)]}'
{
  "commit": "d2d155d1ae8c704a37f42fd3ebb1f3846f78e4d4",
  "tree": "457f75e468727b89035ac0ed055fbd3c980743ce",
  "parents": [
    "803d18fc6c656c5410a62157de0328a669e1b56b"
  ],
  "author": {
    "name": "Ian Lance Taylor",
    "email": "iant@golang.org",
    "time": "Tue Jan 19 21:30:36 2021 -0800"
  },
  "committer": {
    "name": "Ian Lance Taylor",
    "email": "iant@golang.org",
    "time": "Wed Jan 20 19:55:44 2021 +0000"
  },
  "message": "runtime: don\u0027t adjust timer pp field in timerWaiting status\n\nBefore this CL, the following sequence was possible:\n\n* GC scavenger starts and sets up scavenge.timer\n* GC calls readyForScavenger, but sysmon is sleeping\n* program calls runtime.GOMAXPROCS to shrink number of processors\n* procresize destroys a P, the one that scavenge.timer is on\n* (*pp).destroy calls moveTimers, which gets to the scavenger timer\n* scavenger timer is timerWaiting, and moveTimers clears t.pp\n* sysmon wakes up and calls wakeScavenger\n* wakeScavengers calls stopTimer on scavenger.timer, still timerWaiting\n* stopTimer calls deltimer which loads t.pp, which is still nil\n* stopTimer tries to increment deletedTimers on nil t.pp, and crashes\n\nThe point of vulnerability is the time that t.pp is set to nil by\nmoveTimers and the time that t.pp is set to non-nil by moveTimers,\nwhich is a few instructions at most. So it\u0027s not likely and in\nparticular is quite unlikely on x86. But with a more relaxed memory\nmodel the area of vulnerability can be somewhat larger. This appears\nto tbe the cause of two builder failures in a few months on linux-mips.\n\nThis CL fixes the problem by making moveTimers change the status from\ntimerWaiting to timerMoving while t.pp is clear. That will cause\ndeltimer to wait until the status is back to timerWaiting, at which\npoint t.pp has been set again.\n\nFixes #43712\n\nChange-Id: I66838319ecfbf15be66c1fac88d9bd40e2295852\nReviewed-on: https://go-review.googlesource.com/c/go/+/284775\nTrust: Ian Lance Taylor \u003ciant@golang.org\u003e\nReviewed-by: Michael Knyszek \u003cmknyszek@google.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d338705b7c4c5ab9f90a7a23324c9653bbf1c7ed",
      "old_mode": 33188,
      "old_path": "src/runtime/time.go",
      "new_id": "8ab2a0343011d20022dcd0eff406bfb42e2d579e",
      "new_mode": 33188,
      "new_path": "src/runtime/time.go"
    }
  ]
}