)]}'
{
  "commit": "19a66b6f3cd817c5563ae5cb0fd6285a520a3bb7",
  "tree": "813e7defa7f23922e752c2db0b947972ee07c683",
  "parents": [
    "ea07addb23692e35e7018fa73b58b4e86b77147d"
  ],
  "author": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Thu Jul 21 09:10:50 2022 -0700"
  },
  "committer": {
    "name": "Lee Jones",
    "email": "joneslee@google.com",
    "time": "Wed Aug 03 13:09:56 2022 +0100"
  },
  "message": "BACKPORT: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put\n\ncommit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream.\n\nThis fixes the following trace which is caused by hci_rx_work starting up\n*after* the final channel reference has been put() during sock_close() but\n*before* the references to the channel have been destroyed, so instead\nthe code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to\nprevent referencing a channel that is about to be destroyed.\n\n  refcount_t: increment on 0; use-after-free.\n  BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0\n  Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705\n\n  CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S      W\n  4.14.234-00003-g1fb6d0bd49a4-dirty #28\n  Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150\n  Google Inc. MSM sm8150 Flame DVT (DT)\n  Workqueue: hci0 hci_rx_work\n  Call trace:\n   dump_backtrace+0x0/0x378\n   show_stack+0x20/0x2c\n   dump_stack+0x124/0x148\n   print_address_description+0x80/0x2e8\n   __kasan_report+0x168/0x188\n   kasan_report+0x10/0x18\n   __asan_load4+0x84/0x8c\n   refcount_dec_and_test+0x20/0xd0\n   l2cap_chan_put+0x48/0x12c\n   l2cap_recv_frame+0x4770/0x6550\n   l2cap_recv_acldata+0x44c/0x7a4\n   hci_acldata_packet+0x100/0x188\n   hci_rx_work+0x178/0x23c\n   process_one_work+0x35c/0x95c\n   worker_thread+0x4cc/0x960\n   kthread+0x1a8/0x1c4\n   ret_from_fork+0x10/0x18\n\nBug: 165329981\nCc: stable@kernel.org\nReported-by: Lee Jones \u003clee.jones@linaro.org\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nTested-by: Lee Jones \u003clee.jones@linaro.org\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Lee Jones \u003cjoneslee@google.com\u003e\nChange-Id: I6efae55d8014740aebc8c3534846c2d249068b29\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e73c206e843bec783abc7d2bb71f772f2e4de72c",
      "old_mode": 33188,
      "old_path": "include/net/bluetooth/l2cap.h",
      "new_id": "89b226da2d5a4c54c3391289cfb0a807d97d3b47",
      "new_mode": 33188,
      "new_path": "include/net/bluetooth/l2cap.h"
    },
    {
      "type": "modify",
      "old_id": "959a16b133033e9a4329a96402f79db6dd5b0f24",
      "old_mode": 33188,
      "old_path": "net/bluetooth/l2cap_core.c",
      "new_id": "286fca6a9ab2ae8d40ef9653edb45ca9f8b220dd",
      "new_mode": 33188,
      "new_path": "net/bluetooth/l2cap_core.c"
    }
  ]
}