)]}'
{
  "commit": "ec69daabe45256f98ac86c651b8ad1b2574489a7",
  "tree": "24d50874e59e29611c88a81226d0c01b52ac952f",
  "parents": [
    "9df5fad801c5c568ee5f5dacd8b53565d88e4f02"
  ],
  "author": {
    "name": "Tetsuo Handa",
    "email": "penguin-kernel@I-love.SAKURA.ne.jp",
    "time": "Thu Jan 08 21:36:48 2026 +0900"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Mon Jan 12 16:37:40 2026 -0800"
  },
  "message": "bpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count \u003d 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\"bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\"), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\"bpf: introduce frags support to\nbpf_prog_test_run_xdp()\") forgot to call xdp_convert_buff_to_md().\n\nReported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d881d65229ca4f9ae8c84\nFixes: 1c1949982524 (\"bpf: introduce frags support to bpf_prog_test_run_xdp()\")\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/af090e53-9d9b-4412-8acb-957733b3975c@I-love.SAKURA.ne.jp\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e6c0ad204b928464dffb13794ac34b9b76d7b4c4",
      "old_mode": 33188,
      "old_path": "net/bpf/test_run.c",
      "new_id": "26cfcfdc45eb72305e4cceff707adec2bfcb83c3",
      "new_mode": 33188,
      "new_path": "net/bpf/test_run.c"
    }
  ]
}