From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.18 104/150] ipv6: mcast: fix a use-after-free in inet6_mc_check
Date: Fri, 2 Nov 2018 19:34:26 +0100 [thread overview]
Message-ID: <20181102182910.561302362@linuxfoundation.org> (raw)
In-Reply-To: <20181102182902.250560510@linuxfoundation.org>
4.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit dc012f3628eaecfb5ba68404a5c30ef501daf63d ]
syzbot found a use-after-free in inet6_mc_check [1]
The problem here is that inet6_mc_check() uses rcu
and read_lock(&iml->sflock)
So the fact that ip6_mc_leave_src() is called under RTNL
and the socket lock does not help us, we need to acquire
iml->sflock in write mode.
In the future, we should convert all this stuff to RCU.
[1]
BUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline]
BUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
Read of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432
CPU: 1 PID: 22432 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
ipv6_addr_equal include/net/ipv6.h:521 [inline]
inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
__raw_v6_lookup+0x320/0x3f0 net/ipv6/raw.c:98
ipv6_raw_deliver net/ipv6/raw.c:183 [inline]
raw6_local_deliver+0x3d3/0xcb0 net/ipv6/raw.c:240
ip6_input_finish+0x467/0x1aa0 net/ipv6/ip6_input.c:345
NF_HOOK include/linux/netfilter.h:289 [inline]
ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
ip6_mc_input+0x48a/0xd20 net/ipv6/ip6_input.c:503
dst_input include/net/dst.h:450 [inline]
ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
NF_HOOK include/linux/netfilter.h:289 [inline]
ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
__netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
__netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
netif_receive_skb_internal+0x12c/0x620 net/core/dev.c:5126
napi_frags_finish net/core/dev.c:5664 [inline]
napi_gro_frags+0x75a/0xc90 net/core/dev.c:5737
tun_get_user+0x3189/0x4250 drivers/net/tun.c:1923
tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1968
call_write_iter include/linux/fs.h:1808 [inline]
do_iter_readv_writev+0x8b0/0xa80 fs/read_write.c:680
do_iter_write+0x185/0x5f0 fs/read_write.c:959
vfs_writev+0x1f1/0x360 fs/read_write.c:1004
do_writev+0x11a/0x310 fs/read_write.c:1039
__do_sys_writev fs/read_write.c:1112 [inline]
__se_sys_writev fs/read_write.c:1109 [inline]
__x64_sys_writev+0x75/0xb0 fs/read_write.c:1109
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457421
Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b5 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f2d30ecaba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000457421
RDX: 0000000000000001 RSI: 00007f2d30ecabf0 RDI: 00000000000000f0
RBP: 0000000020000500 R08: 00000000000000f0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f2d30ecb6d4
R13: 00000000004c4890 R14: 00000000004d7b90 R15: 00000000ffffffff
Allocated by task 22437:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
__do_kmalloc mm/slab.c:3718 [inline]
__kmalloc+0x14e/0x760 mm/slab.c:3727
kmalloc include/linux/slab.h:518 [inline]
sock_kmalloc+0x15a/0x1f0 net/core/sock.c:1983
ip6_mc_source+0x14dd/0x1960 net/ipv6/mcast.c:427
do_ipv6_setsockopt.isra.9+0x3afb/0x45d0 net/ipv6/ipv6_sockglue.c:743
ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:933
rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1069
sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3038
__sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902
__do_sys_setsockopt net/socket.c:1913 [inline]
__se_sys_setsockopt net/socket.c:1910 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 22430:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xcf/0x230 mm/slab.c:3813
__sock_kfree_s net/core/sock.c:2004 [inline]
sock_kfree_s+0x29/0x60 net/core/sock.c:2010
ip6_mc_leave_src+0x11a/0x1d0 net/ipv6/mcast.c:2448
__ipv6_sock_mc_close+0x20b/0x4e0 net/ipv6/mcast.c:310
ipv6_sock_mc_close+0x158/0x1d0 net/ipv6/mcast.c:328
inet6_release+0x40/0x70 net/ipv6/af_inet6.c:452
__sock_release+0xd7/0x250 net/socket.c:579
sock_close+0x19/0x20 net/socket.c:1141
__fput+0x385/0xa30 fs/file_table.c:278
____fput+0x15/0x20 fs/file_table.c:309
task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801ce7f2500
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes inside of
192-byte region [ffff8801ce7f2500, ffff8801ce7f25c0)
The buggy address belongs to the page:
page:ffffea000739fc80 count:1 mapcount:0 mapping:ffff8801da800040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006f6e548 ffffea000737b948 ffff8801da800040
raw: 0000000000000000 ffff8801ce7f2000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801ce7f2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801ce7f2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8801ce7f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801ce7f2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8801ce7f2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2436,17 +2436,17 @@ static int ip6_mc_leave_src(struct sock
{
int err;
- /* callers have the socket lock and rtnl lock
- * so no other readers or writers of iml or its sflist
- */
+ write_lock_bh(&iml->sflock);
if (!iml->sflist) {
/* any-source empty exclude case */
- return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
+ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
+ } else {
+ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
+ iml->sflist->sl_count, iml->sflist->sl_addr, 0);
+ sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
+ iml->sflist = NULL;
}
- err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
- iml->sflist->sl_count, iml->sflist->sl_addr, 0);
- sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
- iml->sflist = NULL;
+ write_unlock_bh(&iml->sflock);
return err;
}
next prev parent reply other threads:[~2018-11-02 18:43 UTC|newest]
Thread overview: 160+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-02 18:32 [PATCH 4.18 000/150] 4.18.17-stable review Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 001/150] xfrm: Validate address prefix lengths in the xfrm selector Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 002/150] xfrm6: call kfree_skb when skb is toobig Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 003/150] xfrm: reset transport header back to network header after all input transforms ahave been applied Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 004/150] xfrm: reset crypto_done when iterating over multiple input xfrms Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 005/150] mac80211: Always report TX status Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 006/150] cfg80211: reg: Init wiphy_idx in regulatory_hint_core() Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 007/150] mac80211: fix pending queue hang due to TX_DROP Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 008/150] cfg80211: Address some corner cases in scan result channel updating Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 009/150] mac80211: TDLS: fix skb queue/priority assignment Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 010/150] mac80211: fix TX status reporting for ieee80211s Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 011/150] xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 012/150] ARM: 8799/1: mm: fix pci_ioremap_io() offset check Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 013/150] xfrm: validate template mode Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 014/150] drm/i2c: tda9950: fix timeout counter check Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 015/150] drm/i2c: tda9950: set MAX_RETRIES for errors only Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 016/150] netfilter: bridge: Dont sabotage nf_hook calls from an l3mdev Greg Kroah-Hartman
2018-11-02 18:32 ` [PATCH 4.18 017/150] netfilter: conntrack: get rid of double sizeof Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 018/150] arm64: hugetlb: Fix handling of young ptes Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 019/150] ARM: dts: BCM63xx: Fix incorrect interrupt specifiers Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 020/150] net: macb: Clean 64b dma addresses if they are not detected Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 021/150] soc: fsl: qbman: qman: avoid allocating from non existing gen_pool Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 022/150] soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift() Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 023/150] nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 024/150] mac80211_hwsim: fix locking when iterating radios during ns exit Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 025/150] mac80211_hwsim: fix race in radio destruction from netlink notifier Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 026/150] mac80211_hwsim: do not omit multicast announce of first added radio Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 027/150] Bluetooth: SMP: fix crash in unpairing Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 028/150] pxa168fb: prepare the clock Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 029/150] qed: Avoid implicit enum conversion in qed_set_tunn_cls_info Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 030/150] qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 031/150] qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 032/150] qed: Avoid constant logical operation warning in qed_vf_pf_acquire Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 033/150] qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 034/150] nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 035/150] scsi: qedi: Initialize the stats mutex lock Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 036/150] rxrpc: Fix checks as to whether we should set up a new call Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 037/150] rxrpc: Fix RTT gathering Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 038/150] rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 039/150] rxrpc: Fix error distribution Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 040/150] netfilter: nft_set_rbtree: add missing rb_erase() in GC routine Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 041/150] netfilter: avoid erronous array bounds warning Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 042/150] asix: Check for supported Wake-on-LAN modes Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 043/150] ax88179_178a: " Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 044/150] lan78xx: " Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 045/150] sr9800: " Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 046/150] r8152: Check for supported Wake-on-LAN Modes Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 047/150] smsc75xx: Check for Wake-on-LAN modes Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 048/150] smsc95xx: " Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 049/150] cfg80211: fix use-after-free in reg_process_hint() Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 050/150] KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 051/150] KVM: x86: Do not use kvm_x86_ops->mpx_supported() directly Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 052/150] KVM: nVMX: Fix emulation of VM_ENTRY_LOAD_BNDCFGS Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 053/150] perf/core: Fix perf_pmu_unregister() locking Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 054/150] perf/x86/intel/uncore: Use boot_cpu_data.phys_proc_id instead of hardcorded physical package ID 0 Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 055/150] perf/ring_buffer: Prevent concurent ring buffer access Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 056/150] perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 057/150] perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 058/150] thunderbolt: Do not handle ICM events after domain is stopped Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 059/150] thunderbolt: Initialize after IOMMUs Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 060/150] net: fec: fix rare tx timeout Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 061/150] declance: Fix continuation with the adapter identification message Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 062/150] RISCV: Fix end PFN for low memory Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 063/150] Revert "serial: 8250_dw: Fix runtime PM handling" Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 064/150] locking/ww_mutex: Fix runtime warning in the WW mutex selftest Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 065/150] drm/amd/display: Signal hw_done() after waiting for flip_done() Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 066/150] be2net: dont flip hw_features when VXLANs are added/deleted Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 067/150] powerpc/numa: Skip onlining a offline node in kdump path Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 068/150] net: cxgb3_main: fix a missing-check bug Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 069/150] yam: " Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 070/150] ocfs2: fix crash in ocfs2_duplicate_clusters_by_page() Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 071/150] mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 072/150] mm/migrate.c: split only transparent huge pages when allocation fails Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 073/150] x86/paravirt: Fix some warning messages Greg Kroah-Hartman
2018-11-02 18:33 ` Greg Kroah-Hartman
2018-11-02 18:33 ` Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 074/150] clk: mvebu: armada-37xx-periph: Remove unused var num_parents Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 075/150] libertas: call into generic suspend code before turning off power Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 076/150] perf report: Dont try to map ip to invalid map Greg Kroah-Hartman
2018-11-02 18:33 ` [PATCH 4.18 077/150] tls: Fix improper revert in zerocopy_from_iter Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 078/150] HID: i2c-hid: Remove RESEND_REPORT_DESCR quirk and its handling Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 079/150] compiler.h: Allow arch-specific asm/compiler.h Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 080/150] ARM: dts: imx53-qsb: disable 1.2GHz OPP Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 081/150] perf python: Use -Wno-redundant-decls to build with PYTHON=python3 Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 082/150] perf record: Use unmapped IP for inline callchain cursors Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 083/150] rxrpc: Dont check RXRPC_CALL_TX_LAST after calling rxrpc_rotate_tx_window() Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 084/150] rxrpc: Carry call state out of locked section in rxrpc_rotate_tx_window() Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 085/150] rxrpc: Only take the rwind and mtu values from latest ACK Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 086/150] rxrpc: Fix connection-level abort handling Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 087/150] KVM: x86: support CONFIG_KVM_AMD=y with CONFIG_CRYPTO_DEV_CCP_DD=m Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 088/150] net: ena: fix warning in rmmod caused by double iounmap Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 089/150] net: ena: fix rare bug when failed restart/resume is followed by driver removal Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 090/150] net: ena: fix NULL dereference due to untimely napi initialization Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 091/150] gpio: Assign gpio_irq_chip::parents to non-stack pointer Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 092/150] IB/mlx5: Unmap DMA addr from HCA before IOMMU Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 093/150] rds: RDS (tcp) hangs on sendto() to unresponding address Greg Kroah-Hartman
2018-11-05 7:38 ` Ka-Cheong Poon
2018-11-05 13:09 ` Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 094/150] selftests: rtnetlink.sh explicitly requires bash Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 095/150] selftests: udpgso_bench.sh " Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 096/150] vmlinux.lds.h: Fix incomplete .text.exit discards Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 097/150] vmlinux.lds.h: Fix linker warnings about orphan .LPBX sections Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 098/150] afs: Fix cell proc list Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 099/150] fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 100/150] Revert "mm: slowly shrink slabs with a relatively small number of objects" Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 101/150] Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing" Greg Kroah-Hartman
2018-11-02 18:34 ` Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 102/150] perf tools: Disable parallelism for make clean Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 103/150] bridge: do not add port to router list when receives query with source 0.0.0.0 Greg Kroah-Hartman
2018-11-02 18:34 ` Greg Kroah-Hartman [this message]
2018-11-02 18:34 ` [PATCH 4.18 105/150] ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 106/150] ipv6: rate-limit probes for neighbourless routes Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 107/150] llc: set SOCK_RCU_FREE in llc_sap_add_socket() Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 108/150] net: fec: dont dump RX FIFO register when not available Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 109/150] net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 110/150] net/mlx5e: fix csum adjustments caused by RXFCS Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 111/150] net: sched: gred: pass the right attribute to gred_change_table_def() Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 112/150] net: socket: fix a missing-check bug Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 113/150] net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 114/150] net: udp: fix handling of CHECKSUM_COMPLETE packets Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 115/150] r8169: fix NAPI handling under high load Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 116/150] rtnetlink: Disallow FDB configuration for non-Ethernet device Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 117/150] sctp: fix race on sctp_id2asoc Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 118/150] tipc: fix unsafe rcu locking when accessing publication list Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 119/150] udp6: fix encap return code for resubmitting Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 120/150] vhost: Fix Spectre V1 vulnerability Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 121/150] virtio_net: avoid using netif_tx_disable() for serializing tx routine Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 122/150] ethtool: fix a privilege escalation bug Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 123/150] bonding: fix length of actor system Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 124/150] ip6_tunnel: Fix encapsulation layout Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 125/150] openvswitch: Fix push/pop ethernet validation Greg Kroah-Hartman
2018-11-02 18:34 ` Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 126/150] net: ipmr: fix unresolved entry dumps Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 127/150] net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 128/150] net: bcmgenet: Poll internal PHY for GENETv5 Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 129/150] net: sched: Fix for duplicate class dump Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 130/150] net/sched: cls_api: add missing validation of netlink attributes Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 131/150] net/ipv6: Allow onlink routes to have a device mismatch if it is the default route Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 132/150] sctp: fix the data size calculation in sctp_data_size Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 133/150] sctp: not free the new asoc when sctp_wait_for_connect returns err Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 134/150] net/mlx5: Fix memory leak when setting fpga ipsec caps Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 135/150] net/smc: fix smc_buf_unuse to use the lgr pointer Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 136/150] mlxsw: spectrum_switchdev: Dont ignore deletions of learned MACs Greg Kroah-Hartman
2018-11-02 18:34 ` [PATCH 4.18 137/150] net: bpfilter: use get_pid_task instead of pid_task Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 138/150] net: drop skb on failure in ip_check_defrag() Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 139/150] net: fix pskb_trim_rcsum_slow() with odd trim offset Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 140/150] net/mlx5: WQ, fixes for fragmented WQ buffers API Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 141/150] mlxsw: core: Fix devlink unregister flow Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 142/150] sparc64: Export __node_distance Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 143/150] sparc64: Make corrupted user stacks more debuggable Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 144/150] sparc64: Make proc_id signed Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 145/150] sparc64: Set %l4 properly on trap return after handling signals Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 146/150] sparc64: Wire up compat getpeername and getsockname Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 147/150] sparc: Fix single-pcr perf event counter management Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 148/150] sparc: Fix syscall fallback bugs in VDSO Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 149/150] sparc: Throttle perf events properly Greg Kroah-Hartman
2018-11-02 18:35 ` [PATCH 4.18 150/150] net: bridge: remove ipv6 zero address check in mcast queries Greg Kroah-Hartman
2018-11-02 22:49 ` [PATCH 4.18 000/150] 4.18.17-stable review kernelci.org bot
2018-11-03 14:32 ` Guenter Roeck
2018-11-04 4:16 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181102182910.561302362@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.