)]}'
{
  "commit": "aef0f62e87122c0fb90d5da660fd131acd0a9d67",
  "tree": "d540031839fa4841b5e73a339beacd56c612baba",
  "parents": [
    "8f9f665a707721146f24a892b1a0da1ab4da1d58"
  ],
  "author": {
    "name": "Lai Jiangshan",
    "email": "laijs@cn.fujitsu.com",
    "time": "Fri Jun 06 14:37:12 2014 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Fri Jun 06 16:08:12 2014 -0700"
  },
  "message": "idr: fix NULL pointer dereference when ida_remove(unallocated_id)\n\nIf the ida has at least one existing id, and when an unallocated ID\nwhich meets a certain condition is passed to the ida_remove(), the\nsystem will crash because it hits NULL pointer dereference.\n\nThe condition is that the unallocated ID shares the same lowest idr\nlayer with the existing ID, but the idr slot would be different if the\nunallocated ID were to be allocated.\n\nIn this case the matching idr slot for the unallocated_id is NULL,\ncausing @bitmap to be NULL which the function dereferences without\nchecking crashing the kernel.\n\nSee the test code:\n\n  static void test3(void)\n  {\n        int id;\n        DEFINE_IDA(test_ida);\n\n        printk(KERN_INFO \"Start test3\\n\");\n        if (ida_pre_get(\u0026test_ida, GFP_KERNEL) \u003c 0) return;\n        if (ida_get_new(\u0026test_ida,  \u0026id) \u003c 0) return;\n        ida_remove(\u0026test_ida, 4000); /* bug: null deference here */\n        printk(KERN_INFO \"End of test3\\n\");\n  }\n\nIt happens only when the caller tries to free an unallocated ID which is\nthe caller\u0027s fault.  It is not a bug.  But it is better to add the\nproper check and complain rather than crashing the kernel.\n\n[tj@kernel.org: updated patch description]\nSigned-off-by: Lai Jiangshan \u003claijs@cn.fujitsu.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c4afd94bdf69abd2a09ff4e75222592d976a796c",
      "old_mode": 33188,
      "old_path": "lib/idr.c",
      "new_id": "36ff732fd2a6dca0847373d7b3a45048c2f0d0f7",
      "new_mode": 33188,
      "new_path": "lib/idr.c"
    }
  ]
}