdb0c855767eb24e"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@google.com",
    "time": "Fri Sep 11 16:08:04 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Tue Sep 15 18:44:02 2026 -0700"
  },
  "message": "netlink: do not free nlk-\u003egroups while lockless readers can use it\n\nnetlink_realloc_groups() uses krealloc() under netlink_table_grab().\nWhenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old\nbitmap is freed immediately.\n\nTwo readers of nlk-\u003egroups / nlk-\u003engroups do not hold the netlink\ntable lock:\n\n1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the\n   rhashtable walk in __netlink_diag_dump(), which only holds RCU.\n   Only the mc_list part of the dump takes nl_table_lock.\n\n2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been\n   lockless since commit 21e4902aea80 (\"netlink: Lockless lookup with\n   RCU grace period in socket release\").\n\nBoth can read a freed buffer, and sk_diag_dump_groups() can also read\npast the end of the old (smaller) buffer if it happens to load the old\n@groups pointer together with the new @ngroups value, copying the\nresult into a NETLINK_DIAG_GROUPS attribute.\n\nThis is the same class of bug that commit f773608026ee (\"netlink:\naccess nlk groups safely in netlink bind and getname\") fixed for bind()\nand getname(); these two readers were missed. Simply grabbing the table\nlock in sk_diag_dump_groups() is not an option, because it is also\ncalled with nl_table_lock already held from the mc_list section of the\ndump.\n\nMake the lockless readers safe instead:\n\n- Allocate a new bitmap and free the old one after an RCU grace period,\n  instead of relying on the implicit kfree() done by krealloc().\n\n- Publish @groups before @ngroups, both with release semantics, and have\n  the lockless readers load @ngroups first. A reader can then never pair\n  the new (bigger) size with the old (smaller) buffer, and a reader\n  picking up the new pointer while still seeing the old size is\n  guaranteed to see the initialized bitmap.\n\nnetlink_realloc_groups() is called from process context (bind() and\nsetsockopt()), so kfree_rcu_mightsleep() can be used, once the table\nhas been released.\n\nFixes: 21e4902aea80 (\"netlink: Lockless lookup with RCU grace period in socket release\")\nFixes: ad202074320c (\"netlink: Use rhashtable walk interface in diag dump\")\nReported-by: James Burton \u003cjamesburton@meta.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260911160804.917099-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e6b1d9758c9c92ee465888ed206e84339ac8e52c",
      "old_mode": 33188,
      "old_path": "net/netlink/af_netlink.c",
      "new_id": "9fdf964224ab48407ff4915d2b07cc76325ae6af",
      "new_mode": 33188,
      "new_path": "net/netlink/af_netlink.c"
    },
    {
      "type": "modify",
      "old_id": "0b3e021bd0ed29edc094fad2c79c7c067edcdd50",
      "old_mode": 33188,
      "old_path": "net/netlink/diag.c",
      "new_id": "7979bd9b26060ea1812a7b4ac09f74ea74ff0759",
      "new_mode": 33188,
      "new_path": "net/netlink/diag.c"
    }
  ]
}