)]}'
{
  "commit": "afde0dae8ee521686465141a44aa8060f4805cab",
  "tree": "e25d124f650423240f54d92d568839bb4e528aef",
  "parents": [
    "ae77ce9aa720eefa34f3644d0d9e3ce3976e8f07"
  ],
  "author": {
    "name": "Heiko Carstens",
    "email": "heiko.carstens@de.ibm.com",
    "time": "Wed May 09 09:37:30 2012 +0200"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Fri Jun 01 15:18:15 2012 +0800"
  },
  "message": "s390/pfault: fix task state race\n\ncommit d5e50a51ccbda36b379aba9d1131a852eb908dda upstream.\n\nWhen setting the current task state to TASK_UNINTERRUPTIBLE this can\nrace with a different cpu. The other cpu could set the task state after\nit inspected it (while it was still TASK_RUNNING) to TASK_RUNNING which\nwould change the state from TASK_UNINTERRUPTIBLE to TASK_RUNNING again.\n\nThis race was always present in the pfault interrupt code but didn\u0027t\ncause anything harmful before commit f2db2e6c \"[S390] pfault: cpu hotplug\nvs missing completion interrupts\" which relied on the fact that after\nsetting the task state to TASK_UNINTERRUPTIBLE the task would really\nsleep.\nSince this is not necessarily the case the result may be a list corruption\nof the pfault_list or, as observed, a use-after-free bug while trying to\naccess the task_struct of a task which terminated itself already.\n\nTo fix this, we need to get a reference of the affected task when receiving\nthe initial pfault interrupt and add special handling if we receive yet\nanother initial pfault interrupt when the task is already enqueued in the\npfault list.\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nReviewed-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "46ef3fd0663b5c1dfca0ca3b0d175c7a5d4fe990",
      "old_mode": 33188,
      "old_path": "arch/s390/mm/fault.c",
      "new_id": "4e66860029f346a9bd21e6953b0d5bb011577839",
      "new_mode": 33188,
      "new_path": "arch/s390/mm/fault.c"
    }
  ]
}