)]}'
{
  "commit": "e182bb38d7db7494fa5dcd82da17fe0dedf60ecf",
  "tree": "5373b72d6bbd6e9b0bda8fae65dd91f3603c3d54",
  "parents": [
    "1a13c0b181f218bf56a1a6b8edbaf2876b22314b"
  ],
  "author": {
    "name": "Tejun Heo",
    "email": "tj@kernel.org",
    "time": "Wed Feb 20 15:24:12 2013 -0800"
  },
  "committer": {
    "name": "Thomas Gleixner",
    "email": "tglx@linutronix.de",
    "time": "Thu Feb 21 17:28:29 2013 +0100"
  },
  "message": "posix-timer: Don\u0027t call idr_find() with out-of-range ID\n\nWhen idr_find() was fed a negative ID, it used to look up the ID\nignoring the sign bit before recent (\"idr: remove MAX_IDR_MASK and\nmove left MAX_IDR_* into idr.c\") patch. Now a negative ID triggers\na WARN_ON_ONCE().\n\n__lock_timer() feeds timer_id from userland directly to idr_find()\nwithout sanitizing it which can trigger the above malfunctions.  Add a\nrange check on @timer_id before invoking idr_find() in __lock_timer().\n\nWhile timer_t is defined as int by all archs at the moment, Andrew\nworries that it may be defined as a larger type later on.  Make the\ntest cover larger integers too so that it at least is guaranteed to\nnot return the wrong timer.\n\nNote that WARN_ON_ONCE() in idr_find() on id \u003c 0 is transitional\nprecaution while moving away from ignoring MSB.  Once it\u0027s gone we can\nremove the guard as long as timer_t isn\u0027t larger than int.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003ennn\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20130220232412.GL3570@htj.dyndns.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "10349d5f2ec311afe81c17ff533aec6ddbd83d09",
      "old_mode": 33188,
      "old_path": "kernel/posix-timers.c",
      "new_id": "7edfe4b901e7a7487f65d3704034ce8148f748fc",
      "new_mode": 33188,
      "new_path": "kernel/posix-timers.c"
    }
  ]
}