)]}'
{
  "commit": "94d7c16cbbbd0e03841fcf272bcaf0620ad39618",
  "tree": "12a4d8b28bd5bf338b9bd1874e18d4bfdc77837a",
  "parents": [
    "9084d4719784b00ff0bf9c9580007fac8277dbcb"
  ],
  "author": {
    "name": "Akira Fujita",
    "email": "a-fujita@rs.jp.nec.com",
    "time": "Tue Nov 24 10:19:57 2009 -0500"
  },
  "committer": {
    "name": "Theodore Ts\u0027o",
    "email": "tytso@mit.edu",
    "time": "Tue Nov 24 10:19:57 2009 -0500"
  },
  "message": "ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT\n\nAt the beginning of ext4_move_extent(), we call\next4_discard_preallocations() to discard inode PAs of orig and donor\ninodes.  But in the following case, blocks can be double freed, so\nmove ext4_discard_preallocations() to the end of ext4_move_extents().\n\n1. Discard inode PAs of orig and donor inodes with\n   ext4_discard_preallocations() in ext4_move_extents().\n\n   orig : [ DATA1 ]\n   donor: [ DATA2 ]\n\n2. While data blocks are exchanging between orig and donor inodes, new\n   inode PAs is created to orig by other process\u0027s block allocation.\n   (Since there are semaphore gaps in ext4_move_extents().)  And new\n   inode PAs is used partially (2-1).\n\n   2-1 Create new inode PAs to orig inode\n   orig : [ DATA1 | used PA1 | free PA1 ]\n   donor: [ DATA2 ]\n\n3. Donor inode which has old orig inode\u0027s blocks is deleted after\n   EXT4_IOC_MOVE_EXT finished (3-1, 3-2).  So the block bitmap\n   corresponds to old orig inode\u0027s blocks are freed.\n\n   3-1 After EXT4_IOC_MOVE_EXT finished\n   orig : [ DATA2 |  free PA1 ]\n   donor: [ DATA1 |  used PA1 ]\n\n   3-2 Delete donor inode\n   orig : [ DATA2 |  free PA1 ]\n   donor: [ FREE SPACE(DATA1) | FREE SPACE(used PA1) ]\n\n4. The double-free of blocks is occurred, when close() is called to\n   orig inode.  Because ext4_discard_preallocations() for orig inode\n   frees used PA1 and free PA1, though used PA1 is already freed in 3.\n\n   4-1 Double-free of blocks is occurred\n   orig : [ DATA2 |  FREE SPACE(free PA1) ]\n   donor: [ FREE SPACE(DATA1) | DOUBLE FREE(used PA1) ]\n\nSigned-off-by: Akira Fujita \u003ca-fujita@rs.jp.nec.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5a106e02fd9cc48f5960ee973808675b0ed6ea3e",
      "old_mode": 33188,
      "old_path": "fs/ext4/move_extent.c",
      "new_id": "3478889e00b38b364ba9f652e05f92e9fcdf36bb",
      "new_mode": 33188,
      "new_path": "fs/ext4/move_extent.c"
    }
  ]
}