From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Martin K. Petersen" <martin.petersen@oracle.com>,
"Ming Lei" <tom.leiming@gmail.com>,
"Christoph Hellwig" <hch@lst.de>
Subject: [PATCH 3.2 041/126] scsi: Fix use-after-free
Date: Wed, 15 Feb 2017 22:41:34 +0000 [thread overview]
Message-ID: <lsq.1487198494.603985876@decadent.org.uk> (raw)
In-Reply-To: <lsq.1487198490.691915840@decadent.org.uk>
3.2.85-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
commit bcd8f2e94808fcddf6ef3af5f060a36820dcc432 upstream.
This patch fixes one use-after-free report[1] by KASAN.
In __scsi_scan_target(), when a type 31 device is probed,
SCSI_SCAN_TARGET_PRESENT is returned and the target will be scanned
again.
Inside the following scsi_report_lun_scan(), one new scsi_device
instance is allocated, and scsi_probe_and_add_lun() is called again to
probe the target and still see type 31 device, finally
__scsi_remove_device() is called to remove & free the device at the end
of scsi_probe_and_add_lun(), so cause use-after-free in
scsi_report_lun_scan().
And the following SCSI log can be observed:
scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
scsi 0:0:2:0: scsi scan: Sending REPORT LUNS to (try 0)
scsi 0:0:2:0: scsi scan: REPORT LUNS successful (try 0) result 0x0
scsi 0:0:2:0: scsi scan: REPORT LUN scan
scsi 0:0:2:0: scsi scan: INQUIRY pass 1 length 36
scsi 0:0:2:0: scsi scan: INQUIRY successful with code 0x0
scsi 0:0:2:0: scsi scan: peripheral device type of 31, no device added
BUG: KASAN: use-after-free in __scsi_scan_target+0xbf8/0xe40 at addr ffff88007b44a104
This patch fixes the issue by moving the putting reference at
the end of scsi_report_lun_scan().
[1] KASAN report
==================================================================
[ 3.274597] PM: Adding info for serio:serio1
[ 3.275127] BUG: KASAN: use-after-free in __scsi_scan_target+0xd87/0xdf0 at addr ffff880254d8c304
[ 3.275653] Read of size 4 by task kworker/u10:0/27
[ 3.275903] CPU: 3 PID: 27 Comm: kworker/u10:0 Not tainted 4.8.0 #2121
[ 3.276258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 3.276797] Workqueue: events_unbound async_run_entry_fn
[ 3.277083] ffff880254d8c380 ffff880259a37870 ffffffff94bbc6c1 ffff880078402d80
[ 3.277532] ffff880254d8bb80 ffff880259a37898 ffffffff9459fec1 ffff880259a37930
[ 3.277989] ffff880254d8bb80 ffff880078402d80 ffff880259a37920 ffffffff945a0165
[ 3.278436] Call Trace:
[ 3.278528] [<ffffffff94bbc6c1>] dump_stack+0x65/0x84
[ 3.278797] [<ffffffff9459fec1>] kasan_object_err+0x21/0x70
[ 3.279063] device: 'psaux': device_add
[ 3.279616] [<ffffffff945a0165>] kasan_report_error+0x205/0x500
[ 3.279651] PM: Adding info for No Bus:psaux
[ 3.280202] [<ffffffff944ecd22>] ? kfree_const+0x22/0x30
[ 3.280486] [<ffffffff94bc2dc9>] ? kobject_release+0x119/0x370
[ 3.280805] [<ffffffff945a0543>] __asan_report_load4_noabort+0x43/0x50
[ 3.281170] [<ffffffff9507e1f7>] ? __scsi_scan_target+0xd87/0xdf0
[ 3.281506] [<ffffffff9507e1f7>] __scsi_scan_target+0xd87/0xdf0
[ 3.281848] [<ffffffff9507d470>] ? scsi_add_device+0x30/0x30
[ 3.282156] [<ffffffff94f7f660>] ? pm_runtime_autosuspend_expiration+0x60/0x60
[ 3.282570] [<ffffffff956ddb07>] ? _raw_spin_lock+0x17/0x40
[ 3.282880] [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
[ 3.283200] [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
[ 3.283563] [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
[ 3.283882] [<ffffffff9507efc1>] do_scan_async+0x41/0x450
[ 3.284173] [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
[ 3.284492] [<ffffffff941a8954>] ? pwq_dec_nr_in_flight+0x124/0x2a0
[ 3.284876] [<ffffffff941d1770>] ? preempt_count_add+0x130/0x160
[ 3.285207] [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
[ 3.285526] [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
[ 3.285844] [<ffffffff941aa810>] ? process_one_work+0x12d0/0x12d0
[ 3.286182] [<ffffffff941bb365>] kthread+0x1c5/0x260
[ 3.286443] [<ffffffff940855cd>] ? __switch_to+0x88d/0x1430
[ 3.286745] [<ffffffff941bb1a0>] ? kthread_worker_fn+0x5a0/0x5a0
[ 3.287085] [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
[ 3.287368] [<ffffffff941bb1a0>] ? kthread_worker_fn+0x5a0/0x5a0
[ 3.287697] Object at ffff880254d8bb80, in cache kmalloc-2048 size: 2048
[ 3.288064] Allocated:
[ 3.288147] PID = 27
[ 3.288218] [<ffffffff940b27ab>] save_stack_trace+0x2b/0x50
[ 3.288531] [<ffffffff9459f246>] save_stack+0x46/0xd0
[ 3.288806] [<ffffffff9459f4bd>] kasan_kmalloc+0xad/0xe0
[ 3.289098] [<ffffffff9459c07e>] __kmalloc+0x13e/0x250
[ 3.289378] [<ffffffff95078e5a>] scsi_alloc_sdev+0xea/0xcf0
[ 3.289701] [<ffffffff9507de76>] __scsi_scan_target+0xa06/0xdf0
[ 3.290034] [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
[ 3.290362] [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
[ 3.290724] [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
[ 3.291055] [<ffffffff9507efc1>] do_scan_async+0x41/0x450
[ 3.291354] [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
[ 3.291695] [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
[ 3.292022] [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
[ 3.292325] [<ffffffff941bb365>] kthread+0x1c5/0x260
[ 3.292594] [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
[ 3.292886] Freed:
[ 3.292945] PID = 27
[ 3.293016] [<ffffffff940b27ab>] save_stack_trace+0x2b/0x50
[ 3.293327] [<ffffffff9459f246>] save_stack+0x46/0xd0
[ 3.293600] [<ffffffff9459fa61>] kasan_slab_free+0x71/0xb0
[ 3.293916] [<ffffffff9459bac2>] kfree+0xa2/0x1f0
[ 3.294168] [<ffffffff9508158a>] scsi_device_dev_release_usercontext+0x50a/0x730
[ 3.294598] [<ffffffff941ace9a>] execute_in_process_context+0xda/0x130
[ 3.294974] [<ffffffff9508107c>] scsi_device_dev_release+0x1c/0x20
[ 3.295322] [<ffffffff94f566f6>] device_release+0x76/0x1e0
[ 3.295626] [<ffffffff94bc2db7>] kobject_release+0x107/0x370
[ 3.295942] [<ffffffff94bc29ce>] kobject_put+0x4e/0xa0
[ 3.296222] [<ffffffff94f56e17>] put_device+0x17/0x20
[ 3.296497] [<ffffffff9505201c>] scsi_device_put+0x7c/0xa0
[ 3.296801] [<ffffffff9507e1bc>] __scsi_scan_target+0xd4c/0xdf0
[ 3.297132] [<ffffffff9507e505>] scsi_scan_channel+0x105/0x160
[ 3.297458] [<ffffffff9507e8a2>] scsi_scan_host_selected+0x212/0x2f0
[ 3.297829] [<ffffffff9507eb3c>] do_scsi_scan_host+0x1bc/0x250
[ 3.298156] [<ffffffff9507efc1>] do_scan_async+0x41/0x450
[ 3.298453] [<ffffffff941c1fee>] async_run_entry_fn+0xfe/0x610
[ 3.298777] [<ffffffff941a9a84>] process_one_work+0x544/0x12d0
[ 3.299105] [<ffffffff941aa8e9>] worker_thread+0xd9/0x12f0
[ 3.299408] [<ffffffff941bb365>] kthread+0x1c5/0x260
[ 3.299676] [<ffffffff956dde9f>] ret_from_fork+0x1f/0x40
[ 3.299967] Memory state around the buggy address:
[ 3.300209] ffff880254d8c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3.300608] ffff880254d8c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3.300986] >ffff880254d8c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3.301408] ^
[ 3.301550] ffff880254d8c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 3.301987] ffff880254d8c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.302396]
==================================================================
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/scsi_scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1522,12 +1522,12 @@ static int scsi_report_lun_scan(struct s
out_err:
kfree(lun_data);
out:
- scsi_device_put(sdev);
if (scsi_device_created(sdev))
/*
* the sdev we used didn't appear in the report luns scan
*/
__scsi_remove_device(sdev);
+ scsi_device_put(sdev);
return ret;
}
next prev parent reply other threads:[~2017-02-15 22:51 UTC|newest]
Thread overview: 136+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-15 22:41 [PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 013/126] rtlwifi: Update regulatory database Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 061/126] vt: clear selection before resizing Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 085/126] Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 003/126] zfcp: fix ELS/GS request&response length for hardware data router Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 081/126] rtnl: reset calcit fptr in rtnl_unregister() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 006/126] zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 107/126] perf: Fix race in swevent hash Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 122/126] Fix potential infoleak in older kernels Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 069/126] usb: gadget: u_ether: remove interrupt throttling Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 016/126] [media] cx231xx: don't return error on success Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 054/126] hv: do not lose pending heartbeat vmbus packets Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 053/126] scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 062/126] netfilter: nf_conntrack_sip: extend request line validation Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 119/126] rose: limit sk_filter trim to payload Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 113/126] perf: Do not double free Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 102/126] ser_gigaset: return -ENOMEM on error instead of success Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 124/126] sg_write()/bsg_write() is not fit to be called under KERNEL_DS Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 050/126] powerpc: Convert cmp to cmpd in idle enter sequence Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 097/126] tipc: check minimum bearer MTU Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 083/126] coredump: fix unfreezable coredumping task Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 026/126] net/mlx4_core: Fix deadlock when switching between polling and event fw commands Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 091/126] mwifiex: printk() overflow with 32-byte SSIDs Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 104/126] ARM: dma-mapping: don't allow DMA mappings to be marked executable Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 101/126] can: raw: raw_setsockopt: limit number of can_filter that can be set Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 030/126] USB: serial: cp210x: Add ID for a Juniper console Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from __copy_tofrom_user Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 007/126] zfcp: trace on request for open and close of WKA port Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 100/126] fuse: fix clearing suid, sgid for chown() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 035/126] s390/con3270: fix insufficient space padding Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 109/126] tty: Prevent ldisc drivers from re-using stale tty fields Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 066/126] net/mlx4_en: Process all completions in RX rings after port goes up Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 037/126] fuse: fix killing s[ug]id in setattr Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 021/126] iommu/amd: Free domain id when free a domain of struct dma_ops_domain Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 043/126] scsi: zfcp: spin_lock_irqsave() is not nestable Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 098/126] net: ping: check minimum size on ICMP header length Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 080/126] scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 056/126] scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 126/126] ALSA: pcm : Call kill_fasync() in stream lock Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 024/126] ALSA: ali5451: Fix out-of-bound position reporting Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 084/126] dib0700: fix nec repeat handling Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 117/126] fbdev: color map copying bounds checking Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 036/126] fuse: invalidate dir dentry after chmod Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 017/126] [media] cx231xx: fix GPIOs for Pixelview SBTVD hybrid Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 051/126] ACPI / APEI: Fix incorrect return value of ghes_proc() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 060/126] tty: limit terminal size to 4M chars Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 005/126] zfcp: retain trace level for SCSI and HBA FSF response records Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 048/126] xhci: add restart quirk for Intel Wildcatpoint PCH Ben Hutchings
2017-02-15 22:41 ` Ben Hutchings [this message]
2017-02-15 22:41 ` [PATCH 3.2 052/126] dm table: fix missing dm_put_target_type() in dm_table_add_target() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 063/126] lib/genalloc.c: start search from start of chunk Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 123/126] sctp: validate chunk len before actually using it Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 023/126] powerpc/nvram: Fix an incorrect partition merge Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 078/126] USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 045/126] Input: i8042 - add XMG C504 to keyboard reset table Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 059/126] tty: vt, fix bogus division in csi_J Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 031/126] NFSv4: Open state recovery must account for file permission changes Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 073/126] firewire: net: fix fragmented datagram_size off-by-one Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 049/126] batman-adv: fix splat on disabling an interface Ben Hutchings
2017-02-16 6:56 ` Linus Lüssing
2017-02-16 16:05 ` Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 103/126] net: cleanups in sock_setsockopt() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 018/126] ext4: reinforce check of i_dtime when clearing high fields of uid and gid Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 094/126] KVM: x86: drop error recovery in em_jmp_far and em_ret_far Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 033/126] ext4: release bh in make_indexed_dir Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 027/126] ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 112/126] perf: Fix event->ctx locking Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 001/126] fbdev/efifb: Fix 16 color palette entry calculation Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 032/126] powerpc/vdso64: Use double word compare on pointers Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 009/126] zfcp: fix D_ID field with actual value on tracing SAN responses Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 002/126] zfcp: fix fc_host port_type with NPIV Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 064/126] KVM: x86: fix wbinvd_dirty_mask use-after-free Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 116/126] HID: core: prevent out-of-bound readings Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 075/126] HID: usbhid: add ATEN CS962 to list of quirky devices Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 076/126] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 058/126] ALSA: usb-audio: Add quirk for Syntek STK1160 Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 095/126] locking/rtmutex: Prevent dequeue vs. unlock race Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 120/126] dccp: limit sk_filter trim to payload Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 118/126] net: Add __sock_queue_rcv_skb() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 096/126] packet: fix race condition in packet_set_ring Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 105/126] [media] media: info leak in __media_device_enum_links() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 108/126] isdn/gigaset: reset tty->receive_room when attaching ser_gigaset Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 029/126] mmc: block: don't use CMD23 with very old MMC cards Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 125/126] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 019/126] reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 093/126] ext4: sanity check the block and cluster size at mount time Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 071/126] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 077/126] i2c: core: fix NULL pointer dereference under race condition Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 010/126] zfcp: fix payload trace length for SAN request&response Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 086/126] igmp: do not remove igmp souce list info when set link down Ben Hutchings
2017-02-16 1:42 ` Hangbin Liu
2017-02-16 16:03 ` Ben Hutchings
2017-03-06 19:00 ` Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 028/126] regulator: tps65910: Work around silicon erratum SWCZ010 Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 079/126] mmc: mxs: Initialize the spinlock prior to using it Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 055/126] staging: iio: ad5933: avoid uninitialized variable in error case Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 110/126] perf: Fix perf_event_for_each() to use sibling Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 092/126] KVM: Disable irq while unregistering user notifier Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 067/126] ipv6: Don't use ufo handling on later transformed packets Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 044/126] isofs: Do not return EACCES for unknown filesystems Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 014/126] rtlwifi: Fix missing country code for Great Britain Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 046/126] ubifs: Fix xattr_names length in exit paths Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 065/126] ubifs: Fix regression in ubifs_readdir() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 011/126] zfcp: trace full payload of all SAN records (req,resp,iels) Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 020/126] sctp: do not return the transmit err back to sctp_sendmsg Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 106/126] sg: Fix double-free when drives detach during SG_IO Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 111/126] lockdep: Silence warning if CONFIG_LOCKDEP isn't set Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 004/126] zfcp: close window with unblocked rport during rport gone Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 070/126] uwb: fix device reference leaks Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 088/126] USB: serial: cp210x: add ID for the Zone DPMX Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 087/126] mfd: core: Fix device reference leak in mfd_clone_cell Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 042/126] mac80211: discard multicast and 4-addr A-MSDUs Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 068/126] can: bcm: fix warning in bcm_connect/proc_register Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 074/126] HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 039/126] crypto: gcm - Fix IV buffer size in crypto_gcm_setkey Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 114/126] perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race Ben Hutchings
2017-02-21 0:46 ` Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 047/126] ubifs: Abort readdir upon error Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 008/126] zfcp: restore tracing of handle for port and LUN with HBA records Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 115/126] block: fix use-after-free in sys_ioprio_get() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 082/126] swapfile: fix memory corruption via malformed swapfile Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 090/126] IB/mlx4: Fix create CQ error flow Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 057/126] scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 022/126] scsi: ibmvfc: Fix I/O hang when port is not mapped Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 121/126] tcp: take care of truncations done by sk_filter() Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 015/126] [media] mb86a20s: fix the locking logic Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 089/126] IB/uverbs: Fix leak of XRC target QPs Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 038/126] fuse: listxattr: verify xattr list Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 072/126] parisc: Ensure consistent state when switching to kernel stack at syscall entry Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer deference Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 099/126] net: ep93xx_eth: Do not crash unloading module Ben Hutchings
2017-02-15 22:41 ` [PATCH 3.2 012/126] netfilter: restart search if moved to other chain Ben Hutchings
2017-02-16 0:06 ` [PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings
2017-02-16 5:59 ` Guenter Roeck
2017-02-16 15:56 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1487198494.603985876@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=hch@lst.de \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
--cc=tom.leiming@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).