From: Willy Tarreau <w@1wt.eu> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ian Abbott <abbotti@mev.co.uk>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Willy Tarreau <w@1wt.eu> Subject: [ 069/184] staging: comedi: comedi_test: fix race when Date: Tue, 04 Jun 2013 19:22:39 +0200 [thread overview] Message-ID: <20130604172133.166370388@1wt.eu> (raw) In-Reply-To: <58df134a4b98edf5b0073e2e1e988fe6@local> [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1858 bytes --] 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ cancelling command From: Ian Abbott <abbotti@mev.co.uk> commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream. Éric Piel reported a kernel oops in the "comedi_test" module. It was a NULL pointer dereference within `waveform_ai_interrupt()` (actually a timer function) that sometimes occurred when a running asynchronous command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing the device file). This seems to be a race between the caller of `waveform_ai_cancel()` which on return from that function goes and tears down the running command, and the timer function which uses the command. In particular, `async->cmd.chanlist` gets freed (and the pointer set to NULL) by `do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled `waveform_ai_interrupt()` timer function will dereference that pointer regardless, leading to the oops. Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()` with `del_timer_sync()`. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Reported-by: Éric Piel <piel@delmic.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Willy Tarreau <w@1wt.eu> --- drivers/staging/comedi/drivers/comedi_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c index ef83a1a..7a1e2e8 100644 --- a/drivers/staging/comedi/drivers/comedi_test.c +++ b/drivers/staging/comedi/drivers/comedi_test.c @@ -450,7 +450,7 @@ static int waveform_ai_cancel(struct comedi_device *dev, struct comedi_subdevice *s) { devpriv->timer_running = 0; - del_timer(&devpriv->timer); + del_timer_sync(&devpriv->timer); return 0; } -- 1.7.12.2.21.g234cd45.dirty
WARNING: multiple messages have this Message-ID (diff)
From: Willy Tarreau <w@1wt.eu> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ian Abbott <abbotti@mev.co.uk>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Willy Tarreau <w@1wt.eu> Subject: [ 069/184] staging: comedi: comedi_test: fix race when Date: Tue, 04 Jun 2013 19:22:39 +0200 [thread overview] Message-ID: <20130604172133.166370388@1wt.eu> (raw) In-Reply-To: <58df134a4b98edf5b0073e2e1e988fe6@local> 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ cancelling command From: Ian Abbott <abbotti@mev.co.uk> commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream. �ric Piel reported a kernel oops in the "comedi_test" module. It was a NULL pointer dereference within `waveform_ai_interrupt()` (actually a timer function) that sometimes occurred when a running asynchronous command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing the device file). This seems to be a race between the caller of `waveform_ai_cancel()` which on return from that function goes and tears down the running command, and the timer function which uses the command. In particular, `async->cmd.chanlist` gets freed (and the pointer set to NULL) by `do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled `waveform_ai_interrupt()` timer function will dereference that pointer regardless, leading to the oops. Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()` with `del_timer_sync()`. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Reported-by: �ric Piel <piel@delmic.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Willy Tarreau <w@1wt.eu> --- drivers/staging/comedi/drivers/comedi_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c index ef83a1a..7a1e2e8 100644 --- a/drivers/staging/comedi/drivers/comedi_test.c +++ b/drivers/staging/comedi/drivers/comedi_test.c @@ -450,7 +450,7 @@ static int waveform_ai_cancel(struct comedi_device *dev, struct comedi_subdevice *s) { devpriv->timer_running = 0; - del_timer(&devpriv->timer); + del_timer_sync(&devpriv->timer); return 0; } -- 1.7.12.2.21.g234cd45.dirty
next prev parent reply other threads:[~2013-06-04 23:15 UTC|newest] Thread overview: 247+ messages / expand[flat|nested] mbox.gz Atom feed top 2013-06-04 17:21 [ 000/184] 2.6.32.61-longterm review Willy Tarreau 2013-06-04 17:21 ` Willy Tarreau 2013-06-04 17:21 ` [ 001/184] Revert "pcdp: use early_ioremap/early_iounmap to Willy Tarreau 2013-06-04 17:21 ` [ 002/184] Revert "block: improve queue_should_plug() by Willy Tarreau 2013-06-04 17:21 ` [ 003/184] 2.6.32.y: timekeeping: Fix nohz issue with commit Willy Tarreau 2013-06-04 17:21 ` [ 004/184] clockevents: Dont allow dummy broadcast timers Willy Tarreau 2013-06-04 17:21 ` Willy Tarreau 2013-06-04 17:21 ` [ 005/184] posix-cpu-timers: Fix nanosleep task_struct leak Willy Tarreau 2013-06-04 17:21 ` [ 006/184] timer: Dont reinitialize the cpu base lock during Willy Tarreau 2013-06-04 17:21 ` [ 007/184] tick: Cleanup NOHZ per cpu data on cpu down Willy Tarreau 2013-06-04 17:21 ` [ 008/184] kbuild: Fix gcc -x syntax Willy Tarreau 2013-06-04 17:21 ` [ 009/184] gen_init_cpio: avoid stack overflow when expanding Willy Tarreau 2013-06-04 17:21 ` [ 010/184] usermodehelper: introduce umh_complete(sub_info) Willy Tarreau 2013-06-07 4:50 ` Ben Hutchings 2013-06-07 5:40 ` Willy Tarreau 2013-06-04 17:21 ` [ 011/184] usermodehelper: implement UMH_KILLABLE Willy Tarreau 2013-06-04 17:21 ` [ 012/184] usermodehelper: ____call_usermodehelper() doesnt Willy Tarreau 2013-06-04 17:21 ` [ 013/184] kmod: introduce call_modprobe() helper Willy Tarreau 2013-06-04 17:21 ` [ 014/184] kmod: make __request_module() killable Willy Tarreau 2013-06-04 17:21 ` [ 015/184] exec: do not leave bprm->interp on stack Willy Tarreau 2013-06-04 17:21 ` [ 016/184] exec: use -ELOOP for max recursion depth Willy Tarreau 2013-06-04 17:21 ` [ 017/184] signal: always clear sa_restorer on execve Willy Tarreau 2013-06-04 17:21 ` [ 018/184] ptrace: ptrace_resume() shouldnt wake up Willy Tarreau 2013-06-04 17:21 ` [ 019/184] ptrace: introduce signal_wake_up_state() and Willy Tarreau 2013-06-04 17:21 ` [ 020/184] ptrace: ensure arch_ptrace/ptrace_request can never Willy Tarreau 2013-06-05 9:36 ` Luis Henriques 2013-06-05 11:01 ` Willy Tarreau 2013-06-05 15:40 ` Oleg Nesterov 2013-06-05 15:49 ` Oleg Nesterov 2013-06-05 16:13 ` Willy Tarreau 2013-06-07 10:46 ` Oleg Nesterov 2013-06-07 11:35 ` Luis Henriques 2013-06-04 17:21 ` [ 021/184] kernel/signal.c: stop info leak via the tkill and Willy Tarreau 2013-06-04 17:21 ` [ 022/184] signal: Define __ARCH_HAS_SA_RESTORER so we know Willy Tarreau 2013-06-04 17:21 ` [ 023/184] kernel/signal.c: use __ARCH_HAS_SA_RESTORER instead Willy Tarreau 2013-06-04 17:21 ` [ 024/184] wake_up_process() should be never used to wakeup a Willy Tarreau 2013-06-04 17:21 ` [ 025/184] coredump: prevent double-free on an error path in Willy Tarreau 2013-06-04 17:21 ` [ 026/184] kernel/sys.c: call disable_nonboot_cpus() in Willy Tarreau 2013-06-04 17:21 ` [ 027/184] ring-buffer: Fix race between integrity check and Willy Tarreau 2013-06-07 14:07 ` Steven Rostedt 2013-06-07 14:19 ` Willy Tarreau 2013-06-04 17:21 ` [ 028/184] genalloc: stop crashing the system when destroying a Willy Tarreau 2013-06-04 17:21 ` [ 029/184] kernel/resource.c: fix stack overflow in Willy Tarreau 2013-06-04 17:22 ` [ 030/184] Driver core: treat unregistered bus_types as having Willy Tarreau 2013-06-04 17:22 ` [ 031/184] cgroup: remove incorrect dget/dput() pair in Willy Tarreau 2013-06-04 17:22 ` [ 032/184] Fix a dead loop in async_synchronize_full() Willy Tarreau 2013-06-04 17:22 ` [ 033/184] tracing: Dont call page_to_pfn() if page is NULL Willy Tarreau 2013-06-04 17:22 ` [ 034/184] tracing: Fix double free when function profile init Willy Tarreau 2013-06-04 17:22 ` [ 035/184] hugetlb: fix resv_map leak in error path Willy Tarreau 2013-06-04 17:22 ` [ 036/184] mm: fix vma_resv_map() NULL pointer Willy Tarreau 2013-06-04 17:22 ` [ 037/184] mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED Willy Tarreau 2013-06-04 17:22 ` [ 038/184] mm: bugfix: set current->reclaim_state to NULL while Willy Tarreau 2013-06-04 17:22 ` [ 039/184] mm: fix invalidate_complete_page2() lock ordering Willy Tarreau 2013-06-04 17:22 ` [ 040/184] mempolicy: fix a race in shared_policy_replace() Willy Tarreau 2013-06-04 17:22 ` [ 041/184] ALSA: hda - More ALC663 fixes and support of Willy Tarreau 2013-06-04 17:22 ` [ 042/184] ALSA: hda - Add a pin-fix for FSC Amilo Pi1505 Willy Tarreau 2013-06-04 17:22 ` [ 043/184] ALSA: seq: Fix missing error handling in Willy Tarreau 2013-06-04 17:22 ` [ 044/184] ALSA: ice1712: Initialize card->private_data Willy Tarreau 2013-06-07 3:48 ` Ben Hutchings 2013-06-07 5:34 ` Willy Tarreau 2013-06-07 6:12 ` Takashi Iwai 2013-06-07 6:22 ` Willy Tarreau 2013-06-04 17:22 ` [ 045/184] ALSA: ac97 - Fix missing NULL check in Willy Tarreau 2013-06-04 17:22 ` [ 046/184] x86, ioapic: initialize nr_ioapic_registers early in Willy Tarreau 2013-06-04 17:22 ` [ 047/184] x86: Dont use the EFI reboot method by default Willy Tarreau 2013-06-04 17:22 ` [ 048/184] x86, random: make ARCH_RANDOM prompt if EMBEDDED, Willy Tarreau 2013-06-04 17:22 ` [ 049/184] x86/xen: dont assume %ds is usable in xen_iret for Willy Tarreau 2013-06-07 6:28 ` Ben Hutchings 2013-06-07 15:55 ` Willy Tarreau 2013-06-04 17:22 ` [ 050/184] x86/msr: Add capabilities check Willy Tarreau 2013-06-04 17:22 ` [ 051/184] x86/mm: Check if PUD is large when validating a Willy Tarreau 2013-06-04 17:22 ` Willy Tarreau 2013-06-04 17:22 ` [ 052/184] x86, mm, paravirt: Fix vmalloc_fault oops during Willy Tarreau 2013-06-04 17:22 ` [ 053/184] xen/bootup: allow read_tscp call for Xen PV guests Willy Tarreau 2013-06-04 17:22 ` [ 054/184] xen/bootup: allow {read|write}_cr8 pvops call Willy Tarreau 2013-06-04 17:22 ` [ 055/184] KVM: x86: fix for buffer overflow in handling of Willy Tarreau 2013-06-04 17:22 ` [ 056/184] KVM: x86: relax MSR_KVM_SYSTEM_TIME alignment check Willy Tarreau 2013-06-07 6:32 ` Ben Hutchings 2013-06-07 15:59 ` Willy Tarreau 2013-06-04 17:22 ` [ 057/184] KVM: Fix bounds checking in ioapic indirect register Willy Tarreau 2013-06-04 17:22 ` [ 058/184] KVM: x86: invalid opcode oops on SET_SREGS with Willy Tarreau 2013-06-07 4:08 ` Ben Hutchings 2013-06-07 5:35 ` Willy Tarreau 2013-06-04 17:22 ` [ 059/184] MCE: Fix vm86 handling for 32bit mce handler Willy Tarreau 2013-06-04 17:22 ` [ 060/184] ACPI / cpuidle: Fix NULL pointer issues when cpuidle Willy Tarreau 2013-06-04 17:22 ` [ 061/184] PCI/PM: Clean up PME state when removing a device Willy Tarreau 2013-06-07 4:23 ` Ben Hutchings 2013-06-07 5:37 ` Willy Tarreau 2013-06-04 17:22 ` [ 062/184] alpha: Add irongate_io to PCI bus resources Willy Tarreau 2013-06-04 17:22 ` [ 063/184] PARISC: fix user-triggerable panic on parisc Willy Tarreau 2013-06-04 17:22 ` [ 064/184] serial: 8250, increase PASS_LIMIT Willy Tarreau 2013-06-04 17:22 ` [ 065/184] drivers/char/ipmi: memcpy, need additional 2 bytes Willy Tarreau 2013-06-04 17:22 ` [ 066/184] w1: fix oops when w1_search is called from netlink Willy Tarreau 2013-06-04 17:22 ` [ 067/184] staging: comedi: ni_labpc: correct differential Willy Tarreau 2013-06-04 17:22 ` [ 068/184] staging: comedi: ni_labpc: set up command4 register Willy Tarreau 2013-06-04 17:22 ` Willy Tarreau [this message] 2013-06-04 17:22 ` [ 069/184] staging: comedi: comedi_test: fix race when Willy Tarreau 2013-06-04 17:22 ` [ 070/184] staging: comedi: fix memory leak for saved channel Willy Tarreau 2013-06-04 17:22 ` [ 071/184] staging: comedi: s626: dont dereference insn->data Willy Tarreau 2013-06-04 17:22 ` [ 072/184] staging: comedi: jr3_pci: fix iomem dereference Willy Tarreau 2013-06-04 17:22 ` [ 073/184] staging: comedi: dont dereference user memory for Willy Tarreau 2013-06-04 17:22 ` [ 074/184] staging: comedi: check s->async for poll(), read() Willy Tarreau 2013-06-04 17:22 ` [ 075/184] staging: comedi: das08: Correct AO output for Willy Tarreau 2013-06-04 17:22 ` [ 076/184] staging: vt6656: [BUG] out of bound array reference Willy Tarreau 2013-06-04 17:22 ` [ 077/184] libata: fix Null pointer dereference on disk error Willy Tarreau 2013-06-04 17:22 ` [ 078/184] scsi: Silence unnecessary warnings about ioctl to Willy Tarreau 2013-06-04 17:22 ` [ 079/184] scsi: use __uX types for headers exported to user Willy Tarreau 2013-06-04 17:22 ` [ 080/184] [SCSI] fix crash in scsi_dispatch_cmd() Willy Tarreau 2013-06-04 17:22 ` [ 081/184] SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Willy Tarreau 2013-06-04 17:22 ` [ 082/184] keys: fix race with concurrent Willy Tarreau 2013-06-04 17:22 ` [ 083/184] crypto: cryptd - disable softirqs in Willy Tarreau 2013-06-04 17:22 ` [ 084/184] xfrm_user: fix info leak in copy_to_user_state() Willy Tarreau 2013-06-04 17:22 ` [ 085/184] xfrm_user: fix info leak in copy_to_user_policy() Willy Tarreau 2013-06-04 17:22 ` [ 086/184] xfrm_user: fix info leak in copy_to_user_tmpl() Willy Tarreau 2013-06-04 17:22 ` [ 087/184] xfrm_user: return error pointer instead of NULL Willy Tarreau 2013-06-04 17:22 ` [ 088/184] xfrm_user: return error pointer instead of NULL #2 Willy Tarreau 2013-06-04 17:22 ` [ 089/184] r8169: correct settings of rtl8102e Willy Tarreau 2013-06-04 17:23 ` [ 090/184] r8169: remove the obsolete and incorrect AMD Willy Tarreau 2013-06-04 17:23 ` Willy Tarreau 2013-06-04 17:23 ` [ 091/184] r8169: Add support for D-Link 530T rev C1 (Kernel Willy Tarreau 2013-06-04 17:23 ` [ 092/184] r8169: incorrect identifier for a 8168dp Willy Tarreau 2013-06-04 17:23 ` [ 093/184] b43legacy: Fix crash on unload when firmware not Willy Tarreau 2013-06-04 17:23 ` [ 094/184] tg3: Avoid null pointer dereference in tg3_interrupt Willy Tarreau 2013-06-04 17:23 ` [ 095/184] IPoIB: Fix use-after-free of multicast object Willy Tarreau 2013-06-04 17:23 ` [ 096/184] telephony: ijx: buffer overflow in ixj_write_cid() Willy Tarreau 2013-06-04 17:23 ` [ 097/184] Bluetooth: Fix incorrect strncpy() in Willy Tarreau 2013-06-07 4:53 ` Ben Hutchings 2013-06-07 5:41 ` Willy Tarreau 2013-06-04 17:23 ` [ 098/184] Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) Willy Tarreau 2013-06-04 17:23 ` [ 099/184] Bluetooth: RFCOMM - Fix info leak via getsockname() Willy Tarreau 2013-06-04 17:23 ` [ 100/184] Bluetooth: RFCOMM - Fix missing msg_namelen update Willy Tarreau 2013-06-04 17:23 ` [ 101/184] Bluetooth: L2CAP - Fix info leak via getsockname() Willy Tarreau 2013-06-04 17:23 ` [ 102/184] Bluetooth: fix possible info leak in Willy Tarreau 2013-06-07 6:35 ` Ben Hutchings 2013-06-07 16:00 ` Willy Tarreau 2013-06-04 17:23 ` [ 103/184] xhci: Make handover code more robust Willy Tarreau 2013-06-04 17:23 ` [ 104/184] USB: EHCI: go back to using the system clock for QH Willy Tarreau 2013-06-04 17:23 ` [ 105/184] USB: whiteheat: fix memory leak in error path Willy Tarreau 2013-06-04 17:23 ` [ 106/184] USB: serial: Fix memory leak in sierra_release() Willy Tarreau 2013-06-04 17:23 ` [ 107/184] USB: mos7840: fix urb leak at release Willy Tarreau 2013-06-04 17:23 ` [ 108/184] USB: mos7840: fix port-device leak in error path Willy Tarreau 2013-06-04 17:23 ` [ 109/184] USB: garmin_gps: fix memory leak on disconnect Willy Tarreau 2013-06-04 17:23 ` [ 110/184] USB: io_ti: Fix NULL dereference in chase_port() Willy Tarreau 2013-06-04 17:23 ` [ 111/184] USB: cdc-wdm: fix buffer overflow Willy Tarreau 2013-06-07 5:01 ` Ben Hutchings 2013-06-07 5:43 ` Willy Tarreau 2013-06-04 17:23 ` [ 112/184] epoll: prevent missed events on EPOLL_CTL_MOD Willy Tarreau 2013-06-04 17:23 ` [ 113/184] fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing Willy Tarreau 2013-06-04 17:23 ` [ 114/184] fs/fscache/stats.c: fix memory leak Willy Tarreau 2013-06-04 17:23 ` [ 115/184] sysfs: sysfs_pathname/sysfs_add_one: Use strlcat() Willy Tarreau 2013-06-04 17:23 ` [ 116/184] tmpfs: fix use-after-free of mempolicy object Willy Tarreau 2013-06-04 17:23 ` [ 117/184] jbd: Delay discarding buffers in Willy Tarreau 2013-06-04 17:23 ` [ 118/184] jbd: Fix assertion failure in commit code due to Willy Tarreau 2013-06-04 17:23 ` [ 119/184] jbd: Fix lock ordering bug in journal_unmap_buffer() Willy Tarreau 2013-06-04 17:23 ` [ 120/184] ext4: Fix fs corruption when make_indexed_dir() Willy Tarreau 2013-06-04 17:23 ` [ 121/184] ext4: dont dereference null pointer when Willy Tarreau 2013-06-04 17:23 ` [ 122/184] ext4: Fix max file size and logical block counting Willy Tarreau 2013-06-05 9:26 ` Lukáš Czerner 2013-06-05 10:00 ` Lukáš Czerner 2013-06-05 10:00 ` Lukáš Czerner 2013-06-04 17:23 ` [ 123/184] ext4: fix memory leak in ext4_xattr_set_acl()s Willy Tarreau 2013-06-04 17:23 ` [ 124/184] ext4: online defrag is not supported for journaled Willy Tarreau 2013-06-04 17:23 ` [ 125/184] ext4: always set i_op in ext4_mknod() Willy Tarreau 2013-06-04 17:23 ` [ 126/184] ext4: fix fdatasync() for files with only i_size Willy Tarreau 2013-06-04 17:23 ` [ 127/184] ext4: lock i_mutex when truncating orphan inodes Willy Tarreau 2013-06-04 17:23 ` [ 128/184] ext4: fix race in ext4_mb_add_n_trim() Willy Tarreau 2013-06-04 17:23 ` [ 129/184] ext4: limit group search loop for non-extent files Willy Tarreau 2013-06-04 17:23 ` [ 130/184] CVE-2012-4508 kernel: ext4: AIO vs fallocate stale Willy Tarreau 2013-06-07 5:42 ` Ben Hutchings 2013-06-07 5:53 ` Willy Tarreau 2013-06-07 8:02 ` Jamie Iles 2013-06-07 15:02 ` Willy Tarreau 2013-06-04 17:23 ` [ 131/184] ext4: make orphan functions be no-op in no-journal Willy Tarreau 2013-06-07 5:43 ` Ben Hutchings 2013-06-07 5:46 ` Willy Tarreau 2013-06-04 17:23 ` [ 132/184] ext4: avoid hang when mounting non-journal Willy Tarreau 2013-06-07 5:44 ` Ben Hutchings 2013-06-07 5:47 ` Willy Tarreau 2013-06-04 17:23 ` [ 133/184] udf: fix memory leak while allocating blocks during Willy Tarreau 2013-06-04 17:23 ` [ 134/184] udf: avoid info leak on export Willy Tarreau 2013-06-04 17:23 ` [ 135/184] udf: Fix bitmap overflow on large filesystems with Willy Tarreau 2013-06-04 17:23 ` [ 136/184] fs/cifs/cifs_dfs_ref.c: fix potential memory leakage Willy Tarreau 2013-06-04 17:23 ` [ 137/184] isofs: avoid info leak on export Willy Tarreau 2013-06-04 17:23 ` [ 138/184] fat: Fix stat->f_namelen Willy Tarreau 2013-06-04 17:23 ` [ 139/184] NLS: improve UTF8 -> UTF16 string conversion routine Willy Tarreau 2013-06-07 5:48 ` Ben Hutchings 2013-06-07 5:55 ` Willy Tarreau 2013-06-04 17:23 ` [ 140/184] hfsplus: fix potential overflow in Willy Tarreau 2013-06-04 17:23 ` [ 141/184] btrfs: use rcu_barrier() to wait for bdev puts at Willy Tarreau 2013-06-04 17:23 ` [ 142/184] kernel panic when mount NFSv4 Willy Tarreau 2013-06-04 17:23 ` [ 143/184] nfsd4: fix oops on unusual readlike compound Willy Tarreau 2013-06-04 17:23 ` [ 144/184] net/core: Fix potential memory leak in Willy Tarreau 2013-06-04 17:23 ` [ 145/184] net: reduce net_rx_action() latency to 2 HZ Willy Tarreau 2013-06-04 17:23 ` [ 146/184] softirq: reduce latencies Willy Tarreau 2013-08-02 8:14 ` Li Zefan 2013-11-16 7:55 ` Willy Tarreau 2013-06-04 17:23 ` [ 147/184] af_packet: remove BUG statement in Willy Tarreau 2013-06-04 17:23 ` [ 148/184] bridge: set priority of STP packets Willy Tarreau 2013-06-04 17:23 ` [ 149/184] bonding: Fix slave selection bug Willy Tarreau 2013-06-04 17:24 ` [ 150/184] ipv4: check rt_genid in dst_check Willy Tarreau 2013-06-04 17:24 ` Willy Tarreau 2013-06-07 6:07 ` Ben Hutchings 2013-06-07 14:58 ` Benjamin LaHaise 2013-06-07 15:00 ` Willy Tarreau 2013-06-07 15:04 ` Benjamin LaHaise 2013-06-04 17:24 ` [ 151/184] net_sched: gact: Fix potential panic in tcf_gact() Willy Tarreau 2013-06-04 17:24 ` [ 152/184] net: sched: integer overflow fix Willy Tarreau 2013-06-04 17:24 ` [ 153/184] net: prevent setting ttl=0 via IP_TTL Willy Tarreau 2013-06-04 17:24 ` [ 154/184] net: fix divide by zero in tcp algorithm illinois Willy Tarreau 2013-06-04 17:24 ` [ 155/184] net: guard tcp_set_keepalive() to tcp sockets Willy Tarreau 2013-06-04 17:24 ` [ 156/184] net: fix info leak in compat dev_ifconf() Willy Tarreau 2013-06-04 17:24 ` [ 157/184] inet: add RCU protection to inet->opt Willy Tarreau 2013-06-07 6:11 ` Ben Hutchings 2013-06-07 15:49 ` Willy Tarreau 2013-06-04 17:24 ` [ 158/184] tcp: allow splice() to build full TSO packets Willy Tarreau 2013-06-04 17:24 ` [ 159/184] tcp: fix MSG_SENDPAGE_NOTLAST logic Willy Tarreau 2013-06-04 17:24 ` [ 160/184] tcp: preserve ACK clocking in TSO Willy Tarreau 2013-06-04 17:24 ` [ 161/184] unix: fix a race condition in unix_release() Willy Tarreau 2013-06-04 17:24 ` [ 162/184] dcbnl: fix various netlink info leaks Willy Tarreau 2013-06-04 17:24 ` [ 163/184] sctp: fix memory leak in sctp_datamsg_from_user() Willy Tarreau 2013-06-04 17:24 ` [ 164/184] net: sctp: sctp_setsockopt_auth_key: use kzfree Willy Tarreau 2013-06-04 17:24 ` [ 165/184] net: sctp: sctp_endpoint_free: zero out secret key Willy Tarreau 2013-06-04 17:24 ` [ 166/184] net: sctp: sctp_auth_key_put: use kzfree instead of Willy Tarreau 2013-06-04 17:24 ` [ 167/184] ipv6: discard overlapping fragment Willy Tarreau 2013-06-04 17:24 ` [ 168/184] ipv6: make fragment identifications less predictable Willy Tarreau 2013-06-04 17:24 ` [ 169/184] netfilter: nf_ct_ipv4: packets with wrong ihl are Willy Tarreau 2013-06-04 17:24 ` [ 170/184] ipvs: allow transmit of GRO aggregated skbs Willy Tarreau 2013-06-04 17:24 ` [ 171/184] ipvs: IPv6 MTU checking cleanup and bugfix Willy Tarreau 2013-06-04 17:24 ` [ 172/184] ipvs: fix info leak in Willy Tarreau 2013-06-04 17:24 ` [ 173/184] atm: update msg_namelen in vcc_recvmsg() Willy Tarreau 2013-06-04 17:24 ` [ 174/184] atm: fix info leak via getsockname() Willy Tarreau 2013-06-04 17:24 ` [ 175/184] atm: fix info leak in getsockopt(SO_ATMPVC) Willy Tarreau 2013-06-04 17:24 ` [ 176/184] ax25: fix info leak via msg_name in ax25_recvmsg() Willy Tarreau 2013-06-04 17:24 ` [ 177/184] isdnloop: fix and simplify isdnloop_init() Willy Tarreau 2013-06-04 17:24 ` [ 178/184] iucv: Fix missing msg_namelen update in Willy Tarreau 2013-06-04 17:24 ` [ 179/184] llc: fix info leak via getsockname() Willy Tarreau 2013-06-04 17:24 ` [ 180/184] llc: Fix missing msg_namelen update in Willy Tarreau 2013-06-04 17:24 ` [ 181/184] rds: set correct msg_namelen Willy Tarreau 2013-06-04 17:24 ` [ 182/184] rose: fix info leak via msg_name in rose_recvmsg() Willy Tarreau 2013-06-04 17:24 ` [ 183/184] irda: Fix missing msg_namelen update in Willy Tarreau 2013-06-07 6:20 ` Ben Hutchings 2013-06-07 15:52 ` Willy Tarreau 2013-06-04 17:24 ` [ 184/184] tipc: fix info leaks via msg_name in Willy Tarreau 2013-06-05 9:42 ` [ 185/184] [SCSI] mpt2sas: Send default descriptor for RAID pass through in mpt2ctl Willy Tarreau 2013-06-07 6:38 ` Ben Hutchings 2013-06-07 15:46 ` Willy Tarreau 2013-06-07 6:22 ` [ 184/184] tipc: fix info leaks via msg_name in Ben Hutchings 2013-06-07 15:53 ` Willy Tarreau
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20130604172133.166370388@1wt.eu \ --to=w@1wt.eu \ --cc=abbotti@mev.co.uk \ --cc=gregkh@linuxfoundation.org \ --cc=linux-kernel@vger.kernel.org \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.