linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Hulk Robot <hulkci@huawei.com>,
	Jason Wang <jasowang@redhat.com>,
	Yang Yingliang <yangyingliang@huawei.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 5.2 16/85] tun: fix use-after-free when register netdev failed
Date: Wed, 18 Sep 2019 08:18:34 +0200	[thread overview]
Message-ID: <20190918061234.666934150@linuxfoundation.org> (raw)
In-Reply-To: <20190918061234.107708857@linuxfoundation.org>

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 77f22f92dff8e7b45c7786a430626d38071d4670 ]

I got a UAF repport in tun driver when doing fuzzy test:

[  466.269490] ==================================================================
[  466.271792] BUG: KASAN: use-after-free in tun_chr_read_iter+0x2ca/0x2d0
[  466.271806] Read of size 8 at addr ffff888372139250 by task tun-test/2699
[  466.271810]
[  466.271824] CPU: 1 PID: 2699 Comm: tun-test Not tainted 5.3.0-rc1-00001-g5a9433db2614-dirty #427
[  466.271833] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[  466.271838] Call Trace:
[  466.271858]  dump_stack+0xca/0x13e
[  466.271871]  ? tun_chr_read_iter+0x2ca/0x2d0
[  466.271890]  print_address_description+0x79/0x440
[  466.271906]  ? vprintk_func+0x5e/0xf0
[  466.271920]  ? tun_chr_read_iter+0x2ca/0x2d0
[  466.271935]  __kasan_report+0x15c/0x1df
[  466.271958]  ? tun_chr_read_iter+0x2ca/0x2d0
[  466.271976]  kasan_report+0xe/0x20
[  466.271987]  tun_chr_read_iter+0x2ca/0x2d0
[  466.272013]  do_iter_readv_writev+0x4b7/0x740
[  466.272032]  ? default_llseek+0x2d0/0x2d0
[  466.272072]  do_iter_read+0x1c5/0x5e0
[  466.272110]  vfs_readv+0x108/0x180
[  466.299007]  ? compat_rw_copy_check_uvector+0x440/0x440
[  466.299020]  ? fsnotify+0x888/0xd50
[  466.299040]  ? __fsnotify_parent+0xd0/0x350
[  466.299064]  ? fsnotify_first_mark+0x1e0/0x1e0
[  466.304548]  ? vfs_write+0x264/0x510
[  466.304569]  ? ksys_write+0x101/0x210
[  466.304591]  ? do_preadv+0x116/0x1a0
[  466.304609]  do_preadv+0x116/0x1a0
[  466.309829]  do_syscall_64+0xc8/0x600
[  466.309849]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  466.309861] RIP: 0033:0x4560f9
[  466.309875] Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[  466.309889] RSP: 002b:00007ffffa5166e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000127
[  466.322992] RAX: ffffffffffffffda RBX: 0000000000400460 RCX: 00000000004560f9
[  466.322999] RDX: 0000000000000003 RSI: 00000000200008c0 RDI: 0000000000000003
[  466.323007] RBP: 00007ffffa516700 R08: 0000000000000004 R09: 0000000000000000
[  466.323014] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000040cb10
[  466.323021] R13: 0000000000000000 R14: 00000000006d7018 R15: 0000000000000000
[  466.323057]
[  466.323064] Allocated by task 2605:
[  466.335165]  save_stack+0x19/0x80
[  466.336240]  __kasan_kmalloc.constprop.8+0xa0/0xd0
[  466.337755]  kmem_cache_alloc+0xe8/0x320
[  466.339050]  getname_flags+0xca/0x560
[  466.340229]  user_path_at_empty+0x2c/0x50
[  466.341508]  vfs_statx+0xe6/0x190
[  466.342619]  __do_sys_newstat+0x81/0x100
[  466.343908]  do_syscall_64+0xc8/0x600
[  466.345303]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  466.347034]
[  466.347517] Freed by task 2605:
[  466.348471]  save_stack+0x19/0x80
[  466.349476]  __kasan_slab_free+0x12e/0x180
[  466.350726]  kmem_cache_free+0xc8/0x430
[  466.351874]  putname+0xe2/0x120
[  466.352921]  filename_lookup+0x257/0x3e0
[  466.354319]  vfs_statx+0xe6/0x190
[  466.355498]  __do_sys_newstat+0x81/0x100
[  466.356889]  do_syscall_64+0xc8/0x600
[  466.358037]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  466.359567]
[  466.360050] The buggy address belongs to the object at ffff888372139100
[  466.360050]  which belongs to the cache names_cache of size 4096
[  466.363735] The buggy address is located 336 bytes inside of
[  466.363735]  4096-byte region [ffff888372139100, ffff88837213a100)
[  466.367179] The buggy address belongs to the page:
[  466.368604] page:ffffea000dc84e00 refcount:1 mapcount:0 mapping:ffff8883df1b4f00 index:0x0 compound_mapcount: 0
[  466.371582] flags: 0x2fffff80010200(slab|head)
[  466.372910] raw: 002fffff80010200 dead000000000100 dead000000000122 ffff8883df1b4f00
[  466.375209] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[  466.377778] page dumped because: kasan: bad access detected
[  466.379730]
[  466.380288] Memory state around the buggy address:
[  466.381844]  ffff888372139100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  466.384009]  ffff888372139180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  466.386131] >ffff888372139200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  466.388257]                                                  ^
[  466.390234]  ffff888372139280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  466.392512]  ffff888372139300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  466.394667] ==================================================================

tun_chr_read_iter() accessed the memory which freed by free_netdev()
called by tun_set_iff():

        CPUA                                           CPUB
  tun_set_iff()
    alloc_netdev_mqs()
    tun_attach()
                                                  tun_chr_read_iter()
                                                    tun_get()
                                                    tun_do_read()
                                                      tun_ring_recv()
    register_netdevice() <-- inject error
    goto err_detach
    tun_detach_all() <-- set RCV_SHUTDOWN
    free_netdev() <-- called from
                     err_free_dev path
      netdev_freemem() <-- free the memory
                        without check refcount
      (In this path, the refcount cannot prevent
       freeing the memory of dev, and the memory
       will be used by dev_put() called by
       tun_chr_read_iter() on CPUB.)
                                                     (Break from tun_ring_recv(),
                                                     because RCV_SHUTDOWN is set)
                                                   tun_put()
                                                     dev_put() <-- use the memory
                                                                   freed by netdev_freemem()

Put the publishing of tfile->tun after register_netdevice(),
so tun_get() won't get the tun pointer that freed by
err_detach path if register_netdevice() failed.

Fixes: eb0fb363f920 ("tuntap: attach queue 0 before registering netdevice")
Reported-by: Hulk Robot <hulkci@huawei.com>
Suggested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -788,7 +788,8 @@ static void tun_detach_all(struct net_de
 }
 
 static int tun_attach(struct tun_struct *tun, struct file *file,
-		      bool skip_filter, bool napi, bool napi_frags)
+		      bool skip_filter, bool napi, bool napi_frags,
+		      bool publish_tun)
 {
 	struct tun_file *tfile = file->private_data;
 	struct net_device *dev = tun->dev;
@@ -871,7 +872,8 @@ static int tun_attach(struct tun_struct
 	 * initialized tfile; otherwise we risk using half-initialized
 	 * object.
 	 */
-	rcu_assign_pointer(tfile->tun, tun);
+	if (publish_tun)
+		rcu_assign_pointer(tfile->tun, tun);
 	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
 	tun->numqueues++;
 	tun_set_real_num_queues(tun);
@@ -2731,7 +2733,7 @@ static int tun_set_iff(struct net *net,
 
 		err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER,
 				 ifr->ifr_flags & IFF_NAPI,
-				 ifr->ifr_flags & IFF_NAPI_FRAGS);
+				 ifr->ifr_flags & IFF_NAPI_FRAGS, true);
 		if (err < 0)
 			return err;
 
@@ -2830,13 +2832,17 @@ static int tun_set_iff(struct net *net,
 
 		INIT_LIST_HEAD(&tun->disabled);
 		err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
-				 ifr->ifr_flags & IFF_NAPI_FRAGS);
+				 ifr->ifr_flags & IFF_NAPI_FRAGS, false);
 		if (err < 0)
 			goto err_free_flow;
 
 		err = register_netdevice(tun->dev);
 		if (err < 0)
 			goto err_detach;
+		/* free_netdev() won't check refcnt, to aovid race
+		 * with dev_put() we need publish tun after registration.
+		 */
+		rcu_assign_pointer(tfile->tun, tun);
 	}
 
 	netif_carrier_on(tun->dev);
@@ -2979,7 +2985,7 @@ static int tun_set_queue(struct file *fi
 		if (ret < 0)
 			goto unlock;
 		ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI,
-				 tun->flags & IFF_NAPI_FRAGS);
+				 tun->flags & IFF_NAPI_FRAGS, true);
 	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
 		tun = rtnl_dereference(tfile->tun);
 		if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)



  parent reply	other threads:[~2019-09-18  6:24 UTC|newest]

Thread overview: 94+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-18  6:18 [PATCH 5.2 00/85] 5.2.16-stable review Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 01/85] bridge/mdb: remove wrong use of NLM_F_MULTI Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 02/85] cdc_ether: fix rndis support for Mediatek based smartphones Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 03/85] ipv6: Fix the link time qualifier of ping_v6_proc_exit_net() Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 04/85] isdn/capi: check message length in capi_write() Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 05/85] ixgbe: Fix secpath usage for IPsec TX offload Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 06/85] ixgbevf: Fix secpath usage for IPsec Tx offload Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 07/85] net: Fix null de-reference of device refcount Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 08/85] net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 09/85] net: phylink: Fix flow control resolution Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 10/85] net: sched: fix reordering issues Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 11/85] sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 12/85] sctp: Fix the link time qualifier of sctp_ctrlsock_exit() Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 13/85] sctp: use transport pf_retrans in sctp_do_8_2_transport_strike Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 14/85] tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 15/85] tipc: add NULL pointer check before calling kfree_rcu Greg Kroah-Hartman
2019-09-18  6:18 ` Greg Kroah-Hartman [this message]
2019-09-18  6:18 ` [PATCH 5.2 17/85] net-ipv6: fix excessive RTF_ADDRCONF flag on ::1/128 local route (and others) Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 18/85] ipv6: addrconf_f6i_alloc - fix non-null pointer check to !IS_ERR() Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 19/85] net: fixed_phy: Add forward declaration for struct gpio_desc; Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 20/85] sctp: fix the missing put_user when dumping transport thresholds Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 21/85] net: sock_map, fix missing ulp check in sock hash case Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 22/85] gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 23/85] gpio: mockup: add missing single_release() Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 24/85] gpio: fix line flag validation in linehandle_create Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 25/85] gpio: fix line flag validation in lineevent_create Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 26/85] Btrfs: fix assertion failure during fsync and use of stale transaction Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 27/85] cgroup: freezer: fix frozen state inheritance Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 28/85] Revert "mmc: bcm2835: Terminate timeout work synchronously" Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 29/85] Revert "mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller" Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 30/85] mmc: tmio: Fixup runtime PM management during probe Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 31/85] mmc: tmio: Fixup runtime PM management during remove Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 32/85] drm/lima: fix lima_gem_wait() return value Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 33/85] drm/i915: Limit MST to <= 8bpc once again Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 34/85] drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+ Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 35/85] ipc: fix semtimedop for generic 32-bit architectures Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 36/85] ipc: fix sparc64 ipc() wrapper Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 37/85] ixgbe: fix double clean of Tx descriptors with xdp Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 38/85] ixgbe: Prevent u8 wrapping of ITR value to something less than 10us Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 39/85] Revert "rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band" Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 40/85] mt76: mt76x0e: disable 5GHz band for MT7630E Greg Kroah-Hartman
2019-09-18  6:18 ` [PATCH 5.2 41/85] genirq: Prevent NULL pointer dereference in resend_irqs() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 42/85] regulator: twl: voltage lists for vdd1/2 on twl4030 Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 43/85] KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 44/85] KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 45/85] KVM: x86: work around leak of uninitialized stack contents Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 46/85] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 47/85] KVM: nVMX: handle page fault in vmread Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 48/85] x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 49/85] powerpc: Add barrier_nospec to raw_copy_in_user() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 50/85] kernel/module: Fix mem leak in module_add_modinfo_attrs Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 51/85] x86/boot: Use efi_setup_data for searching RSDP on kexec-ed kernels Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 52/85] x86/ima: check EFI SetupMode too Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 53/85] drm/meson: Add support for XBGR8888 & ABGR8888 formats Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 54/85] clk: Fix debugfs clk_possible_parents for clks without parent string names Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 55/85] clk: Simplify debugfs printing and add a newline Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 56/85] mt76: Fix a signedness bug in mt7615_add_interface() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 57/85] mt76: mt7615: Use after free in mt7615_mcu_set_bcn() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 58/85] clk: rockchip: Dont yell about bad mmc phases when getting Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 59/85] mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 60/85] PCI: Always allow probing with driver_override Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 61/85] ubifs: Correctly use tnc_next() in search_dh_cookie() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 62/85] driver core: Fix use-after-free and double free on glue directory Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 63/85] crypto: talitos - check AES key size Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 64/85] crypto: talitos - fix CTR alg blocksize Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 65/85] crypto: talitos - check data blocksize in ablkcipher Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 66/85] crypto: talitos - fix ECB algs ivsize Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 67/85] crypto: talitos - Do not modify req->cryptlen on decryption Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 68/85] crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 69/85] firmware: ti_sci: Always request response from firmware Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 70/85] drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 71/85] drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 72/85] mm/z3fold.c: remove z3fold_migration trylock Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 73/85] mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 74/85] Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 75/85] iio: adc: stm32-dfsdm: fix output resolution Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 76/85] iio: adc: stm32-dfsdm: fix data type Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 77/85] modules: fix BUG when load module with rodata=n Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 78/85] modules: fix compile error if dont have strict module rwx Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 79/85] modules: always page-align module section allocations Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 80/85] kvm: nVMX: Remove unnecessary sync_roots from handle_invept Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 81/85] KVM: SVM: Fix detection of AMD Errata 1096 Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 82/85] platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 83/85] platform/x86: pcengines-apuv2: use KEY_RESTART for front button Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 84/85] rsi: fix a double free bug in rsi_91x_deinit() Greg Kroah-Hartman
2019-09-18  6:19 ` [PATCH 5.2 85/85] x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning Greg Kroah-Hartman
2019-09-18 11:59 ` [PATCH 5.2 00/85] 5.2.16-stable review kernelci.org bot
2019-09-18 15:17 ` Naresh Kamboju
2019-09-19  6:37   ` Greg Kroah-Hartman
2019-09-18 16:28 ` Jon Hunter
2019-09-19  6:37   ` Greg Kroah-Hartman
2019-09-18 19:38 ` Guenter Roeck
2019-09-19  1:22 ` shuah
2019-09-19  6:36   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190918061234.666934150@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=hulkci@huawei.com \
    --cc=jasowang@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=yangyingliang@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).