)]}'
{
  "commit": "1174cf730179d8f029b9e93cb9a4d5bfb08d1202",
  "tree": "0d02da2b8a543ff014f44e87c78fd9e837861113",
  "parents": [
    "833f80627d10d370ea91b96de254850361c3a2fc"
  ],
  "author": {
    "name": "Vasily Averin",
    "email": "vvs@sw.ru",
    "time": "Fri Mar 16 13:38:24 2007 -0800"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@woody.linux-foundation.org",
    "time": "Fri Mar 16 19:25:05 2007 -0700"
  },
  "message": "[PATCH] smbfs: double free memory corruption\n\nsmbfs allocates rq_trans2buffer to handle server\u0027s multi transaction2 response\nmessages.  As struct smb_request may be reused, rq_trans2buffer is freed\nbefore each new request.  However if last servers\u0027s response is not multi but\nsingle trans2 message then new rq_trans2buffer is not allocated but last\nsmb_rput still tries to free it again.\n\nTo prevent this issue rq_trans2buffer pointer should be set to NULL after\nkfree.\n\nSigned-off-by: Vasily Averin \u003cvvs@sw.ru\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "42261dbdf60f172270dff8c70c1942c50a2ce0b3",
      "old_mode": 33188,
      "old_path": "fs/smbfs/request.c",
      "new_id": "723f7c6676614f6343ad6d3df7ca850c434eb282",
      "new_mode": 33188,
      "new_path": "fs/smbfs/request.c"
    }
  ]
}