)]}'
{
  "commit": "2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9",
  "tree": "890fd3916878e2427141d6e53dd70150ac7ff93e",
  "parents": [
    "2afc95bf546a961d2936d886c3802e159f1bae6b"
  ],
  "author": {
    "name": "David Jeffery",
    "email": "djeffery@redhat.com",
    "time": "Mon Sep 28 13:54:24 2009 -0400"
  },
  "committer": {
    "name": "James Bottomley",
    "email": "James.Bottomley@suse.de",
    "time": "Fri Oct 02 14:11:58 2009 -0500"
  },
  "message": "[SCSI] st: fix possible memory use after free after MTSETBLK ioctl\n\nA memory use after free bug can manifest if the MTSETBLK or SET_DENS_AND_BLK\nioctl features are used to set the tape\u0027s blocksize from 0 to non-zero.\nAfter the driver sets the new block size, in this one case it calls\nnormalize_buffer() to free the device\u0027s internal data buffers.  However, the\nioctl code assumes there is always a buffer and does not check or allocate\na buffer if there isn\u0027t one.  So any following ioctl calls can corrupt\na part of memory by writing data to memory that the st driver had freed.\n\nThis patch removes the normalize_buffer() call and the specialness of\nchanging from a 0 to non-zero blocksize to fix the possible use of\nmemory after it has been freed by the st driver.\n\nsigned-off-by: David Jeffery \u003cdjeffery@redhat.com\u003e\nAcked-by: Kai Makisara \u003ckai.makisara@kolumbus.fi\u003e\nSigned-off-by: James Bottomley \u003cJames.Bottomley@suse.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b33d04250bbc3badeeb3f00644f137402af07bf1",
      "old_mode": 33188,
      "old_path": "drivers/scsi/st.c",
      "new_id": "12d58a7ed6bc7dbbaa3a76250c9ab84497f52159",
      "new_mode": 33188,
      "new_path": "drivers/scsi/st.c"
    }
  ]
}