)]}'
{
  "commit": "bf95d20fdbd602d72c28a009a55d90d5109b8a86",
  "tree": "be1a7046b7ae3370d2fa722745addd480752baad",
  "parents": [
    "7514bab04e567c9408fe0facbde4277f09d5eb74"
  ],
  "author": {
    "name": "Hendrik Brueckner",
    "email": "brueckner@linux.vnet.ibm.com",
    "time": "Wed Sep 16 04:37:28 2009 +0000"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Wed Sep 16 20:57:39 2009 -0700"
  },
  "message": "af_iucv: fix race when queueing skbs on the backlog queue\n\niucv_sock_recvmsg() and iucv_process_message()/iucv_fragment_skb race\nfor dequeuing an skb from the backlog queue.\n\nIf iucv_sock_recvmsg() dequeues first, iucv_process_message() calls\nsock_queue_rcv_skb() with an skb that is NULL.\n\nThis results in the following kernel panic:\n\n\u003c1\u003eUnable to handle kernel pointer dereference at virtual kernel address (null)\n\u003c4\u003eOops: 0004 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n\u003c4\u003eModules linked in: af_iucv sunrpc qeth_l3 dm_multipath dm_mod vmur qeth ccwgroup\n\u003c4\u003eCPU: 0 Not tainted 2.6.30 #4\n\u003c4\u003eProcess client-iucv (pid: 4787, task: 0000000034e75940, ksp: 00000000353e3710)\n\u003c4\u003eKrnl PSW : 0704000180000000 000000000043ebca (sock_queue_rcv_skb+0x7a/0x138)\n\u003c4\u003e           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 EA:3\n\u003c4\u003eKrnl GPRS: 0052900000000000 000003e0016e0fe8 0000000000000000 0000000000000000\n\u003c4\u003e           000000000043eba8 0000000000000002 0000000000000001 00000000341aa7f0\n\u003c4\u003e           0000000000000000 0000000000007800 0000000000000000 0000000000000000\n\u003c4\u003e           00000000341aa7f0 0000000000594650 000000000043eba8 000000003fc2fb28\n\u003c4\u003eKrnl Code: 000000000043ebbe: a7840006            brc     8,43ebca\n\u003c4\u003e           000000000043ebc2: 5930c23c            c       %r3,572(%r12)\n\u003c4\u003e           000000000043ebc6: a724004c            brc     2,43ec5e\n\u003c4\u003e          \u003e000000000043ebca: e3c0b0100024        stg     %r12,16(%r11)\n\u003c4\u003e           000000000043ebd0: a7190000            lghi    %r1,0\n\u003c4\u003e           000000000043ebd4: e310b0200024        stg     %r1,32(%r11)\n\u003c4\u003e           000000000043ebda: c010ffffdce9        larl    %r1,43a5ac\n\u003c4\u003e           000000000043ebe0: e310b0800024        stg     %r1,128(%r11)\n\u003c4\u003eCall Trace:\n\u003c4\u003e([\u003c000000000043eba8\u003e] sock_queue_rcv_skb+0x58/0x138)\n\u003c4\u003e [\u003c000003e0016bcf2a\u003e] iucv_process_message+0x112/0x3cc [af_iucv]\n\u003c4\u003e [\u003c000003e0016bd3d4\u003e] iucv_callback_rx+0x1f0/0x274 [af_iucv]\n\u003c4\u003e [\u003c000000000053a21a\u003e] iucv_message_pending+0xa2/0x120\n\u003c4\u003e [\u003c000000000053b5a6\u003e] iucv_tasklet_fn+0x176/0x1b8\n\u003c4\u003e [\u003c000000000014fa82\u003e] tasklet_action+0xfe/0x1f4\n\u003c4\u003e [\u003c0000000000150a56\u003e] __do_softirq+0x116/0x284\n\u003c4\u003e [\u003c0000000000111058\u003e] do_softirq+0xe4/0xe8\n\u003c4\u003e [\u003c00000000001504ba\u003e] irq_exit+0xba/0xd8\n\u003c4\u003e [\u003c000000000010e0b2\u003e] do_extint+0x146/0x190\n\u003c4\u003e [\u003c00000000001184b6\u003e] ext_no_vtime+0x1e/0x22\n\u003c4\u003e [\u003c00000000001fbf4e\u003e] kfree+0x202/0x28c\n\u003c4\u003e([\u003c00000000001fbf44\u003e] kfree+0x1f8/0x28c)\n\u003c4\u003e [\u003c000000000044205a\u003e] __kfree_skb+0x32/0x124\n\u003c4\u003e [\u003c000003e0016bd8b2\u003e] iucv_sock_recvmsg+0x236/0x41c [af_iucv]\n\u003c4\u003e [\u003c0000000000437042\u003e] sock_aio_read+0x136/0x160\n\u003c4\u003e [\u003c0000000000205e50\u003e] do_sync_read+0xe4/0x13c\n\u003c4\u003e [\u003c0000000000206dce\u003e] vfs_read+0x152/0x15c\n\u003c4\u003e [\u003c0000000000206ed0\u003e] SyS_read+0x54/0xac\n\u003c4\u003e [\u003c0000000000117c8e\u003e] sysc_noemu+0x10/0x16\n\u003c4\u003e [\u003c00000042ff8def3c\u003e] 0x42ff8def3c\n\nSigned-off-by: Hendrik Brueckner \u003cbrueckner@linux.vnet.ibm.com\u003e\nSigned-off-by: Ursula Braun \u003cursula.braun@de.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c23ed4ff04c63a63d963a4faddd7d2aa28690ea1",
      "old_mode": 33188,
      "old_path": "net/iucv/af_iucv.c",
      "new_id": "d985d163dcfc12590948cefcb5af50af3d08754e",
      "new_mode": 33188,
      "new_path": "net/iucv/af_iucv.c"
    }
  ]
}