From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Todd Kjos <tkjos@google.com>,
Minchan Kim <minchan@kernel.org>,
Martijn Coenen <maco@android.com>
Subject: [PATCH 4.18 014/158] android: binder: fix the race mmap and alloc_new_buf_locked
Date: Tue, 18 Sep 2018 00:40:44 +0200 [thread overview]
Message-ID: <20180917211711.383489293@linuxfoundation.org> (raw)
In-Reply-To: <20180917211710.383360696@linuxfoundation.org>
4.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <minchan@kernel.org>
commit da1b9564e85b1d7baf66cbfabcab27e183a1db63 upstream.
There is RaceFuzzer report like below because we have no lock to close
below the race between binder_mmap and binder_alloc_new_buf_locked.
To close the race, let's use memory barrier so that if someone see
alloc->vma is not NULL, alloc->vma_vm_mm should be never NULL.
(I didn't add stable mark intentionallybecause standard android
userspace libraries that interact with binder (libbinder & libhwbinder)
prevent the mmap/ioctl race. - from Todd)
"
Thread interleaving:
CPU0 (binder_alloc_mmap_handler) CPU1 (binder_alloc_new_buf_locked)
===== =====
// drivers/android/binder_alloc.c
// #L718 (v4.18-rc3)
alloc->vma = vma;
// drivers/android/binder_alloc.c
// #L346 (v4.18-rc3)
if (alloc->vma == NULL) {
...
// alloc->vma is not NULL at this point
return ERR_PTR(-ESRCH);
}
...
// #L438
binder_update_page_range(alloc, 0,
(void *)PAGE_ALIGN((uintptr_t)buffer->data),
end_page_addr);
// In binder_update_page_range() #L218
// But still alloc->vma_vm_mm is NULL here
if (need_mm && mmget_not_zero(alloc->vma_vm_mm))
alloc->vma_vm_mm = vma->vm_mm;
Crash Log:
==================================================================
BUG: KASAN: null-ptr-deref in __atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_unless include/linux/atomic.h:533 [inline]
BUG: KASAN: null-ptr-deref in mmget_not_zero include/linux/sched/mm.h:75 [inline]
BUG: KASAN: null-ptr-deref in binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
Write of size 4 at addr 0000000000000058 by task syz-executor0/11184
CPU: 1 PID: 11184 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x16e/0x22c lib/dump_stack.c:113
kasan_report_error mm/kasan/report.c:352 [inline]
kasan_report+0x163/0x380 mm/kasan/report.c:412
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x140/0x1a0 mm/kasan/kasan.c:267
kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278
__atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
atomic_add_unless include/linux/atomic.h:533 [inline]
mmget_not_zero include/linux/sched/mm.h:75 [inline]
binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
binder_alloc_new_buf_locked drivers/android/binder_alloc.c:443 [inline]
binder_alloc_new_buf+0x467/0xc30 drivers/android/binder_alloc.c:513
binder_transaction+0x125b/0x4fb0 drivers/android/binder.c:2957
binder_thread_write+0xc08/0x2770 drivers/android/binder.c:3528
binder_ioctl_write_read.isra.39+0x24f/0x8e0 drivers/android/binder.c:4456
binder_ioctl+0xa86/0xf34 drivers/android/binder.c:4596
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x154/0xd40 fs/ioctl.c:686
ksys_ioctl+0x94/0xb0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:706
do_syscall_64+0x167/0x4b0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
"
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 43 +++++++++++++++++++++++++++++++++--------
1 file changed, 35 insertions(+), 8 deletions(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -327,6 +327,35 @@ err_no_vma:
return vma ? -ENOMEM : -ESRCH;
}
+
+static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
+ struct vm_area_struct *vma)
+{
+ if (vma)
+ alloc->vma_vm_mm = vma->vm_mm;
+ /*
+ * If we see alloc->vma is not NULL, buffer data structures set up
+ * completely. Look at smp_rmb side binder_alloc_get_vma.
+ * We also want to guarantee new alloc->vma_vm_mm is always visible
+ * if alloc->vma is set.
+ */
+ smp_wmb();
+ alloc->vma = vma;
+}
+
+static inline struct vm_area_struct *binder_alloc_get_vma(
+ struct binder_alloc *alloc)
+{
+ struct vm_area_struct *vma = NULL;
+
+ if (alloc->vma) {
+ /* Look at description in binder_alloc_set_vma */
+ smp_rmb();
+ vma = alloc->vma;
+ }
+ return vma;
+}
+
static struct binder_buffer *binder_alloc_new_buf_locked(
struct binder_alloc *alloc,
size_t data_size,
@@ -343,7 +372,7 @@ static struct binder_buffer *binder_allo
size_t size, data_offsets_size;
int ret;
- if (alloc->vma == NULL) {
+ if (!binder_alloc_get_vma(alloc)) {
pr_err("%d: binder_alloc_buf, no vma\n",
alloc->pid);
return ERR_PTR(-ESRCH);
@@ -714,9 +743,7 @@ int binder_alloc_mmap_handler(struct bin
buffer->free = 1;
binder_insert_free_buffer(alloc, buffer);
alloc->free_async_space = alloc->buffer_size / 2;
- barrier();
- alloc->vma = vma;
- alloc->vma_vm_mm = vma->vm_mm;
+ binder_alloc_set_vma(alloc, vma);
mmgrab(alloc->vma_vm_mm);
return 0;
@@ -743,10 +770,10 @@ void binder_alloc_deferred_release(struc
int buffers, page_count;
struct binder_buffer *buffer;
- BUG_ON(alloc->vma);
-
buffers = 0;
mutex_lock(&alloc->mutex);
+ BUG_ON(alloc->vma);
+
while ((n = rb_first(&alloc->allocated_buffers))) {
buffer = rb_entry(n, struct binder_buffer, rb_node);
@@ -889,7 +916,7 @@ int binder_alloc_get_allocated_count(str
*/
void binder_alloc_vma_close(struct binder_alloc *alloc)
{
- WRITE_ONCE(alloc->vma, NULL);
+ binder_alloc_set_vma(alloc, NULL);
}
/**
@@ -924,7 +951,7 @@ enum lru_status binder_alloc_free_page(s
index = page - alloc->pages;
page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
- vma = alloc->vma;
+ vma = binder_alloc_get_vma(alloc);
if (vma) {
if (!mmget_not_zero(alloc->vma_vm_mm))
goto err_mmget;
next prev parent reply other threads:[~2018-09-17 23:07 UTC|newest]
Thread overview: 163+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-17 22:40 [PATCH 4.18 000/158] 4.18.9-stable review Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 001/158] i2c: xiic: Make the start and the byte count write atomic Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 002/158] i2c: i801: fix DNVs SMBCTRL register offset Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 003/158] HID: multitouch: fix Elan panels with 2 input modes declaration Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 004/158] HID: core: fix grouping by application Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 005/158] HID: i2c-hid: Fix flooded incomplete report after S3 on Rayd touchscreen Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 006/158] HID: input: fix leaking custom input node name Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 007/158] mm/hugetlb: filter out hugetlb pages if HUGEPAGE migration is not supported Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 008/158] memory_hotplug: fix kernel_panic on offline page processing Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 009/158] mac80211: dont update the PM state of a peer upon a multicast frame Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 010/158] scsi: lpfc: Correct MDS diag and nvmet configuration Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 011/158] nbd: dont allow invalid blocksize settings Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 012/158] block: dont warn when doing fsync on read-only devices Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 013/158] block: bfq: swap puts in bfqg_and_blkg_put Greg Kroah-Hartman
2018-09-17 22:40 ` Greg Kroah-Hartman [this message]
2018-09-17 22:40 ` [PATCH 4.18 015/158] MIPS: VDSO: Match data page cache colouring when D$ aliases Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 016/158] SMB3: Backup intent flag missing for directory opens with backupuid mounts Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 017/158] smb3: check for and properly advertise directory lease support Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 018/158] cifs: connect to servername instead of IP for IPC$ share Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 019/158] btrfs: fix qgroup_free wrong num_bytes in btrfs_subvolume_reserve_metadata Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 020/158] Btrfs: fix data corruption when deduplicating between different files Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 021/158] arm64: KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 022/158] KVM: arm/arm64: Clean dcache to PoC when changing PTE due to CoW Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 023/158] KVM: PPC: Book3S HV: Use correct pagesize in kvm_unmap_radix() Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 024/158] KVM: s390: vsie: copy wrapping keys to right place Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 025/158] KVM: x86: SVM: Set EMULTYPE_NO_REEXECUTE for RSM emulation Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 026/158] KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 027/158] KVM: x86: Invert emulation re-execute behavior to make it opt-in Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 028/158] KVM: x86: Merge EMULTYPE_RETRY and EMULTYPE_ALLOW_REEXECUTE Greg Kroah-Hartman
2018-09-17 22:40 ` [PATCH 4.18 029/158] KVM: x86: Default to not allowing emulation retry in kvm_mmu_page_fault Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 030/158] KVM: x86: Do not re-{try,execute} after failed emulation in L2 Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 031/158] ARC: [plat-axs*/plat-hsdk]: Allow U-Boot to pass MAC-address to the kernel Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 032/158] ACPI / LPSS: Force LPSS quirks on boot Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 033/158] memory: ti-aemif: fix a potential NULL-pointer dereference Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 034/158] ALSA: hda - Fix cancel_work_sync() stall from jackpoll work Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 035/158] cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun() Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 036/158] cpu/hotplug: Prevent state corruption on error rollback Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 037/158] x86/microcode: Make sure boot_cpu_data.microcode is up-to-date Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 038/158] x86/microcode: Update the new microcode revision unconditionally Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 039/158] x86/process: Dont mix user/kernel regs in 64bit __show_regs() Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 040/158] x86/apic/vector: Make error return value negative Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 041/158] switchtec: Fix Spectre v1 vulnerability Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 042/158] ARC: [plat-axs*]: Enable SWAP Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 043/158] tc-testing: flush gact actions on test teardown Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 044/158] tc-testing: remove duplicate spaces in connmark match patterns Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 045/158] misc: mic: SCIF Fix scif_get_new_port() error handling Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 046/158] ALSA: hda/realtek - Add mute LED quirk for HP Spectre x360 Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 047/158] ethtool: Remove trailing semicolon for static inline Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 048/158] i2c: aspeed: Add an explicit type casting for *get_clk_reg_val Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 049/158] Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 050/158] pinctrl: berlin: fix pctrl->functions allocation in berlin_pinctrl_build_state Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 051/158] gpio: tegra: Move driver registration to subsys_init level Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 052/158] powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 053/158] powerpc/4xx: Fix error return path in ppc4xx_msi_probe() Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 054/158] selftests/bpf: fix a typo in map in map test Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 055/158] media: davinci: vpif_display: Mix memory leak on probe error path Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 056/158] media: dw2102: Fix memleak on sequence of probes Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 057/158] net: phy: Fix the register offsets in Broadcom iProc mdio mux driver Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 058/158] scsi: qla2xxx: Fix unintended Logout Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 059/158] scsi: qla2xxx: Fix session state stuck in Get Port DB Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 060/158] scsi: qla2xxx: Silent erroneous message Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 061/158] clk: scmi: Fix the rounding of clock rate Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 062/158] blk-mq: fix updating tags depth Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 063/158] scsi: lpfc: Fix driver crash when re-registering NVME rports Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 064/158] scsi: target: fix __transport_register_session locking Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 065/158] md/raid5: fix data corruption of replacements after originals dropped Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 066/158] timers: Clear timer_base::must_forward_clk with timer_base::lock held Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 067/158] media: camss: csid: Configure data type and decode format properly Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 068/158] gpu: ipu-v3: default to id 0 on missing OF alias Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 069/158] misc: ti-st: Fix memory leak in the error path of probe() Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 070/158] uio: potential double frees if __uio_register_device() fails Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 071/158] firmware: vpd: Fix section enabled flag on vpd_section_destroy Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 072/158] Drivers: hv: vmbus: Cleanup synic memory free path Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 073/158] tty: rocket: Fix possible buffer overwrite on register_PCI Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 074/158] uio: fix possible circular locking dependency Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 075/158] iwlwifi: pcie: dont access periphery registers when not available Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 076/158] IB/IPoIB: Set ah valid flag in multicast send flow Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 077/158] f2fs: fix to active page in lru list for read path Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 078/158] f2fs: do not set free of current section Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 079/158] f2fs: Keep alloc_valid_block_count in sync Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 080/158] f2fs: issue discard align to section in LFS mode Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 081/158] f2fs: fix defined but not used build warnings Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 082/158] f2fs: fix to detect looped node chain correctly Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 083/158] ASoC: soc-pcm: Use delay set in component pointer function Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 084/158] perf tools: Allow overriding MAX_NR_CPUS at compile time Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 085/158] device-dax: avoid hang on error before devm_memremap_pages() Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 086/158] NFSv4.0 fix client reference leak in callback Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 087/158] perf c2c report: Fix crash for empty browser Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 088/158] perf evlist: Fix error out while applying initial delay and LBR Greg Kroah-Hartman
2018-09-17 22:41 ` [PATCH 4.18 089/158] powerpc/pseries: fix EEH recovery of some IOV devices Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 090/158] macintosh/via-pmu: Add missing mmio accessors Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 091/158] perf build: Fix installation directory for eBPF Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 092/158] ath9k: report tx status on EOSP Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 093/158] ath9k_hw: fix channel maximum power level test Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 094/158] ath10k: prevent active scans on potential unusable channels Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 095/158] wlcore: Set rx_status boottime_ns field on rx Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 096/158] rpmsg: core: add support to power domains for devices Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 097/158] mtd: rawnand: make subop helpers return unsigned values Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 098/158] scsi: tcmu: do not set max_blocks if data_bitmap has been setup Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 099/158] MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 100/158] ata: libahci: Allow reconfigure of DEVSLP register Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 101/158] ata: libahci: Correct setting " Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 102/158] nfs: Referrals not inheriting proto setting from parent Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 103/158] scsi: 3ware: fix return 0 on the error path of probe Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 104/158] tools/testing/nvdimm: kaddr and pfn can be NULL to ->direct_access() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 105/158] ath10k: disable bundle mgmt tx completion event support Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 106/158] media: em28xx: explicitly disable TS packet filter Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 107/158] PCI: mobiveil: Add missing ../pci.h include Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 108/158] PCI: mobiveil: Fix struct mobiveil_pcie.pcie_reg_base address type Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 109/158] powerpc/mm: Dont report PUDs as memory leaks when using kmemleak Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 110/158] Bluetooth: hidp: Fix handling of strncpy for hid->name information Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 111/158] x86/mm: Remove in_nmi() warning from vmalloc_fault() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 112/158] regulator: tps65217: Fix NULL pointer dereference on probe Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 113/158] pinctrl: imx: off by one in imx_pinconf_group_dbg_show() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 114/158] gpio: pxa: disable pinctrl calls for PXA3xx Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 115/158] gpio: ml-ioh: Fix buffer underwrite on probe error path Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 116/158] pinctrl/amd: only handle irq if it is pending and unmasked Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 117/158] net: mvneta: fix mtu change on port without link Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 118/158] f2fs: try grabbing node page lock aggressively in sync scenario Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 119/158] pktcdvd: Fix possible Spectre-v1 for pkt_devs Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 120/158] f2fs: fix to skip GC if type in SSA and SIT is inconsistent Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 121/158] tpm_tis_spi: Pass the SPI IRQ down to the driver Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 122/158] tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 123/158] f2fs: fix to do sanity check with reserved blkaddr of inline inode Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 124/158] MIPS: Octeon: add missing of_node_put() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 125/158] MIPS: generic: fix " Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 126/158] thermal: rcar_thermal: avoid NULL dereference in absence of IRQ resources Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 127/158] thermal_hwmon: Sanitize attribute name passed to hwmon Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 128/158] net: dcb: For wild-card lookups, use priority -1, not 0 Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 129/158] dm cache: only allow a single io_mode cache feature to be requested Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 130/158] Input: atmel_mxt_ts - only use first T9 instance Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 131/158] media: s5p-mfc: Fix buffer look up in s5p_mfc_handle_frame_{new, copy_time} functions Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 132/158] partitions/aix: append null character to print data from disk Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 133/158] partitions/aix: fix usage of uninitialized lv_info and lvname structures Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 134/158] media: rcar-csi2: update stream start for V3M Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 135/158] media: helene: fix xtal frequency setting at power on Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 136/158] drm/amd/display: Prevent PSR from being enabled if initialization fails Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 137/158] media: em28xx: Fix dual transport stream operation Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 138/158] iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in kdump kernel Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 139/158] f2fs: fix to wait on page writeback before updating page Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 140/158] f2fs: Fix uninitialized return in f2fs_ioc_shutdown() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 141/158] media: em28xx: Fix DualHD disconnect oops Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 142/158] f2fs: avoid potential deadlock in f2fs_sbi_store Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 143/158] f2fs: fix to do sanity check with secs_per_zone Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 144/158] mfd: rave-sp: Initialize flow control and parity of the port Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 145/158] iommu/ipmmu-vmsa: Fix allocation in atomic context Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 146/158] mfd: ti_am335x_tscadc: Fix struct clk memory leak Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 147/158] f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 148/158] f2fs: fix to propagate return value of scan_nat_page() Greg Kroah-Hartman
2018-09-17 22:42 ` [PATCH 4.18 149/158] f2fs: fix to do sanity check with extra_attr feature Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 150/158] RDMA/hns: Add illegal hop_num judgement Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 151/158] NFSv4.1: Fix a potential layoutget/layoutrecall deadlock Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 152/158] RDMA/hns: Update the data type of immediate data Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 153/158] MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 154/158] MIPS: mscc: ocelot: fix length of memory address space for MIIM Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 155/158] RDMA/cma: Do not ignore net namespace for unbound cm_id Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 156/158] clocksource: Revert "Remove kthread" Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 157/158] autofs: fix autofs_sbi() does not check super block type Greg Kroah-Hartman
2018-09-17 22:43 ` [PATCH 4.18 158/158] mm: get rid of vmacache_flush_all() entirely Greg Kroah-Hartman
2018-09-18 16:21 ` [PATCH 4.18 000/158] 4.18.9-stable review Guenter Roeck
2018-09-18 17:32 ` Greg Kroah-Hartman
2018-09-18 16:48 ` Naresh Kamboju
2018-09-18 17:33 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180917211711.383489293@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=minchan@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).