)]}'
{
  "commit": "ceeff7541e5a4ba8e8d97ffbae32b3f283cb7a3f",
  "tree": "93d2074ac54895daf981fed524989d892bfcb346",
  "parents": [
    "b66985b11b8b00e1ec65b89a3112510ac9a9ec6e"
  ],
  "author": {
    "name": "Patrick McHardy",
    "email": "kaber@trash.net",
    "time": "Wed Jun 11 17:51:10 2008 -0700"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Wed Jun 11 17:51:10 2008 -0700"
  },
  "message": "netfilter: nf_conntrack: fix ctnetlink related crash in nf_nat_setup_info()\n\nWhen creation of a new conntrack entry in ctnetlink fails after having\nset up the NAT mappings, the conntrack has an extension area allocated\nthat is not getting properly destroyed when freeing the conntrack again.\nThis means the NAT extension is still in the bysource hash, causing a\ncrash when walking over the hash chain the next time:\n\nBUG: unable to handle kernel paging request at 00120fbd\nIP: [\u003cc03d394b\u003e] nf_nat_setup_info+0x221/0x58a\n*pde \u003d 00000000\nOops: 0000 [#1] PREEMPT SMP\n\nPid: 2795, comm: conntrackd Not tainted (2.6.26-rc5 #1)\nEIP: 0060:[\u003cc03d394b\u003e] EFLAGS: 00010206 CPU: 1\nEIP is at nf_nat_setup_info+0x221/0x58a\nEAX: 00120fbd EBX: 00120fbd ECX: 00000001 EDX: 00000000\nESI: 0000019e EDI: e853bbb4 EBP: e853bbc8 ESP: e853bb78\n DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068\nProcess conntrackd (pid: 2795, ti\u003de853a000 task\u003df7de10f0 task.ti\u003de853a000)\nStack: 00000000 e853bc2c e85672ec 00000008 c0561084 63c1db4a 00000000 00000000\n       00000000 0002e109 61d2b1c3 00000000 00000000 00000000 01114e22 61d2b1c3\n       00000000 00000000 f7444674 e853bc04 00000008 c038e728 0000000a f7444674\nCall Trace:\n [\u003cc038e728\u003e] nla_parse+0x5c/0xb0\n [\u003cc0397c1b\u003e] ctnetlink_change_status+0x190/0x1c6\n [\u003cc0397eec\u003e] ctnetlink_new_conntrack+0x189/0x61f\n [\u003cc0119aee\u003e] update_curr+0x3d/0x52\n [\u003cc03902d1\u003e] nfnetlink_rcv_msg+0xc1/0xd8\n [\u003cc0390228\u003e] nfnetlink_rcv_msg+0x18/0xd8\n [\u003cc0390210\u003e] nfnetlink_rcv_msg+0x0/0xd8\n [\u003cc038d2ce\u003e] netlink_rcv_skb+0x2d/0x71\n [\u003cc0390205\u003e] nfnetlink_rcv+0x19/0x24\n [\u003cc038d0f5\u003e] netlink_unicast+0x1b3/0x216\n ...\n\nMove invocation of the extension destructors to nf_conntrack_free()\nto fix this problem.\n\nFixes http://bugzilla.kernel.org/show_bug.cgi?id\u003d10875\n\nReported-and-Tested-by: Krzysztof Piotr Oledzki \u003cole@ans.pl\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c4b1799da5d76ac98920527e9fe85d30866ff9c8",
      "old_mode": 33188,
      "old_path": "net/netfilter/nf_conntrack_core.c",
      "new_id": "662c1ccfee262c8047974205c75dca631df51c96",
      "new_mode": 33188,
      "new_path": "net/netfilter/nf_conntrack_core.c"
    }
  ]
}