From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Timofey Titovets <nefelim4ag@gmail.com>,
Yongjian Xu <yongjianchn@gmail.com>,
Eric Dumazet <edumazet@google.com>,
Soheil Hassas Yeganeh <soheil@google.com>,
"David S. Miller" <davem@davemloft.net>,
Mao Wenan <maowenan@huawei.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 212/223] tcp: reset sk_send_head in tcp_write_queue_purge
Date: Fri, 2 Aug 2019 11:37:17 +0200 [thread overview]
Message-ID: <20190802092250.566118754@linuxfoundation.org> (raw)
In-Reply-To: <20190802092238.692035242@linuxfoundation.org>
[ Upstream commit dbbf2d1e4077bab0c65ece2765d3fc69cf7d610f ]
tcp_write_queue_purge clears all the SKBs in the write queue
but does not reset the sk_send_head. As a result, we can have
a NULL pointer dereference anywhere that we use tcp_send_head
instead of the tcp_write_queue_tail.
For example, after a27fd7a8ed38 (tcp: purge write queue upon RST),
we can purge the write queue on RST. Prior to
75c119afe14f (tcp: implement rb-tree based retransmit queue),
tcp_push will only check tcp_send_head and then accesses
tcp_write_queue_tail to send the actual SKB. As a result, it will
dereference a NULL pointer.
This has been reported twice for 4.14 where we don't have
75c119afe14f:
By Timofey Titovets:
[ 422.081094] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000038
[ 422.081254] IP: tcp_push+0x42/0x110
[ 422.081314] PGD 0 P4D 0
[ 422.081364] Oops: 0002 [#1] SMP PTI
By Yongjian Xu:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: tcp_push+0x48/0x120
PGD 80000007ff77b067 P4D 80000007ff77b067 PUD 7fd989067 PMD 0
Oops: 0002 [#18] SMP PTI
Modules linked in: tcp_diag inet_diag tcp_bbr sch_fq iTCO_wdt
iTCO_vendor_support pcspkr ixgbe mdio i2c_i801 lpc_ich joydev input_leds shpchp
e1000e igb dca ptp pps_core hwmon mei_me mei ipmi_si ipmi_msghandler sg ses
scsi_transport_sas enclosure ext4 jbd2 mbcache sd_mod ahci libahci megaraid_sas
wmi ast ttm dm_mirror dm_region_hash dm_log dm_mod dax
CPU: 6 PID: 14156 Comm: [ET_NET 6] Tainted: G D 4.14.26-1.el6.x86_64 #1
Hardware name: LENOVO ThinkServer RD440 /ThinkServer RD440, BIOS A0TS80A
09/22/2014
task: ffff8807d78d8140 task.stack: ffffc9000e944000
RIP: 0010:tcp_push+0x48/0x120
RSP: 0018:ffffc9000e947a88 EFLAGS: 00010246
RAX: 00000000000005b4 RBX: ffff880f7cce9c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff8807d00f5000
RBP: ffffc9000e947aa8 R08: 0000000000001c84 R09: 0000000000000000
R10: ffff8807d00f5158 R11: 0000000000000000 R12: ffff8807d00f5000
R13: 0000000000000020 R14: 00000000000256d4 R15: 0000000000000000
FS: 00007f5916de9700(0000) GS:ffff88107fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000038 CR3: 00000007f8226004 CR4: 00000000001606e0
Call Trace:
tcp_sendmsg_locked+0x33d/0xe50
tcp_sendmsg+0x37/0x60
inet_sendmsg+0x39/0xc0
sock_sendmsg+0x49/0x60
sock_write_iter+0xb6/0x100
do_iter_readv_writev+0xec/0x130
? rw_verify_area+0x49/0xb0
do_iter_write+0x97/0xd0
vfs_writev+0x7e/0xe0
? __wake_up_common_lock+0x80/0xa0
? __fget_light+0x2c/0x70
? __do_page_fault+0x1e7/0x530
do_writev+0x60/0xf0
? inet_shutdown+0xac/0x110
SyS_writev+0x10/0x20
do_syscall_64+0x6f/0x140
? prepare_exit_to_usermode+0x8b/0xa0
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x3135ce0c57
RSP: 002b:00007f5916de4b00 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000003135ce0c57
RDX: 0000000000000002 RSI: 00007f5916de4b90 RDI: 000000000000606f
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f5916de8c38
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000464cc
R13: 00007f5916de8c30 R14: 00007f58d8bef080 R15: 0000000000000002
Code: 48 8b 97 60 01 00 00 4c 8d 97 58 01 00 00 41 b9 00 00 00 00 41 89 f3 4c 39
d2 49 0f 44 d1 41 81 e3 00 80 00 00 0f 85 b0 00 00 00 <80> 4a 38 08 44 8b 8f 74
06 00 00 44 89 8f 7c 06 00 00 83 e6 01
RIP: tcp_push+0x48/0x120 RSP: ffffc9000e947a88
CR2: 0000000000000038
---[ end trace 8d545c2e93515549 ]---
There is other scenario which found in stable 4.4:
Allocated:
[<ffffffff82f380a6>] __alloc_skb+0xe6/0x600 net/core/skbuff.c:218
[<ffffffff832466c3>] alloc_skb_fclone include/linux/skbuff.h:856 [inline]
[<ffffffff832466c3>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
[<ffffffff83249164>] tcp_sendmsg+0xd34/0x2b00 net/ipv4/tcp.c:1178
[<ffffffff83300ef3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
Freed:
[<ffffffff82f372fd>] __kfree_skb+0x1d/0x20 net/core/skbuff.c:676
[<ffffffff83288834>] sk_wmem_free_skb include/net/sock.h:1447 [inline]
[<ffffffff83288834>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
[<ffffffff83288834>] tcp_connect_init net/ipv4/tcp_output.c:3122 [inline]
[<ffffffff83288834>] tcp_connect+0xb24/0x30c0 net/ipv4/tcp_output.c:3261
[<ffffffff8329b991>] tcp_v4_connect+0xf31/0x1890 net/ipv4/tcp_ipv4.c:246
BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:796 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline]
BUG: KASAN: use-after-free in tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056
[<ffffffff81515cd5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
[<ffffffff814f9784>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427
[<ffffffff83286582>] tcp_skb_pcount include/net/tcp.h:796 [inline]
[<ffffffff83286582>] tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline]
[<ffffffff83286582>] tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056
[<ffffffff83287a40>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2307
stable 4.4 and stable 4.9 don't have the commit abb4a8b870b5 ("tcp: purge write queue upon RST")
which is referred in dbbf2d1e4077,
in tcp_connect_init, it calls tcp_write_queue_purge, and does not reset sk_send_head, then UAF.
stable 4.14 have the commit abb4a8b870b5 ("tcp: purge write queue upon RST"),
in tcp_reset, it calls tcp_write_queue_purge(sk), and does not reset sk_send_head, then UAF.
So this patch can be used to fix stable 4.4 and 4.9.
Fixes: a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by: Timofey Titovets <nefelim4ag@gmail.com>
Reported-by: Yongjian Xu <yongjianchn@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Tested-by: Yongjian Xu <yongjianchn@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1512,6 +1512,11 @@ struct sock *tcp_try_fastopen(struct soc
void tcp_fastopen_init_key_once(bool publish);
#define TCP_FASTOPEN_KEY_LENGTH 16
+static inline void tcp_init_send_head(struct sock *sk)
+{
+ sk->sk_send_head = NULL;
+}
+
/* Fastopen key context */
struct tcp_fastopen_context {
struct crypto_cipher *tfm;
@@ -1528,6 +1533,7 @@ static inline void tcp_write_queue_purge
sk_wmem_free_skb(sk, skb);
sk_mem_reclaim(sk);
tcp_clear_all_retrans_hints(tcp_sk(sk));
+ tcp_init_send_head(sk);
inet_csk(sk)->icsk_backoff = 0;
}
@@ -1589,11 +1595,6 @@ static inline void tcp_check_send_head(s
tcp_sk(sk)->highest_sack = NULL;
}
-static inline void tcp_init_send_head(struct sock *sk)
-{
- sk->sk_send_head = NULL;
-}
-
static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb)
{
__skb_queue_tail(&sk->sk_write_queue, skb);
next prev parent reply other threads:[~2019-08-02 9:53 UTC|newest]
Thread overview: 231+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-02 9:33 [PATCH 4.9 000/223] 4.9.187-stable review Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 001/223] MIPS: ath79: fix ar933x uart parity mode Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 002/223] MIPS: fix build on non-linux hosts Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 003/223] arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 004/223] dmaengine: imx-sdma: fix use-after-free on probe error path Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 005/223] ath10k: Do not send probe response template for mesh Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 006/223] ath9k: Check for errors when reading SREV register Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 007/223] ath6kl: add some bounds checking Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 008/223] ath: DFS JP domain W56 fixed pulse type 3 RADAR detection Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 009/223] batman-adv: fix for leaked TVLV handler Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 010/223] media: dvb: usb: fix use after free in dvb_usb_device_exit Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 011/223] crypto: talitos - fix skcipher failure due to wrong output IV Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 012/223] media: marvell-ccic: fix DMA s/g desc number calculation Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 013/223] media: vpss: fix a potential NULL pointer dereference Greg Kroah-Hartman
2019-08-02 9:33 ` [PATCH 4.9 014/223] media: media_device_enum_links32: clean a reserved field Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 015/223] net: stmmac: dwmac1000: Clear unused address entries Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 016/223] net: stmmac: dwmac4/5: " Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 017/223] signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 018/223] af_key: fix leaks in key_pol_get_resp and dump_sp Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 019/223] xfrm: Fix xfrm sel prefix length validation Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 020/223] media: mc-device.c: dont memset __user pointer contents Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 021/223] media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 022/223] net: phy: Check against net_device being NULL Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 023/223] crypto: talitos - properly handle split ICV Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 024/223] crypto: talitos - Align SEC1 accesses to 32 bits boundaries Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 025/223] tua6100: Avoid build warnings Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 026/223] locking/lockdep: Fix merging of hlocks with non-zero references Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 027/223] media: wl128x: Fix some error handling in fm_v4l2_init_video_device() Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 028/223] cpupower : frequency-set -r option misses the last cpu in related cpu list Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 029/223] net: fec: Do not use netdev messages too early Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 030/223] net: axienet: Fix race condition causing TX hang Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 031/223] s390/qdio: handle PENDING state for QEBSM devices Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 032/223] perf cs-etm: Properly set the value of old and head in snapshot mode Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 033/223] perf test 6: Fix missing kvm module load for s390 Greg Kroah-Hartman
2019-08-28 0:12 ` Ben Hutchings
2019-08-28 3:02 ` Sasha Levin
2019-08-02 9:34 ` [PATCH 4.9 034/223] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 035/223] gpio: omap: ensure irq is enabled before wakeup Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 036/223] regmap: fix bulk writes on paged registers Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 037/223] bpf: silence warning messages in core Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 038/223] rcu: Force inlining of rcu_read_lock() Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 039/223] blkcg, writeback: dead memcgs shouldnt contribute to writeback ownership arbitration Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 040/223] xfrm: fix sa selector validation Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 041/223] perf evsel: Make perf_evsel__name() accept a NULL argument Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 042/223] vhost_net: disable zerocopy by default Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 043/223] ipoib: correcly show a VF hardware address Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 044/223] EDAC/sysfs: Fix memory leak when creating a csrow object Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 045/223] ipsec: select crypto ciphers for xfrm_algo Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 046/223] media: i2c: fix warning same module names Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 047/223] ntp: Limit TAI-UTC offset Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 048/223] timer_list: Guard procfs specific code Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 049/223] acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 050/223] media: coda: fix mpeg2 sequence number handling Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 051/223] media: coda: increment sequence offset for the last returned frame Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 052/223] mt7601u: do not schedule rx_tasklet when the device has been disconnected Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 053/223] x86/build: Add set -e to mkcapflags.sh to delete broken capflags.c Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 054/223] mt7601u: fix possible memory leak when the device is disconnected Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 055/223] ath10k: fix PCIE device wake up failed Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 056/223] perf tools: Increase MAX_NR_CPUS and MAX_CACHES Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 057/223] libata: dont request sense data on !ZAC ATA devices Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 058/223] clocksource/drivers/exynos_mct: Increase priority over ARM arch timer Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 059/223] rslib: Fix decoding of shortened codes Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 060/223] rslib: Fix handling of of caller provided syndrome Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 061/223] ixgbe: Check DDM existence in transceiver before access Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 062/223] crypto: asymmetric_keys - select CRYPTO_HASH where needed Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 063/223] EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 064/223] bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 065/223] iwlwifi: mvm: Drop large non sta frames Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 066/223] net: usb: asix: init MAC address buffers Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 067/223] gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 068/223] Bluetooth: hci_bcsp: Fix memory leak in rx_skb Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 069/223] Bluetooth: 6lowpan: search for destination address in all peers Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 070/223] Bluetooth: Check state in l2cap_disconnect_rsp Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 071/223] Bluetooth: validate BLE connection interval updates Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 072/223] gtp: fix Illegal context switch in RCU read-side critical section Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 073/223] gtp: fix use-after-free in gtp_newlink() Greg Kroah-Hartman
2019-08-02 9:34 ` [PATCH 4.9 074/223] xen: let alloc_xenballooned_pages() fail if not enough memory free Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 075/223] scsi: NCR5380: Reduce goto statements in NCR5380_select() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 076/223] scsi: NCR5380: Always re-enable reselection interrupt Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 077/223] scsi: mac_scsi: Increase PIO/PDMA transfer length threshold Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 078/223] crypto: ghash - fix unaligned memory access in ghash_setkey() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 079/223] crypto: arm64/sha1-ce - correct digest for empty data in finup Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 080/223] crypto: arm64/sha2-ce " Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 081/223] crypto: chacha20poly1305 - fix atomic sleep when using async algorithm Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 082/223] crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 083/223] Input: gtco - bounds check collection indent level Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 084/223] regulator: s2mps11: Fix buck7 and buck8 wrong voltages Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 085/223] arm64: tegra: Update Jetson TX1 GPU regulator timings Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 086/223] iwlwifi: pcie: dont service an interrupt that was masked Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 087/223] tracing/snapshot: Resize spare buffer if size changed Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 088/223] NFSv4: Handle the special Linux file open access mode Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 089/223] lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 090/223] ALSA: seq: Break too long mutex context in the write loop Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 091/223] ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 092/223] media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 093/223] media: coda: Remove unbalanced and unneeded mutex unlock Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 094/223] KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 095/223] arm64: tegra: Fix AGIC register range Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 096/223] fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 097/223] drm/nouveau/i2c: Enable i2c pads & busses during preinit Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 098/223] padata: use smp_mb in padata_reorder to avoid orphaned padata jobs Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 099/223] 9p/virtio: Add cleanup path in p9_virtio_init Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 100/223] PCI: Do not poll for PME if the device is in D3cold Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 101/223] Btrfs: add missing inode version, ctime and mtime updates when punching hole Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 102/223] libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 103/223] take floppy compat ioctls to sodding floppy.c Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 104/223] floppy: fix div-by-zero in setup_format_params Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 105/223] floppy: fix out-of-bounds read in next_valid_format Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 106/223] floppy: fix invalid pointer dereference in drive_name Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 107/223] floppy: fix out-of-bounds read in copy_buffer Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 108/223] coda: pass the host file in vma->vm_file on mmap Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 109/223] gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 110/223] crypto: ccp - Validate the the error value used to index error messages Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 111/223] PCI: hv: Delete the device earlier from hbus->children for hot-remove Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 112/223] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 113/223] crypto: caam - limit output IV to CBC to work around CTR mode DMA issue Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 114/223] um: Allow building and running on older hosts Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 115/223] um: Fix FP register size for XSTATE/XSAVE Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 116/223] parisc: Ensure userspace privilege for ptraced processes in regset functions Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 117/223] parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 118/223] powerpc/32s: fix suspend/resume when IBATs 4-7 are used Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 119/223] powerpc/watchpoint: Restore NV GPRs while returning from exception Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 120/223] eCryptfs: fix a couple type promotion bugs Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 121/223] intel_th: msu: Fix single mode with disabled IOMMU Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 122/223] Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 123/223] usb: Handle USB3 remote wakeup for LPM enabled devices correctly Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 124/223] dm bufio: fix deadlock with loop device Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 125/223] compiler.h, kasan: Avoid duplicating __read_once_size_nocheck() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 126/223] compiler.h: Add read_word_at_a_time() function Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 127/223] lib/strscpy: Shut up KASAN false-positives in strscpy() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 128/223] ext4: allow directory holes Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 129/223] bnx2x: Prevent load reordering in tx completion processing Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 130/223] bnx2x: Prevent ptp_task to be rescheduled indefinitely Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 131/223] caif-hsi: fix possible deadlock in cfhsi_exit_module() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 132/223] igmp: fix memory leak in igmpv3_del_delrec() Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 133/223] ipv4: dont set IPv6 only flags to IPv4 addresses Greg Kroah-Hartman
2019-08-02 9:35 ` [PATCH 4.9 134/223] net: bcmgenet: use promisc for unsupported filters Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 135/223] net: dsa: mv88e6xxx: wait after reset deactivation Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 136/223] net: neigh: fix multiple neigh timer scheduling Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 137/223] net: openvswitch: fix csum updates for MPLS actions Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 138/223] nfc: fix potential illegal memory access Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 139/223] rxrpc: Fix send on a connected, but unbound socket Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 140/223] sky2: Disable MSI on ASUS P6T Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 141/223] vrf: make sure skb->data contains ip header to make routing Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 142/223] macsec: fix use-after-free of skb during RX Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 143/223] macsec: fix checksumming after decryption Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 144/223] netrom: fix a memory leak in nr_rx_frame() Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 145/223] netrom: hold sock when setting skb->destructor Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 146/223] bonding: validate ip header before check IPPROTO_IGMP Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 147/223] tcp: Reset bytes_acked and bytes_received when disconnecting Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 148/223] net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 149/223] net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 150/223] net: bridge: stp: dont cache eth dest pointer before skb pull Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 151/223] perf/x86/amd/uncore: Rename L2 to LLC Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 152/223] perf/x86/amd/uncore: Get correct number of cores sharing last level cache Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 153/223] perf/events/amd/uncore: Fix amd_uncore_llc ID to use pre-defined cpu_llc_id Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 154/223] NFSv4: Fix open create exclusive when the server reboots Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 155/223] nfsd: increase DRC cache limit Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 156/223] nfsd: give out fewer session slots as limit approaches Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 157/223] nfsd: fix performance-limiting session calculation Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 158/223] nfsd: Fix overflow causing non-working mounts on 1 TB machines Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 159/223] drm/panel: simple: Fix panel_simple_dsi_probe Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 160/223] usb: core: hub: Disable hub-initiated U1/U2 Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 161/223] tty: max310x: Fix invalid baudrate divisors calculator Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 162/223] pinctrl: rockchip: fix leaked of_node references Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 163/223] tty: serial: cpm_uart - fix init when SMC is relocated Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 164/223] drm/bridge: tc358767: read display_props in get_modes() Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 165/223] drm/bridge: sii902x: pixel clock unit is 10kHz instead of 1kHz Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 166/223] memstick: Fix error cleanup path of memstick_init Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 167/223] tty/serial: digicolor: Fix digicolor-usart already registered warning Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 168/223] tty: serial: msm_serial: avoid system lockup condition Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 169/223] serial: 8250: Fix TX interrupt handling condition Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 170/223] drm/virtio: Add memory barriers for capset cache Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 171/223] phy: renesas: rcar-gen2: Fix memory leak at error paths Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 172/223] drm/rockchip: Properly adjust to a true clock in adjusted_mode Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 173/223] tty: serial_core: Set port active bit in uart_port_activate Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 174/223] usb: gadget: Zero ffs_io_data Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 175/223] powerpc/pci/of: Fix OF flags parsing for 64bit BARs Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 176/223] PCI: sysfs: Ignore lockdep for remove attribute Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 177/223] kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 178/223] PCI: xilinx-nwl: Fix Multi MSI data programming Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 179/223] iio: iio-utils: Fix possible incorrect mask calculation Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 180/223] recordmcount: Fix spurious mcount entries on powerpc Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 181/223] mfd: core: Set fwnode for created devices Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 182/223] mfd: arizona: Fix undefined behavior Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 183/223] mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 184/223] um: Silence lockdep complaint about mmap_sem Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 185/223] powerpc/4xx/uic: clear pending interrupt after irq type/pol change Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 186/223] RDMA/i40iw: Set queue pair state when being queried Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 187/223] serial: sh-sci: Terminate TX DMA during buffer flushing Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 188/223] serial: sh-sci: Fix TX DMA buffer flushing and workqueue races Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 189/223] kallsyms: exclude kasan local symbols on s390 Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 190/223] perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 191/223] RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 192/223] powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 193/223] f2fs: avoid out-of-range memory access Greg Kroah-Hartman
2019-08-02 9:36 ` [PATCH 4.9 194/223] mailbox: handle failed named mailbox channel request Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 195/223] powerpc/eeh: Handle hugepages in ioremap space Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 196/223] sh: prevent warnings when using iounmap Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 197/223] mm/kmemleak.c: fix check for softirq context Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 198/223] 9p: pass the correct prototype to read_cache_page Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 199/223] mm/mmu_notifier: use hlist_add_head_rcu() Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 200/223] locking/lockdep: Fix lock used or unused stats error Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 201/223] locking/lockdep: Hide unused class variable Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 202/223] usb: wusbcore: fix unbalanced get/put cluster_id Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 203/223] usb: pci-quirks: Correct AMD PLL quirk detection Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 204/223] x86/sysfb_efi: Add quirks for some devices with swapped width and height Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 205/223] x86/speculation/mds: Apply more accurate check on hypervisor platform Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 206/223] hpet: Fix division by zero in hpet_time_div() Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 207/223] ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 208/223] ALSA: hda - Add a conexant codec entry to let mute led work Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 209/223] powerpc/tm: Fix oops on sigreturn on systems without TM Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 210/223] access: avoid the RCU grace period for the temporary subjective credentials Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 211/223] ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt Greg Kroah-Hartman
2019-08-02 9:37 ` Greg Kroah-Hartman [this message]
2019-08-02 9:37 ` [PATCH 4.9 213/223] arm64: dts: marvell: Fix A37xx UART0 register size Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 214/223] i2c: qup: fixed releasing dma without flush operation completion Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 215/223] arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 216/223] ISDN: hfcsusb: checking idx of ep configuration Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 217/223] media: au0828: fix null dereference in error path Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 218/223] media: cpia2_usb: first wake up, then free in disconnect Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 219/223] media: radio-raremono: change devm_k*alloc to k*alloc Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 220/223] Bluetooth: hci_uart: check for missing tty operations Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 221/223] sched/fair: Dont free p->numa_faults with concurrent readers Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 222/223] drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl Greg Kroah-Hartman
2019-08-02 9:37 ` [PATCH 4.9 223/223] ceph: hold i_ceph_lock when removing caps for freeing inode Greg Kroah-Hartman
2019-08-02 14:19 ` [PATCH 4.9 000/223] 4.9.187-stable review Thierry Reding
2019-08-02 16:34 ` kernelci.org bot
2019-08-02 18:46 ` Naresh Kamboju
2019-08-02 23:19 ` shuah
2019-08-03 15:58 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190802092250.566118754@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maowenan@huawei.com \
--cc=nefelim4ag@gmail.com \
--cc=sashal@kernel.org \
--cc=soheil@google.com \
--cc=stable@vger.kernel.org \
--cc=yongjianchn@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).