)]}'
{
  "commit": "d34883d4e35c0a994e91dd847a82b4c9e0c31d83",
  "tree": "f141323369c629f8de23bf7bb8f814f643228532",
  "parents": [
    "4c663cfc523a88d97a8309b04a089c27dc57fd7e"
  ],
  "author": {
    "name": "Xiao Guangrong",
    "email": "xiaoguangrong@linux.vnet.ibm.com",
    "time": "Fri May 24 15:55:11 2013 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Fri May 24 16:22:51 2013 -0700"
  },
  "message": "mm: mmu_notifier: re-fix freed page still mapped in secondary MMU\n\nCommit 751efd8610d3 (\"mmu_notifier_unregister NULL Pointer deref and\nmultiple -\u003erelease()\") breaks the fix 3ad3d901bbcf (\"mm: mmu_notifier:\nfix freed page still mapped in secondary MMU\").\n\nSince hlist_for_each_entry_rcu() is changed now, we can not revert that\npatch directly, so this patch reverts the commit and simply fix the bug\nspotted by that patch\n\nThis bug spotted by commit 751efd8610d3 is:\n\n    There is a race condition between mmu_notifier_unregister() and\n    __mmu_notifier_release().\n\n    Assume two tasks, one calling mmu_notifier_unregister() as a result\n    of a filp_close() -\u003eflush() callout (task A), and the other calling\n    mmu_notifier_release() from an mmput() (task B).\n\n                        A                               B\n    t1                                            srcu_read_lock()\n    t2            if (!hlist_unhashed())\n    t3                                            srcu_read_unlock()\n    t4            srcu_read_lock()\n    t5                                            hlist_del_init_rcu()\n    t6                                            synchronize_srcu()\n    t7            srcu_read_unlock()\n    t8            hlist_del_rcu()  \u003c--- NULL pointer deref.\n\nThis can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.\n\nThe another issue spotted in the commit is \"multiple -\u003erelease()\ncallouts\", we needn\u0027t care it too much because it is really rare (e.g,\ncan not happen on kvm since mmu-notify is unregistered after\nexit_mmap()) and the later call of multiple -\u003erelease should be fast\nsince all the pages have already been released by the first call.\nAnyway, this issue should be fixed in a separate patch.\n\n-stable suggestions: Any version that has commit 751efd8610d3 need to be\nbackported.  I find the oldest version has this commit is 3.0-stable.\n\n[akpm@linux-foundation.org: tweak comments]\nSigned-off-by: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nTested-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "be04122fb277acd6a43a2f020e184ed2065258df",
      "old_mode": 33188,
      "old_path": "mm/mmu_notifier.c",
      "new_id": "6725ff183374280ac9a5dcc786cd42f91d3cf669",
      "new_mode": 33188,
      "new_path": "mm/mmu_notifier.c"
    }
  ]
}