)]}'
{
  "commit": "751efd8610d3d7d67b7bdf7f62646edea7365dd7",
  "tree": "1703264d0c128a5d2e602b389cce35de88c06039",
  "parents": [
    "c1f19495277c34b01fe1ac9f781bbeefafaa0d02"
  ],
  "author": {
    "name": "Robin Holt",
    "email": "holt@sgi.com",
    "time": "Fri Feb 22 16:35:34 2013 -0800"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Sat Feb 23 17:50:21 2013 -0800"
  },
  "message": "mmu_notifier_unregister NULL Pointer deref and multiple -\u003erelease() callouts\n\nThere is a race condition between mmu_notifier_unregister() and\n__mmu_notifier_release().\n\nAssume two tasks, one calling mmu_notifier_unregister() as a result of a\nfilp_close() -\u003eflush() callout (task A), and the other calling\nmmu_notifier_release() from an mmput() (task B).\n\n                A                               B\nt1                                              srcu_read_lock()\nt2              if (!hlist_unhashed())\nt3                                              srcu_read_unlock()\nt4              srcu_read_lock()\nt5                                              hlist_del_init_rcu()\nt6                                              synchronize_srcu()\nt7              srcu_read_unlock()\nt8              hlist_del_rcu()  \u003c--- NULL pointer deref.\n\nAdditionally, the list traversal in __mmu_notifier_release() is not\nprotected by the by the mmu_notifier_mm-\u003ehlist_lock which can result in\ncallouts to the -\u003erelease() notifier from both mmu_notifier_unregister()\nand __mmu_notifier_release().\n\n-stable suggestions:\n\nThe stable trees prior to 3.7.y need commits 21a92735f660 and\n70400303ce0c cherry-picked in that order prior to cherry-picking this\ncommit.  The 3.7.y tree already has those two commits.\n\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nCc: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Avi Kivity \u003cavi@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Sagi Grimberg \u003csagig@mellanox.co.il\u003e\nCc: Haggai Eran \u003chaggaie@mellanox.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8a5ac8c686b03480fae7d5b193a5c714c7c2397b",
      "old_mode": 33188,
      "old_path": "mm/mmu_notifier.c",
      "new_id": "f5c3d968d8c6bedf2ddae4356bd2d402efce5f98",
      "new_mode": 33188,
      "new_path": "mm/mmu_notifier.c"
    }
  ]
}