From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Robin Holt <holt@sgi.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Wanpeng Li <liwanp@linux.vnet.ibm.com>,
Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>,
Avi Kivity <avi@redhat.com>, Hugh Dickins <hughd@google.com>,
Marcelo Tosatti <mtosatti@redhat.com>,
Sagi Grimberg <sagig@mellanox.co.il>,
Haggai Eran <haggaie@mellanox.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [ 032/150] mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts
Date: Tue, 26 Feb 2013 15:54:49 -0800 [thread overview]
Message-ID: <20130226235527.543152380@linuxfoundation.org> (raw)
In-Reply-To: <20130226235523.930663721@linuxfoundation.org>
3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Holt <holt@sgi.com>
commit 751efd8610d3d7d67b7bdf7f62646edea7365dd7 upstream.
There is a race condition between mmu_notifier_unregister() and
__mmu_notifier_release().
Assume two tasks, one calling mmu_notifier_unregister() as a result of a
filp_close() ->flush() callout (task A), and the other calling
mmu_notifier_release() from an mmput() (task B).
A B
t1 srcu_read_lock()
t2 if (!hlist_unhashed())
t3 srcu_read_unlock()
t4 srcu_read_lock()
t5 hlist_del_init_rcu()
t6 synchronize_srcu()
t7 srcu_read_unlock()
t8 hlist_del_rcu() <--- NULL pointer deref.
Additionally, the list traversal in __mmu_notifier_release() is not
protected by the by the mmu_notifier_mm->hlist_lock which can result in
callouts to the ->release() notifier from both mmu_notifier_unregister()
and __mmu_notifier_release().
-stable suggestions:
The stable trees prior to 3.7.y need commits 21a92735f660 and
70400303ce0c cherry-picked in that order prior to cherry-picking this
commit. The 3.7.y tree already has those two commits.
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Cc: Avi Kivity <avi@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Sagi Grimberg <sagig@mellanox.co.il>
Cc: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mmu_notifier.c | 82 +++++++++++++++++++++++++++---------------------------
1 file changed, 42 insertions(+), 40 deletions(-)
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -37,49 +37,51 @@ static struct srcu_struct srcu;
void __mmu_notifier_release(struct mm_struct *mm)
{
struct mmu_notifier *mn;
- struct hlist_node *n;
int id;
/*
- * SRCU here will block mmu_notifier_unregister until
- * ->release returns.
+ * srcu_read_lock() here will block synchronize_srcu() in
+ * mmu_notifier_unregister() until all registered
+ * ->release() callouts this function makes have
+ * returned.
*/
id = srcu_read_lock(&srcu);
- hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist)
- /*
- * if ->release runs before mmu_notifier_unregister it
- * must be handled as it's the only way for the driver
- * to flush all existing sptes and stop the driver
- * from establishing any more sptes before all the
- * pages in the mm are freed.
- */
- if (mn->ops->release)
- mn->ops->release(mn, mm);
- srcu_read_unlock(&srcu, id);
-
spin_lock(&mm->mmu_notifier_mm->lock);
while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
mn = hlist_entry(mm->mmu_notifier_mm->list.first,
struct mmu_notifier,
hlist);
+
/*
- * We arrived before mmu_notifier_unregister so
- * mmu_notifier_unregister will do nothing other than
- * to wait ->release to finish and
- * mmu_notifier_unregister to return.
+ * Unlink. This will prevent mmu_notifier_unregister()
+ * from also making the ->release() callout.
*/
hlist_del_init_rcu(&mn->hlist);
+ spin_unlock(&mm->mmu_notifier_mm->lock);
+
+ /*
+ * Clear sptes. (see 'release' description in mmu_notifier.h)
+ */
+ if (mn->ops->release)
+ mn->ops->release(mn, mm);
+
+ spin_lock(&mm->mmu_notifier_mm->lock);
}
spin_unlock(&mm->mmu_notifier_mm->lock);
/*
- * synchronize_srcu here prevents mmu_notifier_release to
- * return to exit_mmap (which would proceed freeing all pages
- * in the mm) until the ->release method returns, if it was
- * invoked by mmu_notifier_unregister.
- *
- * The mmu_notifier_mm can't go away from under us because one
- * mm_count is hold by exit_mmap.
+ * All callouts to ->release() which we have done are complete.
+ * Allow synchronize_srcu() in mmu_notifier_unregister() to complete
+ */
+ srcu_read_unlock(&srcu, id);
+
+ /*
+ * mmu_notifier_unregister() may have unlinked a notifier and may
+ * still be calling out to it. Additionally, other notifiers
+ * may have been active via vmtruncate() et. al. Block here
+ * to ensure that all notifier callouts for this mm have been
+ * completed and the sptes are really cleaned up before returning
+ * to exit_mmap().
*/
synchronize_srcu(&srcu);
}
@@ -294,31 +296,31 @@ void mmu_notifier_unregister(struct mmu_
{
BUG_ON(atomic_read(&mm->mm_count) <= 0);
+ spin_lock(&mm->mmu_notifier_mm->lock);
if (!hlist_unhashed(&mn->hlist)) {
- /*
- * SRCU here will force exit_mmap to wait ->release to finish
- * before freeing the pages.
- */
int id;
- id = srcu_read_lock(&srcu);
/*
- * exit_mmap will block in mmu_notifier_release to
- * guarantee ->release is called before freeing the
- * pages.
+ * Ensure we synchronize up with __mmu_notifier_release().
*/
+ id = srcu_read_lock(&srcu);
+
+ hlist_del_rcu(&mn->hlist);
+ spin_unlock(&mm->mmu_notifier_mm->lock);
+
if (mn->ops->release)
mn->ops->release(mn, mm);
- srcu_read_unlock(&srcu, id);
- spin_lock(&mm->mmu_notifier_mm->lock);
- hlist_del_rcu(&mn->hlist);
+ /*
+ * Allow __mmu_notifier_release() to complete.
+ */
+ srcu_read_unlock(&srcu, id);
+ } else
spin_unlock(&mm->mmu_notifier_mm->lock);
- }
/*
- * Wait any running method to finish, of course including
- * ->release if it was run by mmu_notifier_relase instead of us.
+ * Wait for any running method to finish, including ->release() if it
+ * was run by __mmu_notifier_release() instead of us.
*/
synchronize_srcu(&srcu);
next prev parent reply other threads:[~2013-02-27 1:14 UTC|newest]
Thread overview: 162+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-26 23:54 [ 000/150] 3.8.1-stable review Greg Kroah-Hartman
2013-02-26 23:54 ` [ 001/150] x86-32, mm: Rip out x86_32 NUMA remapping code Greg Kroah-Hartman
2013-02-26 23:54 ` [ 002/150] x86-32, mm: Remove reference to resume_map_numa_kva() Greg Kroah-Hartman
2013-02-26 23:54 ` [ 003/150] x86-32, mm: Remove reference to alloc_remap() Greg Kroah-Hartman
2013-02-26 23:54 ` [ 004/150] perf tools: Fix build with bison 2.3 and older Greg Kroah-Hartman
2013-02-26 23:54 ` [ 005/150] perf hists: Fix period symbol_conf.field_sep display Greg Kroah-Hartman
2013-02-26 23:54 ` [ 006/150] timeconst.pl: Eliminate Perl warning Greg Kroah-Hartman
2013-02-26 23:54 ` [ 007/150] genirq: Avoid deadlock in spurious handling Greg Kroah-Hartman
2013-02-26 23:54 ` [ 008/150] posix-cpu-timers: Fix nanosleep task_struct leak Greg Kroah-Hartman
2013-02-26 23:54 ` [ 009/150] hrtimer: Prevent hrtimer_enqueue_reprogram race Greg Kroah-Hartman
2013-02-26 23:54 ` [ 010/150] x86: Hyper-V: register clocksource only if its advertised Greg Kroah-Hartman
2013-02-26 23:54 ` [ 011/150] workqueue: un-GPL function delayed_work_timer_fn() Greg Kroah-Hartman
2013-02-26 23:54 ` [ 012/150] ALSA: ali5451: remove irq enabling in pointer callback Greg Kroah-Hartman
2013-02-26 23:54 ` [ 013/150] ALSA: rme32.c irq enabling after spin_lock_irq Greg Kroah-Hartman
2013-02-26 23:54 ` [ 014/150] ALSA: aloop: Fix Oops while PM resume Greg Kroah-Hartman
2013-02-26 23:54 ` [ 015/150] tty: Prevent deadlock in n_gsm driver Greg Kroah-Hartman
2013-02-26 23:54 ` [ 016/150] tty: set_termios/set_termiox should not return -EINTR Greg Kroah-Hartman
2013-02-26 23:54 ` [ 017/150] USB: serial: fix null-pointer dereferences on disconnect Greg Kroah-Hartman
2013-02-26 23:54 ` [ 018/150] serial: imx: Fix recursive locking bug Greg Kroah-Hartman
2013-02-26 23:54 ` [ 019/150] serial_core: Fix type definition for PORT_BRCM_TRUMANAGE Greg Kroah-Hartman
2013-02-28 0:05 ` Ben Hutchings
2013-02-28 0:39 ` Greg Kroah-Hartman
2013-03-03 2:51 ` Ben Hutchings
2013-03-03 3:38 ` Ben Hutchings
2013-03-04 2:41 ` Greg Kroah-Hartman
2013-03-04 3:35 ` Ben Hutchings
2013-02-26 23:54 ` [ 020/150] b43: Increase number of RX DMA slots Greg Kroah-Hartman
2013-02-26 23:54 ` [ 021/150] rtlwifi: rtl8192cu: Fix NULL dereference BUG when using new_id Greg Kroah-Hartman
2013-02-26 23:54 ` [ 022/150] rtlwifi: rtl8192cu: Add new USB ID Greg Kroah-Hartman
2013-02-26 23:54 ` [ 023/150] rtlwifi: usb: allocate URB control message setup_packet and data buffer separately Greg Kroah-Hartman
2013-02-26 23:54 ` [ 024/150] tty vt: fix character insertion overflow Greg Kroah-Hartman
2013-02-26 23:54 ` [ 025/150] xen: Send spinlock IPI to all waiters Greg Kroah-Hartman
2013-02-26 23:54 ` [ 026/150] xen: close evtchn port if binding to irq fails Greg Kroah-Hartman
2013-02-26 23:54 ` [ 027/150] pps: Add pps_lookup_dev() function Greg Kroah-Hartman
2013-02-26 23:54 ` [ 028/150] pps: Use pps_lookup_dev to reduce ldisc coupling Greg Kroah-Hartman
2013-02-26 23:54 ` [ 029/150] pps: Fix a use-after free bug when unregistering a source Greg Kroah-Hartman
2013-02-26 23:54 ` [ 030/150] zram: Fix deadlock bug in partial read/write Greg Kroah-Hartman
2013-02-26 23:54 ` [ 031/150] Driver core: treat unregistered bus_types as having no devices Greg Kroah-Hartman
2013-02-26 23:54 ` Greg Kroah-Hartman [this message]
2013-02-26 23:54 ` [ 033/150] KVM: s390: Handle hosts not supporting s390-virtio Greg Kroah-Hartman
2013-02-26 23:54 ` [ 034/150] s390/kvm: Fix store status for ACRS/FPRS Greg Kroah-Hartman
2013-02-26 23:54 ` [ 035/150] futex: Revert "futex: Mark get_robust_list as deprecated" Greg Kroah-Hartman
2013-02-26 23:54 ` [ 036/150] inotify: remove broken mask checks causing unmount to be EINVAL Greg Kroah-Hartman
2013-02-26 23:54 ` [ 037/150] fs/block_dev.c: page cache wrongly left invalidated after revalidate_disk() Greg Kroah-Hartman
2013-02-26 23:54 ` [ 038/150] ocfs2: unlock super lock if lockres refresh failed Greg Kroah-Hartman
2013-02-26 23:54 ` [ 039/150] drivers/video/backlight/adp88?0_bl.c: fix resume Greg Kroah-Hartman
2013-02-26 23:54 ` [ 040/150] KEYS: Revert one application of "Fix unreachable code" patch Greg Kroah-Hartman
2013-02-26 23:54 ` [ 041/150] tmpfs: fix use-after-free of mempolicy object Greg Kroah-Hartman
2013-02-26 23:54 ` [ 042/150] mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages Greg Kroah-Hartman
2013-02-26 23:55 ` [ 043/150] drivercore: Fix ordering between deferred_probe and exiting initcalls Greg Kroah-Hartman
2013-02-26 23:55 ` [ 044/150] umount oops when remove blocklayoutdriver first Greg Kroah-Hartman
2013-02-26 23:55 ` [ 045/150] NLM: Ensure that we resend all pending blocking locks after a reclaim Greg Kroah-Hartman
2013-02-26 23:55 ` [ 046/150] NFSv4.1: Fix an ABBA locking issue with session and state serialisation Greg Kroah-Hartman
2013-02-26 23:55 ` [ 047/150] NFSv4.1: Fix bulk recall and destroy of layouts Greg Kroah-Hartman
2013-02-26 23:55 ` [ 048/150] NFSv4.1: Dont decode skipped layoutgets Greg Kroah-Hartman
2013-02-26 23:55 ` [ 049/150] p54usb: corrected USB ID for T-Com Sinus 154 data II Greg Kroah-Hartman
2013-02-26 23:55 ` [ 050/150] ALSA: usb-audio: fix Roland A-PRO support Greg Kroah-Hartman
2013-02-26 23:55 ` [ 051/150] ALSA: usb/quirks, fix out-of-bounds access Greg Kroah-Hartman
2013-02-26 23:55 ` [ 052/150] ALSA: usb: Fix Processing Unit Descriptor parsers Greg Kroah-Hartman
2013-02-26 23:55 ` [ 053/150] ALSA: hda - Disable runtime PM for Intel 5 Series/3400 Greg Kroah-Hartman
2013-02-26 23:55 ` [ 054/150] ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open() Greg Kroah-Hartman
2013-02-26 23:55 ` [ 055/150] ALSA: hda - Fix default multichannel HDMI mapping regression Greg Kroah-Hartman
2013-02-26 23:55 ` [ 056/150] ALSA: hda - Workaround for silent output on Sony Vaio VGC-LN51JGB with ALC889 Greg Kroah-Hartman
2013-02-26 23:55 ` [ 057/150] ALSA: hda - Fix broken workaround for HDMI/SPDIF conflicts Greg Kroah-Hartman
2013-02-26 23:55 ` [ 058/150] ALSA: hda - hdmi: ELD shouldnt be valid after unplug Greg Kroah-Hartman
2013-02-26 23:55 ` [ 059/150] GFS2: Get a block reservation before resizing a file Greg Kroah-Hartman
2013-02-26 23:55 ` [ 060/150] sparc64: Fix gfp_flags setting in tsb_grow() Greg Kroah-Hartman
2013-02-26 23:55 ` [ 061/150] sparc64: Handle hugepage TSB being NULL Greg Kroah-Hartman
2013-02-26 23:55 ` [ 062/150] sparc64: Fix tsb_grow() in atomic context Greg Kroah-Hartman
2013-02-26 23:55 ` [ 063/150] sparc64: Fix huge PMD to PTE translation for sun4u in TLB miss handler Greg Kroah-Hartman
2013-02-26 23:55 ` [ 064/150] drm/radeon/dce6: fix display powergating Greg Kroah-Hartman
2013-02-26 23:55 ` [ 065/150] drm/radeon: fix multi-head power profile stability on BTC+ asics Greg Kroah-Hartman
2013-02-26 23:55 ` [ 066/150] drm/radeon: remove overzealous warning in hdmi handling Greg Kroah-Hartman
2013-02-26 23:55 ` [ 067/150] drm/radeon: properly validate the atpx interface Greg Kroah-Hartman
2013-02-26 23:55 ` [ 068/150] drm/udl: make usage as a console safer Greg Kroah-Hartman
2013-02-26 23:55 ` [ 069/150] drm/udl: disable fb_defio by default Greg Kroah-Hartman
2013-02-26 23:55 ` [ 070/150] vgacon/vt: clear buffer attributes when we load a 512 character font (v2) Greg Kroah-Hartman
2013-02-26 23:55 ` [ 071/150] PCI: Fix PCI Express Capability accessors for PCI_EXP_FLAGS Greg Kroah-Hartman
2013-02-26 23:55 ` [ 072/150] drm: dont add inferred modes for monitors that dont support them Greg Kroah-Hartman
2013-02-26 23:55 ` [ 073/150] drm: shut up invalid edid messages Greg Kroah-Hartman
2013-02-26 23:55 ` [ 074/150] drm: Fill depth/bits_per_pixel for C8 format Greg Kroah-Hartman
2013-02-26 23:55 ` [ 075/150] drm: Use C8 instead of RGB332 when determining the format from depth/bpp Greg Kroah-Hartman
2013-02-26 23:55 ` [ 076/150] Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S" Greg Kroah-Hartman
2013-02-26 23:55 ` [ 077/150] drm/usb: bind driver to correct device Greg Kroah-Hartman
2013-02-26 23:55 ` [ 078/150] intel/iommu: force writebuffer-flush quirk on Gen 4 Chipsets Greg Kroah-Hartman
2013-02-26 23:55 ` [ 079/150] get rid of unprotected dereferencing of mnt->mnt_ns Greg Kroah-Hartman
2013-02-26 23:55 ` [ 080/150] drm/i915: Preserve the DDI link reversal configuration Greg Kroah-Hartman
2013-02-26 23:55 ` [ 081/150] drm/i915: Preserve the FDI line reversal override bit on CPT Greg Kroah-Hartman
2013-02-26 23:55 ` [ 082/150] drm/i915: Only run idle processing from i915_gem_retire_requests_worker Greg Kroah-Hartman
2013-02-26 23:55 ` [ 083/150] drm/i915: Fix CAGF for HSW Greg Kroah-Hartman
2013-02-26 23:55 ` [ 084/150] drm/i915: Fix RC6VIDS encode/decode Greg Kroah-Hartman
2013-02-26 23:55 ` [ 085/150] drm/i915: write backlight harder Greg Kroah-Hartman
2013-02-26 23:55 ` [ 086/150] drm/i915: disable shared panel fitter for pipe Greg Kroah-Hartman
2013-02-26 23:55 ` [ 087/150] drm/i915: Set i9xx sdvo clock limits according to specifications Greg Kroah-Hartman
2013-02-26 23:55 ` [ 088/150] drm/i915: add missing \n to UTS_RELEASE in the error_state Greg Kroah-Hartman
2013-02-26 23:55 ` [ 089/150] drm/i915: Use HAS_L3_GPU_CACHE in i915_gem_l3_remap Greg Kroah-Hartman
2013-02-26 23:55 ` [ 090/150] drm/i915: inverted brightness quirk for Acer Aspire 4736Z Greg Kroah-Hartman
2013-02-26 23:55 ` [ 091/150] drm/i915: Handle untiled planes when computing their offsets Greg Kroah-Hartman
2013-02-26 23:55 ` [ 092/150] staging: zsmalloc: Fix TLB coherency and build problem Greg Kroah-Hartman
2013-02-26 23:55 ` [ 093/150] staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors Greg Kroah-Hartman
2013-02-26 23:55 ` [ 094/150] staging: comedi: ni_labpc: set up command4 register *after* command3 Greg Kroah-Hartman
2013-02-26 23:55 ` [ 095/150] staging: comedi: ni_labpc: correct differential channel sequence for AI commands Greg Kroah-Hartman
2013-02-26 23:55 ` [ 096/150] staging: vt6656: revert : 64 bit- Correctly address void structure Greg Kroah-Hartman
2013-02-26 23:55 ` [ 097/150] staging: vt6656: Revert: 64bit fixes: dpc.c incorrect addressing of " Greg Kroah-Hartman
2013-02-26 23:55 ` [ 098/150] staging: vt6656: Fix URB submitted while active warning Greg Kroah-Hartman
2013-02-26 23:55 ` [ 099/150] ASoC: wm2200: correct IN2L and IN3L digital mute Greg Kroah-Hartman
2013-02-26 23:55 ` [ 100/150] ASoC: arizona: Fixed a bug in FLL fractional calculation Greg Kroah-Hartman
2013-02-26 23:55 ` [ 101/150] ARM: 7635/1: versatile: fix the PCI IRQ regression Greg Kroah-Hartman
2013-02-26 23:55 ` [ 102/150] ARM: PXA3xx: program the CSMSADRCFG register Greg Kroah-Hartman
2013-02-26 23:56 ` [ 103/150] ARM: at91/DT: remove atmel,use-dma-* from 9x5 and 9n12 USART nodes Greg Kroah-Hartman
2013-02-26 23:56 ` [ 104/150] ARM: samsung: fix assembly syntax for new gas Greg Kroah-Hartman
2013-02-26 23:56 ` [ 105/150] ARM: i.MX25: clk: parent per5_clk to AHB clock Greg Kroah-Hartman
2013-02-26 23:56 ` [ 106/150] ARM: integrator: ensure ap_syscon_base is initialised when !CONFIG_MMU Greg Kroah-Hartman
2013-02-26 23:56 ` [ 107/150] arm64: compat: use compat_uptr_t type for compat_ucontext.uc_link Greg Kroah-Hartman
2013-02-26 23:56 ` [ 108/150] ARM: 7643/1: sched: correct update_sched_clock() Greg Kroah-Hartman
2013-02-26 23:56 ` [ 109/150] powerpc/kexec: Disable hard IRQ before kexec Greg Kroah-Hartman
2013-02-26 23:56 ` [ 110/150] uprobes/powerpc: Add dependency on single step emulation Greg Kroah-Hartman
2013-02-26 23:56 ` [ 111/150] powerpc/eeh: Fix crash when adding a device in a slot with DDW Greg Kroah-Hartman
2013-02-26 23:56 ` [ 112/150] [PARISC] Purge existing TLB entries in set_pte_at and ptep_set_wrprotect Greg Kroah-Hartman
2013-02-26 23:56 ` [ 113/150] pcmcia/vrc4171: Add missing spinlock init Greg Kroah-Hartman
2013-02-26 23:56 ` [ 114/150] drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp Greg Kroah-Hartman
2013-02-26 23:56 ` [ 115/150] drivers/video: fsl-diu-fb: fix bugs in interrupt handling Greg Kroah-Hartman
2013-02-26 23:56 ` [ 116/150] fbcon: dont lose the console font across generic->chip driver switch Greg Kroah-Hartman
2013-02-26 23:56 ` [ 117/150] fb: rework locking to fix lock ordering on takeover Greg Kroah-Hartman
2013-02-26 23:56 ` [ 118/150] fb: Yet another band-aid for fixing lockdep mess Greg Kroah-Hartman
2013-02-26 23:56 ` [ 119/150] mmc: sdhci-esdhc-imx: fix host version read Greg Kroah-Hartman
2013-02-26 23:56 ` [ 120/150] mmc: core: expose RPMB partition only for CMD23 capable hosts Greg Kroah-Hartman
2013-02-26 23:56 ` [ 121/150] HID: wiimote: fix nunchuck button parser Greg Kroah-Hartman
2013-02-26 23:56 ` [ 122/150] net: cdc_ncm: fix probing of devices with multiple control interface altsettings Greg Kroah-Hartman
2013-02-26 23:56 ` [ 123/150] xen-netback: correctly return errors from netbk_count_requests() Greg Kroah-Hartman
2013-02-26 23:56 ` [ 124/150] xen-netback: cancel the credit timer when taking the vif down Greg Kroah-Hartman
2013-02-26 23:56 ` [ 125/150] net: fix a compile error when SOCK_REFCNT_DEBUG is enabled Greg Kroah-Hartman
2013-02-26 23:56 ` [ 126/150] xfrm: release neighbor upon dst destruction Greg Kroah-Hartman
2013-02-26 23:56 ` [ 127/150] ppp: set qdisc_tx_busylock to avoid LOCKDEP splat Greg Kroah-Hartman
2013-02-26 23:56 ` [ 128/150] ipv6: fix race condition regarding dst->expires and dst->from Greg Kroah-Hartman
2013-02-26 23:56 ` [ 129/150] ipv4: fix a bug in ping_err() Greg Kroah-Hartman
2013-02-26 23:56 ` [ 130/150] ipv6: use a stronger hash for tcp Greg Kroah-Hartman
2013-02-26 23:56 ` [ 131/150] ipv4: fix error handling in icmp_protocol Greg Kroah-Hartman
2013-02-26 23:56 ` [ 132/150] tcp: fix SYN-data space mis-accounting Greg Kroah-Hartman
2013-02-26 23:56 ` [ 133/150] mlx4_en: fix allocation of device tx_cq Greg Kroah-Hartman
2013-02-26 23:56 ` [ 134/150] mlx4_en: fix allocation of CPU affinity reverse-map Greg Kroah-Hartman
2013-02-26 23:56 ` [ 135/150] sock_diag: Fix out-of-bounds access to sock_diag_handlers[] Greg Kroah-Hartman
2013-02-26 23:56 ` [ 136/150] vlan: adjust vlan_set_encap_proto() for its callers Greg Kroah-Hartman
2013-02-26 23:56 ` [ 137/150] mac80211: always unblock CSA queue stop when disconnecting Greg Kroah-Hartman
2013-02-26 23:56 ` [ 138/150] USB: ehci-omap: Dont free gpios that we didnt request Greg Kroah-Hartman
2013-02-26 23:56 ` [ 139/150] gpio: em: Use irq_domain_add_simple() to fix runtime error Greg Kroah-Hartman
2013-02-26 23:56 ` [ 140/150] dma: sh: Dont use ENODEV for failing slave lookup Greg Kroah-Hartman
2013-02-26 23:56 ` [ 141/150] dca: check against empty dca_domains list before unregister provider Greg Kroah-Hartman
2013-02-26 23:56 ` [ 142/150] USB: option: add and update Alcatel modems Greg Kroah-Hartman
2013-02-26 23:56 ` [ 143/150] USB: option: add Yota / Megafon M100-1 4g modem Greg Kroah-Hartman
2013-02-26 23:56 ` [ 144/150] USB: option: add Huawei "ACM" devices using protocol = vendor Greg Kroah-Hartman
2013-02-26 23:56 ` [ 145/150] USB: ehci-omap: Fix autoloading of module Greg Kroah-Hartman
2013-02-26 23:56 ` [ 146/150] USB: storage: properly handle the endian issues of idProduct Greg Kroah-Hartman
2013-02-26 23:56 ` [ 147/150] USB: usb-storage: unusual_devs update for Super TOP SATA bridge Greg Kroah-Hartman
2013-02-26 23:56 ` [ 148/150] usb: musb: core: fix failure path Greg Kroah-Hartman
2013-02-26 23:56 ` [ 149/150] usb: musb: fix dependency on transceiver driver Greg Kroah-Hartman
2013-02-26 23:56 ` [ 150/150] usb: musb: ux500: use clk_prepare_enable and clk_disable_unprepare Greg Kroah-Hartman
2013-02-27 16:50 ` [ 000/150] 3.8.1-stable review Shuah Khan
2013-02-28 14:51 ` Satoru Takeuchi
2013-02-28 16:24 ` Greg Kroah-Hartman
2013-02-28 22:26 ` Satoru Takeuchi
2013-02-27 23:09 ` Linus Walleij
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130226235527.543152380@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=avi@redhat.com \
--cc=haggaie@mellanox.com \
--cc=holt@sgi.com \
--cc=hughd@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=liwanp@linux.vnet.ibm.com \
--cc=mtosatti@redhat.com \
--cc=sagig@mellanox.co.il \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=xiaoguangrong@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).