)]}'
{
  "commit": "99a2ef500906138ba58093b9893972a5c303c734",
  "tree": "8d04a0fb3cfe8ab6e44afd90619f33c851f7b324",
  "parents": [
    "592a68212c5664bcaa88f24ed80bf791282790fe"
  ],
  "author": {
    "name": "Chen Ridong",
    "email": "chenridong@huawei.com",
    "time": "Mon Feb 02 12:27:18 2026 +0000"
  },
  "committer": {
    "name": "Tejun Heo",
    "email": "tj@kernel.org",
    "time": "Mon Feb 02 06:04:13 2026 -1000"
  },
  "message": "cgroup/dmem: avoid pool UAF\n\nAn UAF issue was observed:\n\nBUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150\nWrite of size 8 at addr ffff888106715440 by task insmod/527\n\nCPU: 4 UID: 0 PID: 527 Comm: insmod    6.19.0-rc7-next-20260129+ #11\nTainted: [O]\u003dOOT_MODULE\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x82/0xd0\nkasan_report+0xca/0x100\nkasan_check_range+0x39/0x1c0\npage_counter_uncharge+0x65/0x150\ndmem_cgroup_uncharge+0x1f/0x260\n\nAllocated by task 527:\n\nFreed by task 0:\n\nThe buggy address belongs to the object at ffff888106715400\nwhich belongs to the cache kmalloc-512 of size 512\nThe buggy address is located 64 bytes inside of\nfreed 512-byte region [ffff888106715400, ffff888106715600)\n\nThe buggy address belongs to the physical page:\n\nMemory state around the buggy address:\nffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\nffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\t\t\t\t     ^\nffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\nffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\nThe issue occurs because a pool can still be held by a caller after its\nassociated memory region is unregistered. The current implementation frees\nthe pool even if users still hold references to it (e.g., before uncharge\noperations complete).\n\nThis patch adds a reference counter to each pool, ensuring that a pool is\nonly freed when its reference count drops to zero.\n\nFixes: b168ed458dde (\"kernel/cgroup: Add \"dmem\" memory accounting cgroup\")\nCc: stable@vger.kernel.org # v6.14+\nSigned-off-by: Chen Ridong \u003cchenridong@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "787b334e0f5df664b9befd5d295c26ab41c25ef9",
      "old_mode": 33188,
      "old_path": "kernel/cgroup/dmem.c",
      "new_id": "1ea6afffa985c43129cead2c852d43a103f62612",
      "new_mode": 33188,
      "new_path": "kernel/cgroup/dmem.c"
    }
  ]
}