linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Qiujun Huang <hqjagain@gmail.com>,
	Kalle Valo <kvalo@codeaurora.org>,
	syzbot+40d5d2e8a4680952f042@syzkaller.appspotmail.com
Subject: [PATCH 5.6 141/161] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
Date: Tue, 16 Jun 2020 17:35:31 +0200	[thread overview]
Message-ID: <20200616153113.076449069@linuxfoundation.org> (raw)
In-Reply-To: <20200616153106.402291280@linuxfoundation.org>

From: Qiujun Huang <hqjagain@gmail.com>

commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.

In ath9k_hif_usb_rx_cb interface number is assumed to be 0.
usb_ifnum_to_if(urb->dev, 0)
But it isn't always true.

The case reported by syzbot:
https://lore.kernel.org/linux-usb/000000000000666c9c05a1c05d12@google.com
usb 2-1: new high-speed USB device number 2 using dummy_hcd
usb 2-1: config 1 has an invalid interface number: 2 but max is 0
usb 2-1: config 1 has no interface number 0
usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice=
1.08
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
general protection fault, probably for non-canonical address
0xdffffc0000000015: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0

Call Trace
__usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786
__do_softirq+0x21e/0x950 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x178/0x1a0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829

Reported-and-tested-by: syzbot+40d5d2e8a4680952f042@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200404041838.10426-6-hqjagain@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/hif_usb.c |   48 +++++++++++++++++++++++--------
 drivers/net/wireless/ath/ath9k/hif_usb.h |    5 +++
 2 files changed, 42 insertions(+), 11 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -643,9 +643,9 @@ err:
 
 static void ath9k_hif_usb_rx_cb(struct urb *urb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
-	struct hif_device_usb *hif_dev =
-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+	struct sk_buff *skb = rx_buf->skb;
 	int ret;
 
 	if (!skb)
@@ -685,14 +685,15 @@ resubmit:
 	return;
 free:
 	kfree_skb(skb);
+	kfree(rx_buf);
 }
 
 static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
+	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+	struct sk_buff *skb = rx_buf->skb;
 	struct sk_buff *nskb;
-	struct hif_device_usb *hif_dev =
-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
 	int ret;
 
 	if (!skb)
@@ -750,6 +751,7 @@ resubmit:
 	return;
 free:
 	kfree_skb(skb);
+	kfree(rx_buf);
 	urb->context = NULL;
 }
 
@@ -795,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(s
 	init_usb_anchor(&hif_dev->mgmt_submitted);
 
 	for (i = 0; i < MAX_TX_URB_NUM; i++) {
-		tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
+		tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
 		if (!tx_buf)
 			goto err;
 
@@ -832,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urb
 
 static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 {
-	struct urb *urb = NULL;
+	struct rx_buf *rx_buf = NULL;
 	struct sk_buff *skb = NULL;
+	struct urb *urb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->rx_submitted);
@@ -841,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(s
 
 	for (i = 0; i < MAX_RX_URB_NUM; i++) {
 
+		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+		if (!rx_buf) {
+			ret = -ENOMEM;
+			goto err_rxb;
+		}
+
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -855,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(s
 			goto err_skb;
 		}
 
+		rx_buf->hif_dev = hif_dev;
+		rx_buf->skb = skb;
+
 		usb_fill_bulk_urb(urb, hif_dev->udev,
 				  usb_rcvbulkpipe(hif_dev->udev,
 						  USB_WLAN_RX_PIPE),
 				  skb->data, MAX_RX_BUF_SIZE,
-				  ath9k_hif_usb_rx_cb, skb);
+				  ath9k_hif_usb_rx_cb, rx_buf);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->rx_submitted);
@@ -885,6 +897,8 @@ err_submit:
 err_skb:
 	usb_free_urb(urb);
 err_urb:
+	kfree(rx_buf);
+err_rxb:
 	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
 	return ret;
 }
@@ -896,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in
 
 static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 {
-	struct urb *urb = NULL;
+	struct rx_buf *rx_buf = NULL;
 	struct sk_buff *skb = NULL;
+	struct urb *urb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->reg_in_submitted);
 
 	for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
 
+		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+		if (!rx_buf) {
+			ret = -ENOMEM;
+			goto err_rxb;
+		}
+
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -918,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_ur
 			goto err_skb;
 		}
 
+		rx_buf->hif_dev = hif_dev;
+		rx_buf->skb = skb;
+
 		usb_fill_int_urb(urb, hif_dev->udev,
 				  usb_rcvintpipe(hif_dev->udev,
 						  USB_REG_IN_PIPE),
 				  skb->data, MAX_REG_IN_BUF_SIZE,
-				  ath9k_hif_usb_reg_in_cb, skb, 1);
+				  ath9k_hif_usb_reg_in_cb, rx_buf, 1);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
@@ -948,6 +972,8 @@ err_submit:
 err_skb:
 	usb_free_urb(urb);
 err_urb:
+	kfree(rx_buf);
+err_rxb:
 	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
 	return ret;
 }
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -86,6 +86,11 @@ struct tx_buf {
 	struct list_head list;
 };
 
+struct rx_buf {
+	struct sk_buff *skb;
+	struct hif_device_usb *hif_dev;
+};
+
 #define HIF_USB_TX_STOP  BIT(0)
 #define HIF_USB_TX_FLUSH BIT(1)
 



  parent reply	other threads:[~2020-06-16 15:54 UTC|newest]

Thread overview: 164+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-16 15:33 [PATCH 5.6 000/161] 5.6.19-rc1 review Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 001/161] ipv6: fix IPV6_ADDRFORM operation logic Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 002/161] mlxsw: core: Use different get_trend() callbacks for different thermal zones Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 003/161] net_failover: fixed rollback in net_failover_open() Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 004/161] tun: correct header offsets in napi frags mode Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 005/161] bridge: Avoid infinite loop when suppressing NS messages with invalid options Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 006/161] vxlan: " Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 007/161] net: ena: xdp: XDP_TX: fix memory leak Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 008/161] net: ena: xdp: update napi budget for DROP and ABORTED Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 009/161] genetlink: fix memory leaks in genl_family_rcv_msg_dumpit() Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 010/161] net: dsa: qca8k: Fix "Unexpected gfp" kernel exception Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 011/161] tipc: fix NULL pointer dereference in streaming Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 012/161] bpf: Support llvm-objcopy for vmlinux BTF Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 013/161] elfnote: mark all .note sections SHF_ALLOC Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 014/161] Input: mms114 - fix handling of mms345l Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 015/161] Input: axp20x-pek - always register interrupt handlers Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 016/161] ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 017/161] sched/fair: Dont NUMA balance for kthreads Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 018/161] Input: synaptics - add a second working PNP_ID for Lenovo T470s Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 019/161] csky: Fixup abiv2 syscall_trace break a4 & a5 Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 020/161] gfs2: Even more gfs2_find_jhead fixes Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 021/161] drivers/net/ibmvnic: Update VNIC protocol version reporting Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 022/161] staging: wfx: fix double free Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 023/161] staging: mt7621-pci: properly power off dual-ported pcie phy Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 024/161] perf probe: Accept the instance number of kretprobe event Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 025/161] mm: add kvfree_sensitive() for freeing sensitive data objects Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 026/161] selftests: fix flower parent qdisc Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 027/161] fanotify: fix ignore mask logic for events on child and on dir Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 028/161] driver core: Update device link status correctly for SYNC_STATE_ONLY links Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 029/161] powerpc/xive: Clear the page tables for the ESB IO mapping Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 030/161] ASoC: SOF: imx8: Fix randbuild error Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 031/161] ASoC: SOF: imx: fix undefined reference issue Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 032/161] spi: dw: Fix native CS being unset Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 033/161] ath9k_htc: Silence undersized packet warnings Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 034/161] smack: avoid unused sip variable warning Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 035/161] RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 036/161] padata: add separate cpuhp node for CPUHP_PADATA_DEAD Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 037/161] s390/pci: Log new handle in clp_disable_fh() Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 038/161] x86/cpu/amd: Make erratum #1054 a legacy erratum Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 039/161] KVM: x86: only do L1TF workaround on affected processors Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 040/161] PCI/PM: Adjust pcie_wait_for_link_delay() for caller delay Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 041/161] kobject: Make sure the parent does not get released before its children Greg Kroah-Hartman
2020-06-16 17:05   ` Rafael J. Wysocki
2020-06-16 17:11     ` Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 042/161] scsi: target: remove boilerplate code Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 043/161] scsi: target: fix hang when multiple threads try to destroy the same iscsi session Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 044/161] drm/amd/display: remove invalid dc_is_hw_initialized function Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 045/161] drm/amd/display: Not doing optimize bandwidth if flip pending Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 046/161] aio: fix async fsync creds Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 047/161] usercopy: mark dma-kmalloc caches as usercopy caches Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 048/161] x86_64: Fix jiffies ODR violation Greg Kroah-Hartman
2020-06-16 15:33 ` [PATCH 5.6 049/161] x86: mm: ptdump: calculate effective permissions correctly Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 050/161] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 051/161] x86/speculation: Prevent rogue cross-process SSBD shutdown Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 052/161] x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 053/161] x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 054/161] x86/reboot/quirks: Add MacBook6,1 reboot quirk Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 055/161] perf/x86/intel: Add more available bits for OFFCORE_RESPONSE of Intel Tremont Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 056/161] KVM: x86: allow KVM_STATE_NESTED_MTF_PENDING in kvm_state flags Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 057/161] KVM: x86/mmu: Set mmio_value to 0 if reserved #PF cant be generated Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 058/161] KVM: x86: respect singlestep when emulating instruction Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 059/161] KVM: x86: Fix APIC page invalidation race Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 060/161] powerpc/ptdump: Properly handle non standard page size Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 061/161] ASoC: max9867: fix volume controls Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 062/161] io_uring: use kvfree() in io_sqe_buffer_register() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 063/161] efi/efivars: Add missing kobject_put() in sysfs entry creation error path Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 064/161] smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 065/161] smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 066/161] smb3: fix typo in mount options displayed in /proc/mounts Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 067/161] watchdog: imx_sc_wdt: Fix reboot on crash Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 068/161] ALSA: es1688: Add the missed snd_card_free() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 069/161] ALSA: hda: add sienna_cichlid audio asic id for sienna_cichlid up Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 070/161] ALSA: fireface: fix configuration error for nominal sampling transfer frequency Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 071/161] ALSA: fireface: start IR context immediately Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 072/161] ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 073/161] ALSA: pcm: disallow linking stream to itself Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 074/161] ALSA: pcm: fix snd_pcm_link() lockdep splat Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 075/161] ALSA: usb-audio: Fix inconsistent card PM state after resume Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 076/161] ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 077/161] ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 078/161] ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 079/161] ACPI: GED: add support for _Exx / _Lxx handler methods Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 080/161] ACPI: PM: Avoid using power resources if there are none for D0 Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 081/161] arm64: acpi: fix UBSAN warning Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 082/161] lib/lzo: fix ambiguous encoding bug in lzo-rle Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 083/161] nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 084/161] lib: fix bitmap_parse() on 64-bit big endian archs Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 085/161] spi: dw: Fix controller unregister order Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 086/161] spi: " Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 087/161] spi: pxa2xx: " Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 088/161] spi: pxa2xx: Fix runtime PM ref imbalance on probe error Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 089/161] spi: bcm2835: Fix controller unregister order Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 090/161] spi: bcm2835aux: " Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 091/161] spi: bcm-qspi: Handle clock probe deferral Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 092/161] spi: bcm-qspi: when tx/rx buffer is NULL set to 0 Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 093/161] PM: runtime: clk: Fix clk_pm_runtime_get() error path Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 094/161] gup: document and work around "COW can break either way" issue Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 095/161] crypto: cavium/nitrox - Fix nitrox_get_first_device() when ndevlist is fully iterated Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 096/161] crypto: algapi - Avoid spurious modprobe on LOADED Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 097/161] crypto: drbg - fix error return code in drbg_alloc_state() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 098/161] crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 099/161] crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 100/161] crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 101/161] io_uring: fix mismatched finish_wait() calls in io_uring_cancel_files() Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 102/161] io_uring: fix flush req->refs underflow Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 103/161] x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 104/161] firmware: imx-scu: Support one TX and one RX Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 105/161] firmware: imx: scu: Fix corruption of header Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 106/161] dccp: Fix possible memleak in dccp_init and dccp_fini Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 107/161] net: mvneta: do not redirect frames during reconfiguration Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 108/161] selftests/net: in rxtimestamp getopt_long needs terminating null entry Greg Kroah-Hartman
2020-06-16 15:34 ` [PATCH 5.6 109/161] net/mlx5: drain health workqueue in case of driver load error Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 110/161] net/mlx5: Fix fatal error handling during device load Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 111/161] net/mlx5e: Fix repeated XSK usage on one channel Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 112/161] net: cadence: macb: disable NAPI on error Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 113/161] net: macb: Only disable NAPI on the actual error path Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 114/161] net/mlx5: Disable reload while removing the device Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 115/161] ovl: fix out of bounds access warning in ovl_check_fb_len() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 116/161] ovl: initialize error in ovl_copy_xattr Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 117/161] proc: Use new_inode not new_inode_pseudo Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 118/161] remoteproc: Fall back to using parent memory pool if no dedicated available Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 119/161] remoteproc: Fix and restore the parenting hierarchy for vdev Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 120/161] cpufreq: Fix up cpufreq_boost_set_sw() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 121/161] EDAC/skx: Use the mcmtr register to retrieve close_pg/bank_xor_enable Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 122/161] video: vt8500lcdfb: fix fallthrough warning Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 123/161] video: fbdev: w100fb: Fix a potential double free Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 124/161] media: videobuf2-dma-contig: fix bad kfree in vb2_dma_contig_clear_max_seg_size Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 125/161] KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 126/161] KVM: nSVM: fix condition for filtering async PF Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 127/161] KVM: nSVM: leave ASID aside in copy_vmcb_control_area Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 128/161] KVM: nVMX: Consult only the "basic" exit reason when routing nested exit Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 129/161] KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data) Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 130/161] KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 131/161] KVM: arm64: Stop writing aarch32s CSSELR into ACTLR Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 132/161] KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 133/161] scsi: megaraid_sas: TM command refire leads to controller firmware crash Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 134/161] scsi: lpfc: Fix negation of else clause in lpfc_prep_node_fc4type Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 135/161] scsi: megaraid_sas: Replace undefined MFI_BIG_ENDIAN macro with __BIG_ENDIAN_BITFIELD macro Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 136/161] selftests/ftrace: Return unsupported if no error_log file Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 137/161] ath9k: Fix use-after-free Read in htc_connect_service Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 138/161] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 139/161] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 140/161] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Greg Kroah-Hartman
2020-06-16 15:35 ` Greg Kroah-Hartman [this message]
2020-06-16 15:35 ` [PATCH 5.6 142/161] Smack: slab-out-of-bounds in vsscanf Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 143/161] drm/vkms: Hold gem object while still in-use Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 144/161] mm/slub: fix a memory leak in sysfs_slab_add() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 145/161] fat: dont allow to mount if the FAT length == 0 Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 146/161] perf: Add cond_resched() to task_function_call() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 147/161] agp/intel: Reinforce the barrier after GTT updates Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 148/161] mmc: sdhci-msm: Clear tuning done flag while hs400 tuning Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 149/161] mmc: sdhci-of-at91: fix CALCR register being rewritten Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 150/161] mmc: mmci_sdmmc: fix DMA API warning overlapping mappings Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 151/161] mmc: tmio: Further fixup runtime PM management at remove Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 152/161] mmc: uniphier-sd: call devm_request_irq() after tmio_mmc_host_probe() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 153/161] ARM: dts: at91: sama5d2_ptc_ek: fix sdmmc0 node description Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 154/161] mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 155/161] mmc: sdio: Fix several potential memory leaks " Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 156/161] block/floppy: fix contended case in floppy_queue_rq() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 157/161] xen/pvcalls-back: test for errors when calling backend_connect() Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 158/161] platform/x86: sony-laptop: SNC calls should handle BUFFER types Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 159/161] platform/x86: sony-laptop: Make resuming thermal profile safer Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 160/161] KVM: arm64: Synchronize sysreg state on injecting an AArch32 exception Greg Kroah-Hartman
2020-06-16 15:35 ` [PATCH 5.6 161/161] KVM: arm64: Save the hosts PtrAuth keys in non-preemptible context Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200616153113.076449069@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=hqjagain@gmail.com \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+40d5d2e8a4680952f042@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).