From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"David Sterba" <dsterba@suse.com>,
"Josef Bacik" <josef@toxicpanda.com>,
"Filipe Manana" <fdmanana@suse.com>
Subject: [PATCH 3.16 114/245] Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
Date: Fri, 24 Apr 2020 00:05:41 +0100 [thread overview]
Message-ID: <lsq.1587683028.116145969@decadent.org.uk> (raw)
In-Reply-To: <lsq.1587683027.831233700@decadent.org.uk>
3.16.83-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit 6609fee8897ac475378388238456c84298bff802 upstream.
When a tree mod log user no longer needs to use the tree it calls
btrfs_put_tree_mod_seq() to remove itself from the list of users and
delete all no longer used elements of the tree's red black tree, which
should be all elements with a sequence number less then our equals to
the caller's sequence number. However the logic is broken because it
can delete and free elements from the red black tree that have a
sequence number greater then the caller's sequence number:
1) At a point in time we have sequence numbers 1, 2, 3 and 4 in the
tree mod log;
2) The task which got assigned the sequence number 1 calls
btrfs_put_tree_mod_seq();
3) Sequence number 1 is deleted from the list of sequence numbers;
4) The current minimum sequence number is computed to be the sequence
number 2;
5) A task using sequence number 2 is at tree_mod_log_rewind() and gets
a pointer to one of its elements from the red black tree through
a call to tree_mod_log_search();
6) The task with sequence number 1 iterates the red black tree of tree
modification elements and deletes (and frees) all elements with a
sequence number less then or equals to 2 (the computed minimum sequence
number) - it ends up only leaving elements with sequence numbers of 3
and 4;
7) The task with sequence number 2 now uses the pointer to its element,
already freed by the other task, at __tree_mod_log_rewind(), resulting
in a use-after-free issue. When CONFIG_DEBUG_PAGEALLOC=y it produces
a trace like the following:
[16804.546854] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
[16804.547451] CPU: 0 PID: 28257 Comm: pool Tainted: G W 5.4.0-rc8-btrfs-next-51 #1
[16804.548059] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
[16804.548666] RIP: 0010:rb_next+0x16/0x50
(...)
[16804.550581] RSP: 0018:ffffb948418ef9b0 EFLAGS: 00010202
[16804.551227] RAX: 6b6b6b6b6b6b6b6b RBX: ffff90e0247f6600 RCX: 6b6b6b6b6b6b6b6b
[16804.551873] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff90e0247f6600
[16804.552504] RBP: ffff90dffe0d4688 R08: 0000000000000001 R09: 0000000000000000
[16804.553136] R10: ffff90dffa4a0040 R11: 0000000000000000 R12: 000000000000002e
[16804.553768] R13: ffff90e0247f6600 R14: 0000000000001663 R15: ffff90dff77862b8
[16804.554399] FS: 00007f4b197ae700(0000) GS:ffff90e036a00000(0000) knlGS:0000000000000000
[16804.555039] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[16804.555683] CR2: 00007f4b10022000 CR3: 00000002060e2004 CR4: 00000000003606f0
[16804.556336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[16804.556968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[16804.557583] Call Trace:
[16804.558207] __tree_mod_log_rewind+0xbf/0x280 [btrfs]
[16804.558835] btrfs_search_old_slot+0x105/0xd00 [btrfs]
[16804.559468] resolve_indirect_refs+0x1eb/0xc70 [btrfs]
[16804.560087] ? free_extent_buffer.part.19+0x5a/0xc0 [btrfs]
[16804.560700] find_parent_nodes+0x388/0x1120 [btrfs]
[16804.561310] btrfs_check_shared+0x115/0x1c0 [btrfs]
[16804.561916] ? extent_fiemap+0x59d/0x6d0 [btrfs]
[16804.562518] extent_fiemap+0x59d/0x6d0 [btrfs]
[16804.563112] ? __might_fault+0x11/0x90
[16804.563706] do_vfs_ioctl+0x45a/0x700
[16804.564299] ksys_ioctl+0x70/0x80
[16804.564885] ? trace_hardirqs_off_thunk+0x1a/0x20
[16804.565461] __x64_sys_ioctl+0x16/0x20
[16804.566020] do_syscall_64+0x5c/0x250
[16804.566580] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[16804.567153] RIP: 0033:0x7f4b1ba2add7
(...)
[16804.568907] RSP: 002b:00007f4b197adc88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[16804.569513] RAX: ffffffffffffffda RBX: 00007f4b100210d8 RCX: 00007f4b1ba2add7
[16804.570133] RDX: 00007f4b100210d8 RSI: 00000000c020660b RDI: 0000000000000003
[16804.570726] RBP: 000055de05a6cfe0 R08: 0000000000000000 R09: 00007f4b197add44
[16804.571314] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b197add48
[16804.571905] R13: 00007f4b197add40 R14: 00007f4b100210d0 R15: 00007f4b197add50
(...)
[16804.575623] ---[ end trace 87317359aad4ba50 ]---
Fix this by making btrfs_put_tree_mod_seq() skip deletion of elements that
have a sequence number equals to the computed minimum sequence number, and
not just elements with a sequence number greater then that minimum.
Fixes: bd989ba359f2ac ("Btrfs: add tree modification log functions")
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/ctree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -418,7 +418,7 @@ void btrfs_put_tree_mod_seq(struct btrfs
for (node = rb_first(tm_root); node; node = next) {
next = rb_next(node);
tm = container_of(node, struct tree_mod_elem, node);
- if (tm->seq > min_seq)
+ if (tm->seq >= min_seq)
continue;
rb_erase(node, tm_root);
kfree(tm);
next prev parent reply other threads:[~2020-04-23 23:15 UTC|newest]
Thread overview: 260+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-23 23:03 [PATCH 3.16 000/245] 3.16.83-rc1 review Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 001/245] mwifiex: fix unbalanced locking in mwifiex_process_country_ie() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 002/245] libertas: Fix two buffer overflows at parsing bss descriptor Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 003/245] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 004/245] libertas: make lbs_ibss_join_existing() return error code on rates overflow Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 005/245] mwifiex: fix probable memory corruption while processing TDLS frame Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 006/245] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 007/245] cfg80211/mac80211: make ieee80211_send_layer2_update a public function Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 008/245] mac80211: Do not send Layer 2 Update frame before authorization Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 009/245] x86/microcode/AMD: Add support for fam17h microcode loading Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 010/245] ext4: wait for existing dio workers in ext4_alloc_file_blocks() Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 011/245] ext4: only call ext4_truncate when size <= isize Ben Hutchings
2020-04-23 23:03 ` [PATCH 3.16 012/245] ext4: update c/mtime on truncate up Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 013/245] quota: fix wrong condition in is_quota_modification() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 014/245] ext4: fix races between page faults and hole punching Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 015/245] ext4: move unlocked dio protection from ext4_alloc_file_blocks() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 016/245] ext4: fix races between buffered IO and collapse / insert range Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 017/245] ext4: fix races of writeback with punch hole and zero range Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 018/245] Btrfs: fix wrong max inline data size limit Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 019/245] btrfs: new define for the inline extent data start Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 020/245] btrfs: kill extent_buffer_page helper Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 021/245] btrfs: cleanup, rename a few variables in btrfs_read_sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 022/245] btrfs: add more checks to btrfs_read_sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 023/245] btrfs: cleanup, stop casting for extent_map->lookup everywhere Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 024/245] btrfs: handle invalid num_stripes in sys_array Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 025/245] btrfs: Enhance chunk validation check Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 026/245] Btrfs: add validadtion checks for chunk loading Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 027/245] Btrfs: check inconsistence between chunk and block group Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 028/245] Btrfs: fix em leak in find_first_block_group Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 029/245] Btrfs: detect corruption when non-root leaf has zero item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 030/245] Btrfs: check btree node's nritems Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 031/245] Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 032/245] Btrfs: memset to avoid stale content in btree node block Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 033/245] Btrfs: improve check_node to avoid reading corrupted nodes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 034/245] Btrfs: kill BUG_ON in run_delayed_tree_ref Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 035/245] Btrfs: memset to avoid stale content in btree leaf Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 036/245] Btrfs: fix emptiness check for dirtied extent buffers at check_leaf() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 037/245] btrfs: struct-funcs, constify readers Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 038/245] btrfs: Refactor check_leaf function for later expansion Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 039/245] btrfs: Check if item pointer overlaps with the item itself Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 040/245] btrfs: Add sanity check for EXTENT_DATA when reading out leaf Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 041/245] btrfs: Add checker for EXTENT_CSUM Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 042/245] btrfs: Move leaf and node validation checker to tree-checker.c Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 043/245] btrfs: tree-checker: Enhance btrfs_check_node output Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 044/245] btrfs: tree-checker: Fix false panic for sanity test Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 045/245] btrfs: tree-checker: Add checker for dir item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 046/245] btrfs: tree-checker: use %zu format string for size_t Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 047/245] btrfs: tree-check: reduce stack consumption in check_dir_item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 048/245] btrfs: tree-checker: Verify block_group_item Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 049/245] btrfs: tree-checker: Detect invalid and empty essential trees Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 050/245] btrfs: validate type when reading a chunk Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 051/245] btrfs: Check that each block group has corresponding chunk at mount time Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 052/245] btrfs: Verify that every chunk has corresponding block group " Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 053/245] btrfs: tree-checker: Check level for leaves and nodes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 054/245] btrfs: tree-checker: Fix misleading group system information Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 055/245] btrfs: ensure that a DUP or RAID1 block group has exactly two stripes Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 056/245] dm: do not override error code returned from dm_get_device() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 057/245] dm flakey: return -EINVAL on interval bounds error in flakey_ctr() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 058/245] dm flakey: fix reads to be issued if drop_writes configured Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 059/245] dm flakey: check for null arg_name in parse_features() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 060/245] x86/pti/efi: broken conversion from efi to kernel page table Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 061/245] batman-adv: Fix DAT candidate selection on little endian systems Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 062/245] netfilter: ctnetlink: netns exit must wait for callbacks Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 063/245] taskstats: fix data-race Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 064/245] dm btree: increase rebalance threshold in __rebalance2() Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 065/245] dm thin metadata: Add support for a pre-commit callback Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 066/245] pinctrl: baytrail: Relax GPIO request rules Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 067/245] pinctrl: baytrail: Clear interrupt triggering from pins that are in GPIO mode Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 068/245] pinctrl: baytrail: Rework interrupt handling Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 069/245] pinctrl: baytrail: Serialize all register access Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 070/245] pinctrl: baytrail: Really serialize all register accesses Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 071/245] netfilter: nf_tables: missing sanitization in data from userspace Ben Hutchings
2020-04-23 23:04 ` [PATCH 3.16 072/245] netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 073/245] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 074/245] HID: uhid: Fix returning EPOLLOUT from uhid_char_poll Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 075/245] gpio: Fix error message on out-of-range GPIO in lookup table Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 076/245] neighbour: remove neigh_cleanup() method Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 077/245] bonding: fix bond_neigh_init() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 078/245] af_packet: set defaule value for tmo Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 079/245] ACPI: PM: Avoid attaching ACPI PM domain to certain devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 080/245] scsi: iscsi: qla4xxx: fix double free in probe Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 081/245] staging: gigaset: fix general protection fault on probe Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 082/245] staging: gigaset: fix illegal free on probe errors Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 083/245] staging: gigaset: add endpoint-type sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 084/245] usb: core: urb: fix URB structure initialization function Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 085/245] usb: mon: Fix a deadlock in usbmon between mmap and read Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 086/245] USB: serial: io_edgeport: fix epic endpoint lookup Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 087/245] USB: idmouse: fix interface sanity checks Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 088/245] USB: adutux: fix interface sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 089/245] USB: atm: ueagle-atm: add missing endpoint check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 090/245] staging: rtl8188eu: fix interface sanity check Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 091/245] staging: rtl8712: " Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 092/245] gpiolib: fix up emulated open drain outputs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 093/245] virtio-balloon: fix managed page counts when migrating pages between zones Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 094/245] HID: Fix slab-out-of-bounds read in hid_field_extract Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 095/245] xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 096/245] xhci: make sure interrupts are restored to correct state Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 097/245] usb: dwc3: pci: Add PCI ID for Intel Braswell Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 098/245] usb: dwc3: pci: add support for Intel Sunrise Point PCH Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 099/245] usb: dwc3: pci: add support for Intel Broxton SOC Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 100/245] usb: dwc3: pci: add ID for one more Intel Broxton platform Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 101/245] usb: dwc3: pci: add Intel Kabylake PCI ID Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 102/245] usb: dwc3: pci: add Intel Gemini Lake " Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 103/245] usb: dwc3: pci: add Intel Cannonlake PCI IDs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 104/245] usb: dwc3: pci: add support for Intel IceLake Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 105/245] usb: dwc3: pci: add support for Comet Lake PCH ID Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 106/245] usb: dwc3: pci: Add Support for Intel Elkhart Lake Devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 107/245] usb: dwc3: pci: add support for TigerLake Devices Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 108/245] usb: dwc3: pci: add ID for the Intel Comet Lake -H variant Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 109/245] tty: serial: msm_serial: Fix lockup for sysrq and oops Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 110/245] IB/mlx4: Avoid executing gid task when device is being removed Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 111/245] IB/mlx4: Follow mirror sequence of device add during device removal Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 112/245] HID: hid-input: clear unmapped usages Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 113/245] btrfs: do not call synchronize_srcu() in inode_tree_del Ben Hutchings
2020-04-23 23:05 ` Ben Hutchings [this message]
2020-04-23 23:05 ` [PATCH 3.16 115/245] btrfs: abort transaction after failed inode updates in create_subvol Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 116/245] btrfs: handle ENOENT in btrfs_uuid_tree_iterate Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 117/245] btrfs: skip log replay on orphaned roots Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 118/245] btrfs: do not leak reloc root if we fail to read the fs root Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 119/245] Btrfs: fix infinite loop during nocow writeback due to race Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 120/245] btrfs: Remove redundant btrfs_release_path from btrfs_unlink_subvol Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 121/245] btrfs: do not delete mismatched root refs Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 122/245] btrfs: check rw_devices, not num_devices for balance Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 123/245] ext4: check for directory entries too close to block end Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 124/245] powerpc/irq: fix stack overflow verification Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 125/245] 6pack,mkiss: fix possible deadlock Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 126/245] tcp: do not send empty skb from tcp_write_xmit() Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 127/245] ALSA: pcm: Avoid possible info leaks from PCM stream buffers Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 128/245] ALSA: hda/ca0132 - Avoid endless loop Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 129/245] ASoC: wm8962: fix lambda value Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 130/245] tty: link tty and port before configuring it as console Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 131/245] USB: EHCI: Do not return -EPIPE when hub is disconnected Ben Hutchings
2020-04-23 23:05 ` [PATCH 3.16 132/245] usbip: Fix error path of vhci_recv_ret_submit() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 133/245] kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 134/245] net: stmmac: 16KB buffer must be 16 byte aligned Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 135/245] net: stmmac: Enable 16KB buffer size Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 136/245] netfilter: ebtables: convert BUG_ONs to WARN_ONs Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 137/245] netfilter: ebtables: compat: reject all padding in matches/watchers Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 138/245] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 139/245] mod_devicetable: fix PHY module format Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 140/245] x86/efistub: Disable paging at mixed mode entry Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 141/245] ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 142/245] locks: print unsigned ino in /proc/locks Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 143/245] netfilter: arp_tables: init netns pointer in xt_tgchk_param struct Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 144/245] tty: always relink the port Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 145/245] USB: core: fix check for duplicate endpoints Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 146/245] USB: core: add endpoint-blacklist quirk Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 147/245] USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 148/245] usb: musb: dma: Correct parameter passed to IRQ handler Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 149/245] can: gs_usb: gs_usb_probe(): use descriptors of current altsetting Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 150/245] can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 151/245] tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 152/245] vxlan: fix tos value before xmit Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 153/245] tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 154/245] ftrace: Avoid potential division by zero in function profiler Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 155/245] staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 156/245] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 157/245] kobject: Export kobject_get_unless_zero() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 158/245] chardev: Avoid potential use-after-free in 'chrdev_open()' Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 159/245] sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 160/245] vlan: vlan_changelink() should propagate errors Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 161/245] net: stmmac: dwmac-sunxi: Allow all RGMII modes Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 162/245] pkt_sched: fq: avoid hang when quantum 0 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 163/245] pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 164/245] macvlan: do not assume mac_header is set in macvlan_broadcast() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 165/245] netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 166/245] ixgbevf: Remove limit of 10 entries for unicast filter list Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 167/245] scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 168/245] scsi: enclosure: Fix stale device oops with hot replug Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 169/245] hidraw: Return EPOLLOUT from hidraw_poll Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 170/245] HID: hidraw: Fix returning " Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 171/245] HID: hidraw, uhid: Always report EPOLLOUT Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 172/245] Input: aiptek - fix endpoint sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 173/245] Input: gtco " Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 174/245] Input: sur40 - fix interface sanity checks Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 175/245] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 176/245] iio: buffer: align the size of scan bytes to size of the largest element Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 177/245] USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 178/245] netfilter: fix a use-after-free in mtype_destroy() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 179/245] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 180/245] ALSA: usb-audio: add implicit fb quirk for Axe-Fx II Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 181/245] ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 182/245] ALSA: usb-audio: fix sync-ep altsetting sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 183/245] USB: serial: opticon: fix control-message timeouts Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 184/245] r8152: add missing endpoint sanity check Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 185/245] usb: core: hub: Improved device recognition on remote wakeup Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 186/245] Fix built-in early-load Intel microcode alignment Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 187/245] ALSA: seq: Fix racy access for queue timer in proc read Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 188/245] scsi: fnic: fix invalid stack access Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 189/245] block: fix an integer overflow in logical block size Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 190/245] macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 191/245] Input: keyspan-remote - fix control-message timeouts Ben Hutchings
2020-04-23 23:06 ` [PATCH 3.16 192/245] USB: serial: suppress driver bind attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 193/245] USB: serial: ch341: handle unbound port at reset_resume Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 194/245] USB: serial: io_edgeport: handle unbound ports on URB completion Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 195/245] USB: serial: io_edgeport: add missing active-port sanity check Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 196/245] USB: serial: keyspan: handle unbound ports Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 197/245] USB: serial: quatech2: " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 198/245] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 199/245] ARM: 8950/1: ftrace/recordmcount: filter relocation types Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 200/245] mmc: sdhci: fix minimum clock rate for v3 controller Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 201/245] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 202/245] net: sonic: return NETDEV_TX_OK if failed to map buffer Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 203/245] net/sonic: Add mutual exclusion for accessing shared state Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 204/245] net/sonic: Use MMIO accessors Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 205/245] net/sonic: Fix receive buffer handling Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 206/245] net/sonic: Quiesce SONIC before re-initializing descriptor memory Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 207/245] net_sched: fix datalen for ematch Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 208/245] namei: allow restricted O_CREAT of FIFOs and regular files Ben Hutchings
2020-04-24 13:52 ` Solar Designer
2020-04-24 15:13 ` Ben Hutchings
2020-04-24 17:38 ` Solar Designer
2020-04-23 23:07 ` [PATCH 3.16 209/245] do_last(): fetch directory ->i_mode and ->i_uid before it's too late Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 210/245] vfs: fix do_last() regression Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 211/245] blktrace: re-write setting q->blk_trace Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 212/245] blktrace: Protect q->blk_trace with RCU Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 213/245] blktrace: fix dereference after null check Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 214/245] Input: add safety guards to input_set_keycode() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 215/245] staging: android: ashmem: Disallow ashmem memory from being remapped Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 216/245] net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 217/245] KVM: nVMX: Don't emulate instructions in guest mode Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 218/245] vgacon: Fix a UAF in vgacon_invert_region Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 219/245] tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 220/245] vt: selection, handle pending signals in paste_selection Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 221/245] vt: selection, close sel_buffer race Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 222/245] vt: selection, push console lock down Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 223/245] vt: selection, push sel_lock up Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 224/245] floppy: check FDC index for errors before assigning it Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 225/245] vhost: Check docket sk_family instead of call getname Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 226/245] mm: mempolicy: require at least one nodeid for MPOL_PREFERRED Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 227/245] media: ov519: add missing endpoint sanity checks Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 228/245] media: stv06xx: add missing descriptor " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 229/245] media: xirlink_cit: " Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 230/245] ptp: do not explicitly set drvdata in ptp_clock_register() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 231/245] ptp: use is_visible method to hide unused attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 232/245] ptp: create "pins" together with the rest of attributes Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 233/245] chardev: add helper function to register char devs with a struct device Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 234/245] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 235/245] ptp: fix the race between the release of ptp_clock and cdev Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 236/245] ptp: free ptp device pin descriptors properly Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 237/245] [media] media-devnode: just return 0 instead of using a var Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 238/245] [media] media: Fix media_open() to clear filp->private_data in error leg Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 239/245] [media] drivers/media/media-devnode: clear private_data before put_device() Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 240/245] [media] media-devnode: add missing mutex lock in error handler Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 241/245] [media] media-devnode: fix namespace mess Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 242/245] [media] media-device: dynamically allocate struct media_devnode Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 243/245] [media] media: fix use-after-free in cdev_put() when app exits after driver unbind Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 244/245] [media] media: fix media devnode ioctl/syscall and unregister race Ben Hutchings
2020-04-23 23:07 ` [PATCH 3.16 245/245] slcan: Don't transmit uninitialized stack data in padding Ben Hutchings
2020-04-23 23:59 ` [PATCH 3.16 000/245] 3.16.83-rc1 review Jann Horn
2020-04-24 13:43 ` Ben Hutchings
2020-04-24 14:49 ` Guenter Roeck
2020-04-24 15:13 ` Ben Hutchings
2020-04-24 15:47 ` [PATCH 3.16 000/247] 3.16.83-rc2 review Ben Hutchings
2020-04-24 15:51 ` [PATCH 3.16 246/247] futex: Fix inode life-time issue Ben Hutchings
2020-04-24 15:56 ` Peter Zijlstra
2020-04-24 16:31 ` Ben Hutchings
2020-04-24 15:51 ` [PATCH 3.16 247/247] futex: Unbreak futex hashing Ben Hutchings
2020-04-24 17:48 ` [PATCH 3.16 000/247] 3.16.83-rc2 review Guenter Roeck
2020-04-24 17:54 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1587683028.116145969@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=dsterba@suse.com \
--cc=fdmanana@suse.com \
--cc=josef@toxicpanda.com \
--cc=kda@linux-powerpc.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).