* [PATCH] scsi: sg: protect accesses to 'reserved' page array @ 2017-08-16 3:09 Todd Poynor [not found] ` <CAAW3YpbROHL_EXNCRrNOV=K9ywAmBTsxDVBmKHxNCKJPkRnZEA@mail.gmail.com> 0 siblings, 1 reply; 6+ messages in thread From: Todd Poynor @ 2017-08-16 3:09 UTC (permalink / raw) To: stable Cc: android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen, Todd Poynor From: Hannes Reinecke <hare@suse.de> The 'reserved' page array is used as a short-cut for mapping data, saving us to allocate pages per request. However, the 'reserved' array is only capable of holding one request, so this patch introduces a mutex for protect 'sg_fd' against concurrent accesses. [toddpoynor@google.com: backport to 3.18-4.9, fixup for bad ioctl SG_SET_FORCE_LOW_DMA code removed in later versions and not modified by the original patch.] commit 1bc0eb0446158cc76562176b80623aa119afee5b upstream. Signed-off-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Tested-by: Johannes Thumshirn <jthumshirn@suse.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Todd Poynor <toddpoynor@google.com> --- Suggested for 4.9, 4.4, and 3.18. This version includes a trivial fixup for some bad ioctl code that has been removed. The fix is already in 4.12. Fixes a KASAN use-after-free bug found during multithreaded fuzz testing of SCSI char device syscalls, where ioctl SG_SET_RESERVED_SIZE frees a pre-allocated "reserve buffer" in a race with an I/O request that uses the buffer. BUG: KASAN: use-after-free in bio_copy_user_iov+xx block/bio.c:1205 Call Trace: ... [<ffffffff81e051cf>] bio_copy_user_iov+0xcdf/0xe50 block/bio.c:1205 [<ffffffff81e3665f>] __blk_rq_map_user_iov block/blk-map.c:56 [inline] [<ffffffff81e3665f>] blk_rq_map_user_iov+0x22f/0x770 block/blk-map.c:133 [<ffffffff81e36ca9>] blk_rq_map_user+0x109/0x180 block/blk-map.c:163 [<ffffffff8278f982>] sg_start_req drivers/scsi/sg.c:1766 [inline] [<ffffffff8278f982>] sg_common_write.isra.21+0xc12/0x17a0 drivers/scsi/sg.c:775 [<ffffffff82793d1b>] sg_write+0x68b/0xb10 drivers/scsi/sg.c:678 drivers/scsi/sg.c | 47 ++++++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index f753df25ba34..cf7e5f096988 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -142,6 +142,7 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ struct sg_device *parentdp; /* owning device */ wait_queue_head_t read_wait; /* queue read until command done */ rwlock_t rq_list_lock; /* protect access to list in req_arr */ + struct mutex f_mutex; /* protect against changes in this fd */ int timeout; /* defaults to SG_DEFAULT_TIMEOUT */ int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */ Sg_scatter_hold reserve; /* buffer held for this file descriptor */ @@ -155,6 +156,7 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ unsigned char next_cmd_len; /* 0: automatic, >0: use on next write() */ char keep_orphan; /* 0 -> drop orphan (def), 1 -> keep for read() */ char mmap_called; /* 0 -> mmap() never called on this fd */ + char res_in_use; /* 1 -> 'reserve' array in use */ struct kref f_ref; struct execute_work ew; } Sg_fd; @@ -198,7 +200,6 @@ static void sg_remove_sfp(struct kref *); static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); static Sg_request *sg_add_request(Sg_fd * sfp); static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); -static int sg_res_in_use(Sg_fd * sfp); static Sg_device *sg_get_dev(int dev); static void sg_device_destroy(struct kref *kref); @@ -614,6 +615,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) } buf += SZ_SG_HEADER; __get_user(opcode, buf); + mutex_lock(&sfp->f_mutex); if (sfp->next_cmd_len > 0) { cmd_size = sfp->next_cmd_len; sfp->next_cmd_len = 0; /* reset so only this write() effected */ @@ -622,6 +624,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) if ((opcode >= 0xc0) && old_hdr.twelve_byte) cmd_size = 12; } + mutex_unlock(&sfp->f_mutex); SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp, "sg_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size)); /* Determine buffer size. */ @@ -721,7 +724,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf, sg_remove_request(sfp, srp); return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */ } - if (sg_res_in_use(sfp)) { + if (sfp->res_in_use) { sg_remove_request(sfp, srp); return -EBUSY; /* reserve buffer already being used */ } @@ -892,7 +895,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) return result; if (val) { sfp->low_dma = 1; - if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) { + if ((0 == sfp->low_dma) && !sfp->res_in_use) { val = (int) sfp->reserve.bufflen; sg_remove_scat(sfp, &sfp->reserve); sg_build_reserve(sfp, val); @@ -967,12 +970,18 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) return -EINVAL; val = min_t(int, val, max_sectors_bytes(sdp->device->request_queue)); + mutex_lock(&sfp->f_mutex); if (val != sfp->reserve.bufflen) { - if (sg_res_in_use(sfp) || sfp->mmap_called) + if (sfp->mmap_called || + sfp->res_in_use) { + mutex_unlock(&sfp->f_mutex); return -EBUSY; + } + sg_remove_scat(sfp, &sfp->reserve); sg_build_reserve(sfp, val); } + mutex_unlock(&sfp->f_mutex); return 0; case SG_GET_RESERVED_SIZE: val = min_t(int, sfp->reserve.bufflen, @@ -1727,13 +1736,22 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) md = &map_data; if (md) { - if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen) + mutex_lock(&sfp->f_mutex); + if (dxfer_len <= rsv_schp->bufflen && + !sfp->res_in_use) { + sfp->res_in_use = 1; sg_link_reserve(sfp, srp, dxfer_len); - else { + } else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) { + mutex_unlock(&sfp->f_mutex); + return -EBUSY; + } else { res = sg_build_indirect(req_schp, sfp, dxfer_len); - if (res) + if (res) { + mutex_unlock(&sfp->f_mutex); return res; + } } + mutex_unlock(&sfp->f_mutex); md->pages = req_schp->pages; md->page_order = req_schp->page_order; @@ -2135,6 +2153,7 @@ sg_add_sfp(Sg_device * sdp) rwlock_init(&sfp->rq_list_lock); kref_init(&sfp->f_ref); + mutex_init(&sfp->f_mutex); sfp->timeout = SG_DEFAULT_TIMEOUT; sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER; sfp->force_packid = SG_DEF_FORCE_PACK_ID; @@ -2210,20 +2229,6 @@ sg_remove_sfp(struct kref *kref) schedule_work(&sfp->ew.work); } -static int -sg_res_in_use(Sg_fd * sfp) -{ - const Sg_request *srp; - unsigned long iflags; - - read_lock_irqsave(&sfp->rq_list_lock, iflags); - for (srp = sfp->headrp; srp; srp = srp->nextrp) - if (srp->res_used) - break; - read_unlock_irqrestore(&sfp->rq_list_lock, iflags); - return srp ? 1 : 0; -} - #ifdef CONFIG_SCSI_PROC_FS static int sg_idr_max_id(int id, void *p, void *data) -- 2.14.1.480.gb18f417b89-goog ^ permalink raw reply related [flat|nested] 6+ messages in thread
[parent not found: <CAAW3YpbROHL_EXNCRrNOV=K9ywAmBTsxDVBmKHxNCKJPkRnZEA@mail.gmail.com>]
* Re: [PATCH] scsi: sg: protect accesses to 'reserved' page array [not found] ` <CAAW3YpbROHL_EXNCRrNOV=K9ywAmBTsxDVBmKHxNCKJPkRnZEA@mail.gmail.com> @ 2017-08-16 3:32 ` Todd Poynor 2017-08-31 6:19 ` Greg KH 0 siblings, 1 reply; 6+ messages in thread From: Todd Poynor @ 2017-08-16 3:32 UTC (permalink / raw) To: stable Cc: android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen, Todd Poynor Ah, this patch also requires another follow-on fix: > > commit e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 > Author: Hannes Reinecke <hare@suse.de> > Date: Mon Apr 24 10:26:36 2017 +0200 > > scsi: sg: reset 'res_in_use' after unlinking reserved array > > > On Tue, Aug 15, 2017 at 8:09 PM, Todd Poynor <toddpoynor@google.com> wrote: >> >> From: Hannes Reinecke <hare@suse.de> >> >> The 'reserved' page array is used as a short-cut for mapping data, >> saving us to allocate pages per request. However, the 'reserved' array >> is only capable of holding one request, so this patch introduces a mutex >> for protect 'sg_fd' against concurrent accesses. >> >> [toddpoynor@google.com: backport to 3.18-4.9, fixup for bad ioctl >> SG_SET_FORCE_LOW_DMA code removed in later versions and not modified by >> the original patch.] >> >> commit 1bc0eb0446158cc76562176b80623aa119afee5b upstream. >> >> Signed-off-by: Hannes Reinecke <hare@suse.com> >> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> >> Tested-by: Johannes Thumshirn <jthumshirn@suse.de> >> Reviewed-by: Christoph Hellwig <hch@lst.de> >> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> >> Signed-off-by: Todd Poynor <toddpoynor@google.com> >> --- >> Suggested for 4.9, 4.4, and 3.18. This version includes a trivial >> fixup for some bad ioctl code that has been removed. The fix is >> already in 4.12. >> >> Fixes a KASAN use-after-free bug found during multithreaded fuzz testing >> of SCSI char device syscalls, where ioctl SG_SET_RESERVED_SIZE frees a >> pre-allocated "reserve buffer" in a race with an I/O request that uses >> the buffer. >> >> BUG: KASAN: use-after-free in bio_copy_user_iov+xx block/bio.c:1205 >> Call Trace: >> ... >> [<ffffffff81e051cf>] bio_copy_user_iov+0xcdf/0xe50 block/bio.c:1205 >> [<ffffffff81e3665f>] __blk_rq_map_user_iov block/blk-map.c:56 [inline] >> [<ffffffff81e3665f>] blk_rq_map_user_iov+0x22f/0x770 block/blk-map.c:133 >> [<ffffffff81e36ca9>] blk_rq_map_user+0x109/0x180 block/blk-map.c:163 >> [<ffffffff8278f982>] sg_start_req drivers/scsi/sg.c:1766 [inline] >> [<ffffffff8278f982>] sg_common_write.isra.21+0xc12/0x17a0 >> drivers/scsi/sg.c:775 >> [<ffffffff82793d1b>] sg_write+0x68b/0xb10 drivers/scsi/sg.c:678 >> >> drivers/scsi/sg.c | 47 ++++++++++++++++++++++++++--------------------- >> 1 file changed, 26 insertions(+), 21 deletions(-) >> >> diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c >> index f753df25ba34..cf7e5f096988 100644 >> --- a/drivers/scsi/sg.c >> +++ b/drivers/scsi/sg.c >> @@ -142,6 +142,7 @@ typedef struct sg_fd { /* holds the state >> of a file descriptor */ >> struct sg_device *parentdp; /* owning device */ >> wait_queue_head_t read_wait; /* queue read until command done >> */ >> rwlock_t rq_list_lock; /* protect access to list in req_arr */ >> + struct mutex f_mutex; /* protect against changes in this fd */ >> int timeout; /* defaults to SG_DEFAULT_TIMEOUT */ >> int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */ >> Sg_scatter_hold reserve; /* buffer held for this file >> descriptor */ >> @@ -155,6 +156,7 @@ typedef struct sg_fd { /* holds the state >> of a file descriptor */ >> unsigned char next_cmd_len; /* 0: automatic, >0: use on next >> write() */ >> char keep_orphan; /* 0 -> drop orphan (def), 1 -> keep for >> read() */ >> char mmap_called; /* 0 -> mmap() never called on this fd */ >> + char res_in_use; /* 1 -> 'reserve' array in use */ >> struct kref f_ref; >> struct execute_work ew; >> } Sg_fd; >> @@ -198,7 +200,6 @@ static void sg_remove_sfp(struct kref *); >> static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); >> static Sg_request *sg_add_request(Sg_fd * sfp); >> static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); >> -static int sg_res_in_use(Sg_fd * sfp); >> static Sg_device *sg_get_dev(int dev); >> static void sg_device_destroy(struct kref *kref); >> >> @@ -614,6 +615,7 @@ sg_write(struct file *filp, const char __user *buf, >> size_t count, loff_t * ppos) >> } >> buf += SZ_SG_HEADER; >> __get_user(opcode, buf); >> + mutex_lock(&sfp->f_mutex); >> if (sfp->next_cmd_len > 0) { >> cmd_size = sfp->next_cmd_len; >> sfp->next_cmd_len = 0; /* reset so only this write() >> effected */ >> @@ -622,6 +624,7 @@ sg_write(struct file *filp, const char __user *buf, >> size_t count, loff_t * ppos) >> if ((opcode >= 0xc0) && old_hdr.twelve_byte) >> cmd_size = 12; >> } >> + mutex_unlock(&sfp->f_mutex); >> SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp, >> "sg_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) >> opcode, cmd_size)); >> /* Determine buffer size. */ >> @@ -721,7 +724,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char >> __user *buf, >> sg_remove_request(sfp, srp); >> return -EINVAL; /* either MMAP_IO or DIRECT_IO >> (not both) */ >> } >> - if (sg_res_in_use(sfp)) { >> + if (sfp->res_in_use) { >> sg_remove_request(sfp, srp); >> return -EBUSY; /* reserve buffer already being >> used */ >> } >> @@ -892,7 +895,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, >> unsigned long arg) >> return result; >> if (val) { >> sfp->low_dma = 1; >> - if ((0 == sfp->low_dma) && (0 == >> sg_res_in_use(sfp))) { >> + if ((0 == sfp->low_dma) && !sfp->res_in_use) { >> val = (int) sfp->reserve.bufflen; >> sg_remove_scat(sfp, &sfp->reserve); >> sg_build_reserve(sfp, val); >> @@ -967,12 +970,18 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, >> unsigned long arg) >> return -EINVAL; >> val = min_t(int, val, >> >> max_sectors_bytes(sdp->device->request_queue)); >> + mutex_lock(&sfp->f_mutex); >> if (val != sfp->reserve.bufflen) { >> - if (sg_res_in_use(sfp) || sfp->mmap_called) >> + if (sfp->mmap_called || >> + sfp->res_in_use) { >> + mutex_unlock(&sfp->f_mutex); >> return -EBUSY; >> + } >> + >> sg_remove_scat(sfp, &sfp->reserve); >> sg_build_reserve(sfp, val); >> } >> + mutex_unlock(&sfp->f_mutex); >> return 0; >> case SG_GET_RESERVED_SIZE: >> val = min_t(int, sfp->reserve.bufflen, >> @@ -1727,13 +1736,22 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) >> md = &map_data; >> >> if (md) { >> - if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen) >> + mutex_lock(&sfp->f_mutex); >> + if (dxfer_len <= rsv_schp->bufflen && >> + !sfp->res_in_use) { >> + sfp->res_in_use = 1; >> sg_link_reserve(sfp, srp, dxfer_len); >> - else { >> + } else if ((hp->flags & SG_FLAG_MMAP_IO) && >> sfp->res_in_use) { >> + mutex_unlock(&sfp->f_mutex); >> + return -EBUSY; >> + } else { >> res = sg_build_indirect(req_schp, sfp, dxfer_len); >> - if (res) >> + if (res) { >> + mutex_unlock(&sfp->f_mutex); >> return res; >> + } >> } >> + mutex_unlock(&sfp->f_mutex); >> >> md->pages = req_schp->pages; >> md->page_order = req_schp->page_order; >> @@ -2135,6 +2153,7 @@ sg_add_sfp(Sg_device * sdp) >> rwlock_init(&sfp->rq_list_lock); >> >> kref_init(&sfp->f_ref); >> + mutex_init(&sfp->f_mutex); >> sfp->timeout = SG_DEFAULT_TIMEOUT; >> sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER; >> sfp->force_packid = SG_DEF_FORCE_PACK_ID; >> @@ -2210,20 +2229,6 @@ sg_remove_sfp(struct kref *kref) >> schedule_work(&sfp->ew.work); >> } >> >> -static int >> -sg_res_in_use(Sg_fd * sfp) >> -{ >> - const Sg_request *srp; >> - unsigned long iflags; >> - >> - read_lock_irqsave(&sfp->rq_list_lock, iflags); >> - for (srp = sfp->headrp; srp; srp = srp->nextrp) >> - if (srp->res_used) >> - break; >> - read_unlock_irqrestore(&sfp->rq_list_lock, iflags); >> - return srp ? 1 : 0; >> -} >> - >> #ifdef CONFIG_SCSI_PROC_FS >> static int >> sg_idr_max_id(int id, void *p, void *data) >> -- >> 2.14.1.480.gb18f417b89-goog >> > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] scsi: sg: protect accesses to 'reserved' page array 2017-08-16 3:32 ` Todd Poynor @ 2017-08-31 6:19 ` Greg KH 2017-08-31 20:11 ` Todd Poynor 0 siblings, 1 reply; 6+ messages in thread From: Greg KH @ 2017-08-31 6:19 UTC (permalink / raw) To: Todd Poynor Cc: stable, android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen On Tue, Aug 15, 2017 at 08:32:06PM -0700, Todd Poynor wrote: > Ah, this patch also requires another follow-on fix: > > > > commit e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 > > Author: Hannes Reinecke <hare@suse.de> > > Date: Mon Apr 24 10:26:36 2017 +0200 > > > > scsi: sg: reset 'res_in_use' after unlinking reserved array > > Thanks, both now queued up. greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] scsi: sg: protect accesses to 'reserved' page array 2017-08-31 6:19 ` Greg KH @ 2017-08-31 20:11 ` Todd Poynor 2017-09-01 5:03 ` Greg KH 0 siblings, 1 reply; 6+ messages in thread From: Todd Poynor @ 2017-08-31 20:11 UTC (permalink / raw) To: Greg KH Cc: stable, android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen Thanks! A couple more follow-on fixes for sg race conditions are now in the linux-next tree (via linux-scsi), in case it's appropriate to also queue these for linux-stable trees now or after 4.14 release: commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 Author: Todd Poynor <toddpoynor@google.com> Date: Tue Aug 15 21:48:43 2017 -0700 scsi: sg: recheck MMAP_IO request length with lock held commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 Author: Todd Poynor <toddpoynor@google.com> Date: Tue Aug 15 22:41:08 2017 -0700 scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE Todd ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] scsi: sg: protect accesses to 'reserved' page array 2017-08-31 20:11 ` Todd Poynor @ 2017-09-01 5:03 ` Greg KH 2017-09-08 7:10 ` Greg KH 0 siblings, 1 reply; 6+ messages in thread From: Greg KH @ 2017-09-01 5:03 UTC (permalink / raw) To: Todd Poynor Cc: stable, android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen On Thu, Aug 31, 2017 at 01:11:18PM -0700, Todd Poynor wrote: > Thanks! A couple more follow-on fixes for sg race conditions are now > in the linux-next tree (via linux-scsi), in case it's appropriate to > also queue these for linux-stable trees now or after 4.14 release: > > commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 > Author: Todd Poynor <toddpoynor@google.com> > Date: Tue Aug 15 21:48:43 2017 -0700 > > scsi: sg: recheck MMAP_IO request length with lock held > > commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 > Author: Todd Poynor <toddpoynor@google.com> > Date: Tue Aug 15 22:41:08 2017 -0700 > > scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE > As per: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html I have to wait until they hit Linus's tree, and ideally, show up in a -rc release, before I can add them to a stable tree. thanks, greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] scsi: sg: protect accesses to 'reserved' page array 2017-09-01 5:03 ` Greg KH @ 2017-09-08 7:10 ` Greg KH 0 siblings, 0 replies; 6+ messages in thread From: Greg KH @ 2017-09-08 7:10 UTC (permalink / raw) To: Todd Poynor Cc: stable, android-kernel, Hannes Reinecke, Hannes Reinecke, Martin K . Petersen On Fri, Sep 01, 2017 at 07:03:55AM +0200, Greg KH wrote: > On Thu, Aug 31, 2017 at 01:11:18PM -0700, Todd Poynor wrote: > > Thanks! A couple more follow-on fixes for sg race conditions are now > > in the linux-next tree (via linux-scsi), in case it's appropriate to > > also queue these for linux-stable trees now or after 4.14 release: > > > > commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 > > Author: Todd Poynor <toddpoynor@google.com> > > Date: Tue Aug 15 21:48:43 2017 -0700 > > > > scsi: sg: recheck MMAP_IO request length with lock held > > > > commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 > > Author: Todd Poynor <toddpoynor@google.com> > > Date: Tue Aug 15 22:41:08 2017 -0700 > > > > scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE > > > > As per: > https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html > > I have to wait until they hit Linus's tree, and ideally, show up in a > -rc release, before I can add them to a stable tree. Now all queued up. thanks, greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-09-08 7:10 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-08-16 3:09 [PATCH] scsi: sg: protect accesses to 'reserved' page array Todd Poynor [not found] ` <CAAW3YpbROHL_EXNCRrNOV=K9ywAmBTsxDVBmKHxNCKJPkRnZEA@mail.gmail.com> 2017-08-16 3:32 ` Todd Poynor 2017-08-31 6:19 ` Greg KH 2017-08-31 20:11 ` Todd Poynor 2017-09-01 5:03 ` Greg KH 2017-09-08 7:10 ` Greg KH
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.