)]}'
{
  "commit": "38e15ed783eb6b17598497dbb43e1edac623fdb3",
  "tree": "c8d52ed8ee7587c552f37ea88fe492a2030ef4df",
  "parents": [
    "8fe20b2e3ef2511cf03ed040062c21d9bac1eeaa"
  ],
  "author": {
    "name": "Michal Luczaj",
    "email": "mhal@rbox.co",
    "time": "Mon Feb 10 13:15:00 2025 +0100"
  },
  "committer": {
    "name": "Lee Jones",
    "email": "joneslee@google.com",
    "time": "Tue Apr 01 13:05:51 2025 +0100"
  },
  "message": "UPSTREAM: vsock: Orphan socket after transport release\n\ncommit 78dafe1cf3afa02ed71084b350713b07e72a18fb upstream.\n\nDuring socket release, sock_orphan() is called without considering that it\nsets sk-\u003esk_wq to NULL. Later, if SO_LINGER is enabled, this leads to a\nnull pointer dereferenced in virtio_transport_wait_close().\n\nOrphan the socket only after transport release.\n\nPartially reverts the \u0027Fixes:\u0027 commit.\n\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n lock_acquire+0x19e/0x500\n _raw_spin_lock_irqsave+0x47/0x70\n add_wait_queue+0x46/0x230\n virtio_transport_release+0x4e7/0x7f0\n __vsock_release+0xfd/0x490\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x35e/0xa90\n __x64_sys_close+0x78/0xd0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nBug: 396331793\nReported-by: syzbot+9d55b199192a4be7d02c@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d9d55b199192a4be7d02c\nFixes: fcdd2242c023 (\"vsock: Keep the binding until socket destruction\")\nTested-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nLink: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-1-ef6244d02b54@rbox.co\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 631e00fdac7acca676103d6cbc96eb152625f449)\nSigned-off-by: Lee Jones \u003cjoneslee@google.com\u003e\nChange-Id: I61ef914e5f706ee1c9dd2b9f95cbc69020fe8f00\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "67c6ed3f4eb70cf5223c231a1f0e38c25ad53080",
      "old_mode": 33188,
      "old_path": "net/vmw_vsock/af_vsock.c",
      "new_id": "ac1bd12928e510ece466eb8776621fa9bc0a92a7",
      "new_mode": 33188,
      "new_path": "net/vmw_vsock/af_vsock.c"
    }
  ]
}