)]}'
{
  "commit": "181b64803661209cda64e5e874ad75f373a69de8",
  "tree": "0e0ee378b98e5ee72aeae428b1f155d031fe2597",
  "parents": [
    "683e91cbd0582cb8e63daaf0429e0a62be9cc421"
  ],
  "author": {
    "name": "Paul Jackson",
    "email": "pj@sgi.com",
    "time": "Fri Sep 29 02:01:48 2006 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@g5.osdl.org",
    "time": "Fri Sep 29 09:18:25 2006 -0700"
  },
  "message": "[PATCH] cpuset: fix obscure attach_task vs exiting race\n\nFix obscure race condition in kernel/cpuset.c attach_task() code.\n\nThere is basically zero chance of anyone accidentally being harmed by this\nrace.\n\nIt requires a special \u0027micro-stress\u0027 load and a special timing loop hacks\nin the kernel to hit in less than an hour, and even then you\u0027d have to hit\nit hundreds or thousands of times, followed by some unusual and senseless\ncpuset configuration requests, including removing the top cpuset, to cause\nany visibly harm affects.\n\nOne could, with perhaps a few days or weeks of such effort, get the\nreference count on the top cpuset below zero, and manage to crash the\nkernel by asking to remove the top cpuset.\n\nI found it by code inspection.\n\nThe race was introduced when \u0027the_top_cpuset_hack\u0027 was introduced, and one\npiece of code was not updated.  An old check for a possibly null task\ncpuset pointer needed to be changed to a check for a task marked\nPF_EXITING.  The pointer can\u0027t be null anymore, thanks to\nthe_top_cpuset_hack (documented in kernel/cpuset.c).  But the task could\nhave gone into PF_EXITING state after it was found in the task_list scan.\n\nIf a task is PF_EXITING in this code, it is possible that its task-\u003ecpuset\npointer is pointing to the top cpuset due to the_top_cpuset_hack, rather\nthan because the top_cpuset was that tasks last valid cpuset.  In that\ncase, the wrong cpuset reference counter would be decremented.\n\nThe fix is trivial.  Instead of failing the system call if the tasks cpuset\npointer is null here, fail it if the task is in PF_EXITING state.\n\nThe code for \u0027the_top_cpuset_hack\u0027 that changes an exiting tasks cpuset to\nthe top_cpuset is done without locking, so could happen at anytime.  But it\nis done during the exit handling, after the PF_EXITING flag is set.  So if\nwe verify that a task is still not PF_EXITING after we copy out its cpuset\npointer (into \u0027oldcs\u0027, below), we know that \u0027oldcs\u0027 is not one of these\nhack references to the top_cpuset.\n\nSigned-off-by: Paul Jackson \u003cpj@sgi.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cc0395d7eba1357c0dc8dde822b1c5c21e7af41d",
      "old_mode": 33188,
      "old_path": "kernel/cpuset.c",
      "new_id": "8c3c400cce91f4a679e0d034380ca16065b296a5",
      "new_mode": 33188,
      "new_path": "kernel/cpuset.c"
    }
  ]
}