linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Takashi Iwai" <tiwai@suse.de>,
	"Dmitry Vyukov" <dvyukov@google.com>
Subject: [PATCH 3.16 258/346] ALSA: rawmidi: Fix possible deadlock with virmidi registration
Date: Mon, 14 Nov 2016 00:14:20 +0000	[thread overview]
Message-ID: <lsq.1479082460.336278615@decadent.org.uk> (raw)
In-Reply-To: <lsq.1479082458.755945576@decadent.org.uk>

3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 816f318b2364262a51024096da7ca3b84e78e3b5 upstream.

When a seq-virmidi driver is initialized, it registers a rawmidi
instance with its callback to create an associated seq kernel client.
Currently it's done throughly in rawmidi's register_mutex context.
Recently it was found that this may lead to a deadlock another rawmidi
device that is being attached with the sequencer is accessed, as both
open with the same register_mutex.  This was actually triggered by
syzkaller, as Dmitry Vyukov reported:

======================================================
 [ INFO: possible circular locking dependency detected ]
 4.8.0-rc1+ #11 Not tainted
 -------------------------------------------------------
 syz-executor/7154 is trying to acquire lock:
  (register_mutex#5){+.+.+.}, at: [<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341

 but task is already holding lock:
  (&grp->list_mutex){++++.+}, at: [<ffffffff850138bb>] check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&grp->list_mutex){++++.+}:
    [<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [<ffffffff863f6199>] down_read+0x49/0xc0 kernel/locking/rwsem.c:22
    [<     inline     >] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:681
    [<ffffffff85005c5e>] snd_seq_deliver_event+0x35e/0x890 sound/core/seq/seq_clientmgr.c:822
    [<ffffffff85006e96>] > snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2418
    [<ffffffff85012c52>] snd_seq_system_broadcast+0xb2/0xf0 sound/core/seq/seq_system.c:101
    [<ffffffff84fff70a>] snd_seq_create_kernel_client+0x24a/0x330 sound/core/seq/seq_clientmgr.c:2297
    [<     inline     >] snd_virmidi_dev_attach_seq sound/core/seq/seq_virmidi.c:383
    [<ffffffff8502d29f>] snd_virmidi_dev_register+0x29f/0x750 sound/core/seq/seq_virmidi.c:450
    [<ffffffff84fd208c>] snd_rawmidi_dev_register+0x30c/0xd40 sound/core/rawmidi.c:1645
    [<ffffffff84f816d3>] __snd_device_register.part.0+0x63/0xc0 sound/core/device.c:164
    [<     inline     >] __snd_device_register sound/core/device.c:162
    [<ffffffff84f8235d>] snd_device_register_all+0xad/0x110 sound/core/device.c:212
    [<ffffffff84f7546f>] snd_card_register+0xef/0x6c0 sound/core/init.c:749
    [<ffffffff85040b7f>] snd_virmidi_probe+0x3ef/0x590 sound/drivers/virmidi.c:123
    [<ffffffff833ebf7b>] platform_drv_probe+0x8b/0x170 drivers/base/platform.c:564
    ......

 -> #0 (register_mutex#5){+.+.+.}:
    [<     inline     >] check_prev_add kernel/locking/lockdep.c:1829
    [<     inline     >] check_prevs_add kernel/locking/lockdep.c:1939
    [<     inline     >] validate_chain kernel/locking/lockdep.c:2266
    [<ffffffff814791f4>] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335
    [<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [<     inline     >] __mutex_lock_common kernel/locking/mutex.c:521
    [<ffffffff863f0ef1>] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621
    [<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341
    [<ffffffff8502e7c7>] midisynth_subscribe+0xf7/0x350 sound/core/seq/seq_midi.c:188
    [<     inline     >] subscribe_port sound/core/seq/seq_ports.c:427
    [<ffffffff85013cc7>] check_and_subscribe_port+0x467/0x5c0 sound/core/seq/seq_ports.c:510
    [<ffffffff85015da9>] snd_seq_port_connect+0x2c9/0x500 sound/core/seq/seq_ports.c:579
    [<ffffffff850079b8>] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 sound/core/seq/seq_clientmgr.c:1480
    [<ffffffff84ffe9e4>] snd_seq_do_ioctl+0x184/0x1e0 sound/core/seq/seq_clientmgr.c:2225
    [<ffffffff84ffeae8>] snd_seq_kernel_client_ctl+0xa8/0x110 sound/core/seq/seq_clientmgr.c:2440
    [<ffffffff85027664>] snd_seq_oss_midi_open+0x3b4/0x610 sound/core/seq/oss/seq_oss_midi.c:375
    [<ffffffff85023d67>] snd_seq_oss_synth_setup_midi+0x107/0x4c0 sound/core/seq/oss/seq_oss_synth.c:281
    [<ffffffff8501b0a8>] snd_seq_oss_open+0x748/0x8d0 sound/core/seq/oss/seq_oss_init.c:274
    [<ffffffff85019d8a>] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138
    [<ffffffff84f7040f>] soundcore_open+0x30f/0x640 sound/sound_core.c:639
    ......

 other info that might help us debug this:

 Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&grp->list_mutex);
                                lock(register_mutex#5);
                                lock(&grp->list_mutex);
   lock(register_mutex#5);

 *** DEADLOCK ***
======================================================

The fix is to simply move the registration parts in
snd_rawmidi_dev_register() to the outside of the register_mutex lock.
The lock is needed only to manage the linked list, and it's not
necessarily to cover the whole initialization process.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 sound/core/rawmidi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1637,12 +1637,14 @@ static int snd_rawmidi_dev_register(stru
 		return -EBUSY;
 	}
 	list_add_tail(&rmidi->list, &snd_rawmidi_devices);
+	mutex_unlock(&register_mutex);
 	sprintf(name, "midiC%iD%i", rmidi->card->number, rmidi->device);
 	if ((err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
 				       rmidi->card, rmidi->device,
 				       &snd_rawmidi_f_ops, rmidi, name)) < 0) {
 		rmidi_err(rmidi, "unable to register rawmidi device %i:%i\n",
 			  rmidi->card->number, rmidi->device);
+		mutex_lock(&register_mutex);
 		list_del(&rmidi->list);
 		mutex_unlock(&register_mutex);
 		return err;
@@ -1650,6 +1652,7 @@ static int snd_rawmidi_dev_register(stru
 	if (rmidi->ops && rmidi->ops->dev_register &&
 	    (err = rmidi->ops->dev_register(rmidi)) < 0) {
 		snd_unregister_device(SNDRV_DEVICE_TYPE_RAWMIDI, rmidi->card, rmidi->device);
+		mutex_lock(&register_mutex);
 		list_del(&rmidi->list);
 		mutex_unlock(&register_mutex);
 		return err;
@@ -1682,7 +1685,6 @@ static int snd_rawmidi_dev_register(stru
 		}
 	}
 #endif /* CONFIG_SND_OSSEMUL */
-	mutex_unlock(&register_mutex);
 	sprintf(name, "midi%d", rmidi->device);
 	entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
 	if (entry) {

  parent reply	other threads:[~2016-11-14  3:25 UTC|newest]

Thread overview: 352+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-11-14  0:14 [PATCH 3.16 000/346] 3.16.39-rc1 review Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 046/346] drm/radeon: add a delay after ATPX dGPU power off Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 130/346] drm/nouveau/fbcon: fix font width not divisible by 8 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 282/346] openrisc: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 102/346] libceph: set 'exists' flag for newly up osd Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 093/346] target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 277/346] metag: copy_from_user() should zero the destination on access_ok() failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 189/346] usb: xhci: Fix panic if disconnect Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 238/346] ipv6: add missing netconf notif when 'all' is updated Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 227/346] drm/msm: use mutex_lock_interruptible for submit ioctl Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 170/346] ARC: Call trace_hardirqs_on() before enabling irqs Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 281/346] mn10300: copy_from_user() should zero on access_ok() failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 121/346] MIPS: c-r4k: Fix protected_writeback_scache_line for EVA Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 216/346] timekeeping: Cap array access in timekeeping_debug Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 326/346] MIPS: Malta: Fix IOCU disable switch read for MIPS64 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 084/346] netfilter: x_tables: speed up jump target validation Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 005/346] s5p-mfc: Add release callback for memory region devs Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 320/346] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 201/346] USB: serial: option: add WeTelecom WM-D200 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 051/346] ppp: defer netns reference release for ppp channel Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 265/346] NFSv4.1: Fix the CREATE_SESSION slot number accounting Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 232/346] ALSA: timer: fix NULL pointer dereference on memory allocation failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 001/346] lib/mpi: mpi_read_raw_data(): fix nbits calculation Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 175/346] MIPS: KVM: Fix mapped fault broken commpage handling Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 134/346] tcp: consider recv buf for the initial window scale Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 318/346] tcp: fix a compile error in DBGUNDO() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 259/346] xfrm_user: propagate sec ctx allocation errors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 296/346] fix minor infoleak in get_user_ex() Ben Hutchings
     [not found]   ` <CA+55aFyrySgb5rGq=0aON5tPu5_UR5CNn8T0FUqonMqSJUTXrQ@mail.gmail.com>
2016-11-14  2:27     ` Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 087/346] tpm: read burstcount from TPM_STS in one 32-bit transaction Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 298/346] USB: change bInterval default to 10 ms Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 039/346] batman-adv: Fix non-atomic bla_claim::backbone_gw access Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 028/346] usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 242/346] x86/paravirt: Do not trace _paravirt_ident_*() functions Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 050/346] net: mvneta: set real interrupt per packet for tx_done Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 271/346] nl80211: validate number of probe response CSA counters Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 263/346] asm-generic: make copy_from_user() zero the destination properly Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 324/346] mm,ksm: fix endless looping in allocating memory when ksm enable Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 162/346] netfilter: nfnetlink_queue: reject verdict request from different portid Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 217/346] x86/apic: Do not init irq remapping if ioapic is disabled Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 331/346] KEYS: Fix short sprintf buffer in /proc/keys show function Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 280/346] mn10300: failing __get_user() and get_user() should zero Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 166/346] cpuset: make sure new tasks conform to the current config of the cpuset Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 067/346] s390/mm: fix gmap tlb flush issues Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 192/346] bcache: register_bcache(): call blkdev_put() when cache_alloc() fails Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 226/346] fs/seq_file: fix out-of-bounds read Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 269/346] crypto: arm64/aes-ctr - fix NULL dereference in tail processing Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 021/346] tty/serial: atmel: fix RS485 half duplex with DMA Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 276/346] ia64: copy_from_user() should zero the destination on access_ok() failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 157/346] drm/edid: Add 6 bpc quirk for display AEO model 0 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 014/346] usb: dwc3: fix for the isoc transfer EP_BUSY flag Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 237/346] serial: 8250: added acces i/o products quad and octal serial cards Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 018/346] drm/nouveau: Don't leak runtime pm ref on driver unload Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 198/346] Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 010/346] random: print a warning for the first ten uninitialized random users Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 009/346] gpio: pca953x: Fix NBANK calculation for PCA9536 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 031/346] ext4: check for extents that wrap around Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 107/346] tools/vm/slabinfo: fix an unintentional printf Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 246/346] l2tp: fix use-after-free during module unload Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 002/346] HID: uhid: fix timeout when probe races with IO Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 306/346] xfrm: Fix memory leak of aead algorithm name Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 193/346] bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 036/346] batman-adv: Fix orig_node_vlan leak on orig_node_release Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 045/346] batman-adv: Fix speedy join in gateway client mode Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 106/346] radix-tree: fix radix_tree_iter_retry() for tagged iterators Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 185/346] iio: proximity: as3935: set up buffer timestamps for non-zero values Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 029/346] Input: xpad - validate USB endpoint count during probe Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 178/346] MIPS: KVM: Propagate kseg0/mapped tlb fault errors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 037/346] batman-adv: Fix kerneldoc member names in for main structs Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 230/346] powerpc/powernv : Drop reference added by kset_find_obj() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 190/346] xhci: don't dereference a xhci member after removing xhci Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 319/346] ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit path Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 096/346] cifs: fix crash due to race in hmac(md5) handling Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 004/346] s5p-mfc: Set device name for reserved memory region devs Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 152/346] USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 205/346] iio: accel: kxsd9: Fix raw read return Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 057/346] x86/quirks: Add early quirk to reset Apple AirPort card Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 075/346] ext4: short-cut orphan cleanup on error Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 153/346] USB: serial: ftdi_sio: add device ID for WICED USB UART dev board Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 139/346] balloon: check the number of available pages in leak balloon Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 105/346] nfs: don't create zero-length requests Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 240/346] kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 080/346] xfrm: fix crash in XFRM_MSG_GETSA netlink handler Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 085/346] crypto: nx - off by one bug in nx_of_update_msc() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 327/346] mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() Ben Hutchings
2016-11-14 15:42   ` Johannes Weiner
2016-11-20  1:13     ` Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 135/346] s390: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 161/346] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 047/346] drm/radeon: Poll for both connect/disconnect on analog connectors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 143/346] sysv, ipc: fix security-layer leaking Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 101/346] bpf, mips: fix off-by-one in ctx offset allocation Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 262/346] alpha: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 186/346] iio: adc: at91: unbreak channel adc channel 3 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 070/346] ARM: 8561/3: dma-mapping: Don't use outer_flush_range when the L2C is coherent Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 307/346] can: flexcan: fix resume function Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 025/346] hp-wmi: Fix wifi cannot be hard-unblocked Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 111/346] net/irda: fix NULL pointer dereference on memory allocation failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 065/346] cifs: Check for existing directory when opening file with O_CREAT Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 286/346] score: fix __get_user/get_user Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 177/346] MIPS: KVM: Fix gfn range check in kseg0 tlb faults Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 329/346] arm64: perf: reject groups spanning multiple HW PMUs Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 035/346] batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 059/346] ALSA: hda - fix use-after-free after module unload Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 151/346] USB: serial: option: add D-Link DWM-156/A3 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 125/346] fuse: fuse_flush must check mapping->flags for errors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 117/346] CIFS: Fix a possible invalid memory access in smb2_query_symlink() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 049/346] ALSA: pcm: Free chmap at PCM free callback, too Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 174/346] usb: misc: usbtest: add fix for driver hang Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 171/346] arm: oabi compat: add missing access checks Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 264/346] mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 184/346] cdc-acm: fix wrong pipe type on rx interrupt xfers Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 156/346] vfio/pci: Fix NULL pointer oops in error interrupt setup handling Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 206/346] powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb) Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 017/346] IB/mlx5: Fix MODIFY_QP command input structure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 231/346] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 030/346] ath9k: Fix programming of minCCA power threshold Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 124/346] fuse: fsync() did not return IO errors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 063/346] Bluetooth: Add support of 13d3:3490 AR3012 device Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 023/346] serial: samsung: Fix possible out of bounds access on non-DT platform Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 247/346] iio: fix pressure data output unit in hid-sensor-attributes Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 006/346] netlabel: add address family checks to netlbl_{sock,req}_delattr() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 176/346] MIPS: KVM: Add missing gfn range check Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 328/346] ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 013/346] ARM: mvebu: fix HW I/O coherency related deadlocks Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 158/346] drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown" Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 137/346] ALSA: hda - On-board speaker fixup on ACER Veriton Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 334/346] brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 123/346] avr32: off by one in at32_init_pio() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 196/346] MIPS: KVM: Check for pfn noslot case Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 144/346] ALSA: hda: Fix krealloc() with __GFP_ZERO usage Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 314/346] i2c: mux: pca954x: retry updating the mux selection on failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 245/346] x86/AMD: Apply erratum 665 on machines without a BIOS fix Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 109/346] ARM: OMAP3: hwmod data: Add sysc information for DSI Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 305/346] openrisc: fix the fix of copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 330/346] Bluetooth: Fix potential NULL dereference in RFCOMM bind callback Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 115/346] Input: i8042 - break load dependency between atkbd/psmouse and i8042 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 210/346] Input: tegra-kbc - fix inverted reset logic Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 221/346] ARM: kirkwood: ib62x0: fix size of u-boot environment partition Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 295/346] avr32: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 099/346] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 288/346] sh64: failing __get_user() should zero Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 146/346] metag: Fix __cmpxchg_u32 asm constraint for CMP Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 141/346] dm flakey: error READ bios during the down_interval Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 098/346] iscsi-target: Fix panic when adding second TCP connection to iSCSI session Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 138/346] x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 236/346] ALSA: fireworks: accessing to user space outside spinlock Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 131/346] drm/nouveau/acpi: ensure matching ACPI handle and supported functions Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 260/346] kvm-arm: Unmap shadow pagetables properly Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 094/346] target: Fix race between iscsi-target connection shutdown + ABORT_TASK Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 172/346] megaraid_sas: Fix probing cards without io port Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 224/346] ARM: sa1100: clear reset status prior to reboot Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 256/346] crypto: cryptd - initialize child shash_desc on import Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 308/346] ocfs2/dlm: fix race between convert and migration Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 234/346] dm crypt: fix free of bad values after tfm allocation failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 147/346] block: fix use-after-free in seq file Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 223/346] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 194/346] tcp: fix use after free in tcp_xmit_retransmit_queue() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 008/346] PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 163/346] powerpc/book3s: Fix MCE console messages for unrecoverable MCE Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 097/346] hwmon: (adt7411) set bit 3 in CFG1 register Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 081/346] crypto: scatterwalk - Fix test in scatterwalk_done Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 285/346] s390: get_user() should zero on failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 322/346] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 244/346] IB/ipoib: Fix memory corruption in ipoib cm mode connect flow Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 086/346] i2c: efm32: fix a failure path in efm32_i2c_probe() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 233/346] NFSv4.x: Fix a refcount leak in nfs_callback_up_net Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 150/346] SUNRPC: allow for upcalls for same uid but different gss service Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 268/346] crypto: skcipher - Fix blkcipher walk OOM crash Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 027/346] usb: renesas_usbhs: fix NULL pointer dereference in xfer_work() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 294/346] microblaze: fix __get_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 228/346] drm/msm: fix use of copy_from_user() while holding spinlock Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 164/346] crypto: caam - fix non-hmac hashes Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 133/346] drm/nouveau/acpi: check for function 0x1B before using it Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 058/346] posix_cpu_timer: Exit early when process has been reaped Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 290/346] sparc32: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 218/346] USB: serial: option: add WeTelecom 0x6802 and 0x6803 products Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 160/346] powerpc/powernv: Fix MCE handler to avoid trashing CR0/CR1 registers Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 092/346] mtd: nand: fix bug writing 1 byte less than page size Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 309/346] fsnotify: add a way to stop queueing events on group shutdown Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 066/346] net: ethoc: Fix early error paths Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 038/346] batman-adv: lock crc access in bridge loop avoidance Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 173/346] usb: gadget: fsl_qe_udc: off by one in setup_received_handle() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 179/346] power: supply: max17042_battery: fix model download bug Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 335/346] vfio/pci: Fix integer overflows, bitmask check Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 074/346] ext4: fix reference counting bug on block allocation error Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 183/346] USB: serial: mos7840: fix non-atomic allocation in write path Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 297/346] perf/x86/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 090/346] brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 197/346] drm/radeon: fix radeon_move_blit on 32bit systems Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 222/346] batman-adv: Add missing refcnt for last_candidate Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 108/346] pps: do not crash when failed to register Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 241/346] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 200/346] parisc: Fix order of EREFUSED define in errno.h Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 279/346] mips: copy_from_user() must zero the destination on access_ok() failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 024/346] hwrng: omap - Fix assumption that runtime_get_sync will always succeed Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 119/346] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 180/346] PM / hibernate: Restore processor state before using per-CPU variables Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 255/346] ipv6: addrconf: fix dev refcont leak when DAD failed Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 140/346] ftrace/recordmcount: Work around for addition of metag magic but not relocations Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 312/346] fix fault_in_multipages_...() on architectures with no-op access_ok() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 003/346] macvlan: Fix potential use-after free for broadcasts Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 321/346] tracing: Move mutex to protect against resetting of seq data Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 132/346] drm/nouveau/acpi: return supported DSM functions Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 253/346] Btrfs: add missing blk_finish_plug in btrfs_sync_log() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 069/346] usb: quirks: Add no-lpm quirk for Elan Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 169/346] x86/mm: Disable preemption during CR3 read+write Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 142/346] mm/hugetlb: avoid soft lockup in set_max_huge_pages() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 019/346] drm/radeon: Don't leak runtime pm ref on driver unload Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 289/346] sh: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 026/346] usb: renesas_usbhs: fix the sequence in xfer_work() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 015/346] crypto: gcm - Filter out async ghash if necessary Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 061/346] NFS: Don't drop CB requests with invalid principals Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 333/346] firewire: net: guard against rx buffer overflows Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 022/346] serial: samsung: Fix ERR pointer dereference on deferred probe Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 202/346] staging: comedi: daqboard2000: bug fix board type matching code Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 136/346] ext4: validate that metadata blocks do not overlap superblock Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 071/346] KVM: nVMX: fix lifetime issues for vmcs02 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 088/346] arm64: debug: unmask PSTATE.D earlier Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 091/346] brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 120/346] drm/radeon: fix firmware info version checks Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 270/346] MIPS: paravirt: Fix undefined reference to smp_bootstrap Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 311/346] ocfs2: fix start offset to ocfs2_zero_range_for_truncate() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 235/346] kernfs: don't depend on d_find_any_alias() when generating notifications Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 214/346] ubifs: Fix assertion in layout_in_gaps() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 191/346] KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 252/346] iio:core: fix IIO_VAL_FRACTIONAL sign handling Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 323/346] drm/radeon/si/dpm: add workaround for for Jet parts Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 077/346] mtd: pmcmsp-flash: Allocating too much in init_msp_flash() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 064/346] qxl: check for kmap failures Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 062/346] Bluetooth: Add USB ID 13D3:3487 to ath3k Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 204/346] iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 072/346] KVM: nVMX: Fix memory corruption when using VMCS shadowing Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 188/346] xhci: always handle "Command Ring Stopped" events Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 044/346] MIPS: Fix page table corruption on THP permission changes Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 302/346] IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 052/346] rtc: ds1307: Fix relying on reset value for weekday Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 060/346] svc: Avoid garbage replies when pc_func() returns rpc_drop_reply Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 159/346] aacraid: Check size values after double-fetch from user Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 122/346] arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 325/346] ARM: 8617/1: dma: fix dma_max_pfn() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 209/346] usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 083/346] netfilter: x_tables: validate targets of jumps Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 313/346] i2c-eg20t: fix race between i2c init and interrupt enable Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 293/346] microblaze: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 215/346] tun: fix transmit timestamp support Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 043/346] iwlwifi: pcie: fix access to scratch buffer Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 257/346] ALSA: timer: Fix zero-division by continue of uninitialized instance Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 048/346] ALSA: ctl: Stop notification after disconnection Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 207/346] powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 100/346] MIPS: RM7000: Double locking bug in rm7k_tc_disable() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 243/346] IB/core: Fix use after free in send_leave function Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 284/346] ppc32: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 303/346] irda: Free skb on irda_accept error path Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 073/346] drm/radeon: support backlight control for UNIPHY3 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 068/346] USB: quirks: Fix another ELAN touchscreen Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 199/346] net/mlx5: Added missing check of msg length in verifying its signature Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 154/346] USB: serial: option: add support for Telit LE920A4 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 112/346] l2tp: Correctly return -EBADF from pppol2tp_getname Ben Hutchings
2016-11-14  0:14 ` Ben Hutchings [this message]
2016-11-14  0:14 ` [PATCH 3.16 278/346] ARC: uaccess: get_user to zero out dest in cause of fault Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 053/346] [media] ngene: properly handle __user ptr Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 110/346] tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 250/346] usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 007/346] [media] em28xx-i2c: rt_mutex_trylock() returns zero on failure Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 299/346] IB/ipoib: Don't allow MC joins during light MC flush Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 283/346] parisc: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 113/346] module: Invalidate signatures on force-loaded modules Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 229/346] drm/msm: protect against faults from copy_from_user() in submit ioctl Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 212/346] ASoC: omap-mcpdm: Fix irq resource handling Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 219/346] usb: gadget: udc: core: don't starve DMA resources Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 041/346] batman-adv: Free last_bonding_candidate on release of orig_node Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 275/346] hexagon: fix strncpy_from_user() error return Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 273/346] cris: buggered copy_from_user/copy_to_user/clear_user Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 114/346] Documentation/module-signing.txt: Note need for version info if reusing a key Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 034/346] batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 155/346] USB: serial: fix memleak in driver-registration error path Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 316/346] can: dev: fix deadlock reported after bus-off Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 267/346] ARM: sa1111: fix pcmcia suspend/resume Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 300/346] IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 208/346] drm: Reject page_flip for !DRIVER_MODESET Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 187/346] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 213/346] USB: avoid left shift by -1 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 304/346] avr32: fix 'undefined reference to `___copy_from_user' Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 292/346] m32r: fix __get_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 103/346] libceph: apply new_state before new_up_client on incrementals Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 011/346] random: add interrupt callback to VMBus IRQ handler Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 182/346] USB: serial: mos7720: fix non-atomic allocation in write path Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 104/346] gpio: intel-mid: Remove potentially harmful code Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 095/346] target: Fix max_unmap_lba_count calc overflow Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 181/346] ipv6: suppress sparse warnings in IP6_ECN_set_ce() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 042/346] ext4: validate s_reserved_gdt_blocks on mount Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 116/346] ceph: Correctly return NXIO errors from ceph_llseek Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 317/346] i2c: qup: skip qup_i2c_suspend if the device is already runtime suspended Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 055/346] x86/quirks: Apply nvidia_bugs quirk only on root bus Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 248/346] iio: accel: kxsd9: Fix scaling bug Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 195/346] gpio: Fix OF build problem on UM Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 274/346] frv: fix clear_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 078/346] USB: serial: option: add support for Telit LE910 PID 0x1206 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 082/346] mmc: block: fix packed command header endianness Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 020/346] drm/radeon: Don't leak runtime pm ref on driver load Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 056/346] x86/quirks: Reintroduce scanning of secondary buses Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 211/346] USB: fix typo in wMaxPacketSize validation Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 126/346] fuse: fix wrong assignment of ->flags in fuse_send_init() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 310/346] fanotify: fix list corruption in fanotify_get_response() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 079/346] Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 254/346] Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 332/346] scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 128/346] ubi: Make volume resize power cut aware Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 165/346] USB: validate wMaxPacketValue entries in endpoint descriptors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 261/346] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 225/346] printk: fix parsing of "brl=" option Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 089/346] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 315/346] btrfs: ensure that file descriptor used with subvol ioctls is a dir Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 145/346] hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 203/346] staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 076/346] powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 016/346] ARM: AM43XX: hwmod: Fix RSTST register offset for pruss Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 127/346] ubi: Fix race condition between ubi device creation and udev Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 118/346] sparc: serial: sunhv: fix a double lock bug Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 040/346] batman-adv: Fix reference leak in batadv_find_router Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 251/346] efi/libstub: Allocate headspace in efi_get_memory_map() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 301/346] IB/mlx4: Fix code indentation in QP1 MAD flow Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 272/346] asm-generic: make get_user() clear the destination on errors Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 239/346] tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 168/346] usb: dwc3: gadget: increment request->actual once Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 266/346] USB: serial: simple: add support for another Infineon flashloader Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 220/346] qdisc: fix a module refcount leak in qdisc_create_dflt() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 148/346] block: fix bdi vs gendisk lifetime mismatch Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 287/346] score: fix copy_from_user() and friends Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 054/346] [media] media: dvb_ringbuffer: Add memory barriers Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 012/346] sched/cputime: Fix prev steal time accouting during CPU hotplug Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 033/346] ext4: don't call ext4_should_journal_data() on the journal inode Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 167/346] s390/dasd: fix hanging device after clear subchannel Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 149/346] mac80211: fix purging multicast PS buffer queue Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 249/346] sched/core: Fix a race between try_to_wake_up() and a woken up task Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 032/346] ext4: fix deadlock during page writeback Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 291/346] blackfin: fix copy_from_user() Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 129/346] ubi: Be more paranoid while seaching for the most recent Fastmap Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 340/346] [media] usbvision: revert commit 588afcc1 Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 341/346] staging: comedi: ni_mio_common: fix wrong insn_write handler Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 342/346] xenbus: don't BUG() on user mode induced condition Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 337/346] fs: Avoid premature clearing of capabilities Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 336/346] fs: Give dentry to inode_change_ok() instead of inode Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 338/346] posix_acl: Clear SGID bit when setting file permissions Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 346/346] KVM: MIPS: Drop other CPU ASIDs on guest MMU changes Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 339/346] ARC: use ASL assembler mnemonic Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 344/346] compiler-gcc: disable -ftracer for __noclone functions Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 343/346] xenbus: don't look up transaction IDs for ordinary writes Ben Hutchings
2016-11-14  0:14 ` [PATCH 3.16 345/346] PM / devfreq: Fix incorrect type issue Ben Hutchings
2016-11-14  5:49 ` [PATCH 3.16 000/346] 3.16.39-rc1 review Guenter Roeck
2016-11-14 17:10   ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1479082460.336278615@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=dvyukov@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tiwai@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).