)]}'
{
  "commit": "c0729eeefdcd76db338f635162bf0739fd2c5f6f",
  "tree": "93325e4764bd7144631ff129b4e0f412f48d0d7f",
  "parents": [
    "34ffb33e09132401872fe79e95c30824ce194d23"
  ],
  "author": {
    "name": "Ian Abbott",
    "email": "abbotti@mev.co.uk",
    "time": "Fri Jan 04 11:33:21 2013 +0000"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Mon Jan 07 14:48:25 2013 -0800"
  },
  "message": "staging: comedi: comedi_test: fix race when cancelling command\n\nÉric Piel reported a kernel oops in the \"comedi_test\" module.  It was a\nNULL pointer dereference within `waveform_ai_interrupt()` (actually a\ntimer function) that sometimes occurred when a running asynchronous\ncommand is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing\nthe device file).\n\nThis seems to be a race between the caller of `waveform_ai_cancel()`\nwhich on return from that function goes and tears down the running\ncommand, and the timer function which uses the command.  In particular,\n`async-\u003ecmd.chanlist` gets freed (and the pointer set to NULL) by\n`do_become_nonbusy()` in \"comedi_fops.c\" but a previously scheduled\n`waveform_ai_interrupt()` timer function will dereference that pointer\nregardless, leading to the oops.\n\nFix it by replacing the `del_timer()` call in `waveform_ai_cancel()`\nwith `del_timer_sync()`.\n\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nReported-by: Éric Piel \u003cpiel@delmic.com\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fb3d09323ba145c2460408971459ee29f39bd63b",
      "old_mode": 33188,
      "old_path": "drivers/staging/comedi/drivers/comedi_test.c",
      "new_id": "01de996239f1e6142f07f9851cc840e8ddc14a75",
      "new_mode": 33188,
      "new_path": "drivers/staging/comedi/drivers/comedi_test.c"
    }
  ]
}