linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andrea Arcangeli <aarcange@redhat.com>,
	Mark Rutland <mark.rutland@arm.com>,
	Pavel Emelyanov <xemul@virtuozzo.com>,
	Mike Rapoport <rppt@linux.vnet.ibm.com>,
	"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
	Mike Kravetz <mike.kravetz@oracle.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.13 102/160] userfaultfd: non-cooperative: fix fork use after free
Date: Tue, 10 Oct 2017 21:50:30 +0200	[thread overview]
Message-ID: <20171010190552.780951490@linuxfoundation.org> (raw)
In-Reply-To: <20171010190548.690912997@linuxfoundation.org>

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrea Arcangeli <aarcange@redhat.com>

commit 384632e67e0829deb8015ee6ad916b180049d252 upstream.

When reading the event from the uffd, we put it on a temporary
fork_event list to detect if we can still access it after releasing and
retaking the event_wqh.lock.

If fork aborts and removes the event from the fork_event all is fine as
long as we're still in the userfault read context and fork_event head is
still alive.

We've to put the event allocated in the fork kernel stack, back from
fork_event list-head to the event_wqh head, before returning from
userfaultfd_ctx_read, because the fork_event head lifetime is limited to
the userfaultfd_ctx_read stack lifetime.

Forgetting to move the event back to its event_wqh place then results in
__remove_wait_queue(&ctx->event_wqh, &ewq->wq); in
userfaultfd_event_wait_completion to remove it from a head that has been
already freed from the reader stack.

This could only happen if resolve_userfault_fork failed (for example if
there are no file descriptors available to allocate the fork uffd).  If
it succeeded it was put back correctly.

Furthermore, after find_userfault_evt receives a fork event, the forked
userfault context in fork_nctx and uwq->msg.arg.reserved.reserved1 can
be released by the fork thread as soon as the event_wqh.lock is
released.  Taking a reference on the fork_nctx before dropping the lock
prevents an use after free in resolve_userfault_fork().

If the fork side aborted and it already released everything, we still
try to succeed resolve_userfault_fork(), if possible.

Fixes: 893e26e61d04eac9 ("userfaultfd: non-cooperative: Add fork() event")
Link: http://lkml.kernel.org/r/20170920180413.26713-1-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Cc: Pavel Emelyanov <xemul@virtuozzo.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/userfaultfd.c |   66 ++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 56 insertions(+), 10 deletions(-)

--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -566,6 +566,12 @@ static void userfaultfd_event_wait_compl
 			break;
 		if (ACCESS_ONCE(ctx->released) ||
 		    fatal_signal_pending(current)) {
+			/*
+			 * &ewq->wq may be queued in fork_event, but
+			 * __remove_wait_queue ignores the head
+			 * parameter. It would be a problem if it
+			 * didn't.
+			 */
 			__remove_wait_queue(&ctx->event_wqh, &ewq->wq);
 			if (ewq->msg.event == UFFD_EVENT_FORK) {
 				struct userfaultfd_ctx *new;
@@ -1039,6 +1045,12 @@ static ssize_t userfaultfd_ctx_read(stru
 					(unsigned long)
 					uwq->msg.arg.reserved.reserved1;
 				list_move(&uwq->wq.entry, &fork_event);
+				/*
+				 * fork_nctx can be freed as soon as
+				 * we drop the lock, unless we take a
+				 * reference on it.
+				 */
+				userfaultfd_ctx_get(fork_nctx);
 				spin_unlock(&ctx->event_wqh.lock);
 				ret = 0;
 				break;
@@ -1069,19 +1081,53 @@ static ssize_t userfaultfd_ctx_read(stru
 
 	if (!ret && msg->event == UFFD_EVENT_FORK) {
 		ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+		spin_lock(&ctx->event_wqh.lock);
+		if (!list_empty(&fork_event)) {
+			/*
+			 * The fork thread didn't abort, so we can
+			 * drop the temporary refcount.
+			 */
+			userfaultfd_ctx_put(fork_nctx);
+
+			uwq = list_first_entry(&fork_event,
+					       typeof(*uwq),
+					       wq.entry);
+			/*
+			 * If fork_event list wasn't empty and in turn
+			 * the event wasn't already released by fork
+			 * (the event is allocated on fork kernel
+			 * stack), put the event back to its place in
+			 * the event_wq. fork_event head will be freed
+			 * as soon as we return so the event cannot
+			 * stay queued there no matter the current
+			 * "ret" value.
+			 */
+			list_del(&uwq->wq.entry);
+			__add_wait_queue(&ctx->event_wqh, &uwq->wq);
 
-		if (!ret) {
-			spin_lock(&ctx->event_wqh.lock);
-			if (!list_empty(&fork_event)) {
-				uwq = list_first_entry(&fork_event,
-						       typeof(*uwq),
-						       wq.entry);
-				list_del(&uwq->wq.entry);
-				__add_wait_queue(&ctx->event_wqh, &uwq->wq);
+			/*
+			 * Leave the event in the waitqueue and report
+			 * error to userland if we failed to resolve
+			 * the userfault fork.
+			 */
+			if (likely(!ret))
 				userfaultfd_event_complete(ctx, uwq);
-			}
-			spin_unlock(&ctx->event_wqh.lock);
+		} else {
+			/*
+			 * Here the fork thread aborted and the
+			 * refcount from the fork thread on fork_nctx
+			 * has already been released. We still hold
+			 * the reference we took before releasing the
+			 * lock above. If resolve_userfault_fork
+			 * failed we've to drop it because the
+			 * fork_nctx has to be freed in such case. If
+			 * it succeeded we'll hold it because the new
+			 * uffd references it.
+			 */
+			if (ret)
+				userfaultfd_ctx_put(fork_nctx);
 		}
+		spin_unlock(&ctx->event_wqh.lock);
 	}
 
 	return ret;

  parent reply	other threads:[~2017-10-10 20:04 UTC|newest]

Thread overview: 160+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-10 19:48 [PATCH 4.13 000/160] 4.13.6-stable review Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 001/160] [media] imx-media-of: avoid uninitialized variable warning Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 002/160] usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0 Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 003/160] mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+ Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 004/160] net: bonding: Fix transmit load balancing in balance-alb mode if specified by sysfs Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 005/160] openvswitch: Fix an error handling path in ovs_nla_init_match_and_action() Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 006/160] mlxsw: spectrum: Prevent mirred-related crash on removal Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 007/160] net: bonding: fix tlb_dynamic_lb default value Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 008/160] net_sched: gen_estimator: fix scaling error in bytes/packets samples Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 009/160] net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 010/160] sctp: potential read out of bounds in sctp_ulpevent_type_enabled() Greg Kroah-Hartman
2017-10-10 19:48 ` [PATCH 4.13 011/160] tcp: update skb->skb_mstamp more carefully Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 012/160] bpf/verifier: reject BPF_ALU64|BPF_END Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 013/160] tcp: fix data delivery rate Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 014/160] udpv6: Fix the checksum computation when HW checksum does not apply Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 015/160] ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 016/160] net: phy: Fix mask value write on gmii2rgmii converter speed register Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 017/160] ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 018/160] net/sched: cls_matchall: fix crash when used with classful qdisc Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 020/160] bpf: do not disable/enable BH in bpf_map_free_id() Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 021/160] tcp: fastopen: fix on syn-data transmit failure Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 022/160] net: emac: Fix napi poll list corruption Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 023/160] net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 024/160] packet: hold bind lock when rebinding to fanout hook Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 025/160] bpf: one perf event close wont free bpf program attached by another perf event Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 026/160] net: change skb->mac_header when Generic XDP calls adjust_head Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 027/160] isdn/i4l: fetch the ppp_write buffer in one shot Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 028/160] net_sched: always reset qdisc backlog in qdisc_reset() Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 029/160] net: stmmac: Cocci spatch "of_table" Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 030/160] net: qcom/emac: specify the correct size when mapping a DMA buffer Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 031/160] vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 032/160] l2tp: fix race condition in l2tp_tunnel_delete Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 033/160] tun: bail out from tun_get_user() if the skb is empty Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 034/160] net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 035/160] net: dsa: Fix network device registration order Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 036/160] packet: in packet_do_bind, test fanout with bind_lock held Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 037/160] packet: only test po->has_vnet_hdr once in packet_snd Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 038/160] net: dsa: mv88e6xxx: lock mutex when freeing IRQs Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 039/160] net: Set sk_prot_creator when cloning sockets to the right proto Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 040/160] net/mlx5e: IPoIB, Fix access to invalid memory address Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 041/160] netlink: do not proceed if dumps start() errs Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 042/160] ip6_gre: ip6gre_tap device should keep dst Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 043/160] ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 044/160] IPv4: early demux can return an error code Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 045/160] tipc: use only positive error codes in messages Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 046/160] l2tp: fix l2tp_eth module loading Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 047/160] socket, bpf: fix possible use after free Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 048/160] net: rtnetlink: fix info leak in RTM_GETSTATS call Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 049/160] bpf: fix bpf_tail_call() x64 JIT Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 050/160] usb: gadget: core: fix ->udc_set_speed() logic Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 051/160] USB: gadgetfs: Fix crash caused by inadequate synchronization Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 052/160] USB: gadgetfs: fix copy_to_user while holding spinlock Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 053/160] usb: gadget: udc: atmel: set vbus irqflags explicitly Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 054/160] usb: gadget: udc: renesas_usb3: fix for no-data control transfer Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 055/160] usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 056/160] usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe() Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 057/160] usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 058/160] usb-storage: fix bogus hardware error messages for ATA pass-thru devices Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 059/160] usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 060/160] usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 061/160] ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 062/160] usb: pci-quirks.c: Corrected timeout values used in handshake Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 064/160] USB: dummy-hcd: fix connection failures (wrong speed) Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 065/160] USB: dummy-hcd: fix infinite-loop resubmission bug Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 066/160] USB: dummy-hcd: Fix erroneous synchronization change Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 067/160] USB: devio: Prevent integer overflow in proc_do_submiturb() Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 068/160] USB: devio: Dont corrupt user memory Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 069/160] USB: g_mass_storage: Fix deadlock when driver is unbound Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 070/160] USB: uas: fix bug in handling of alternate settings Greg Kroah-Hartman
2017-10-10 19:49 ` [PATCH 4.13 071/160] USB: core: harden cdc_parse_cdc_header Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 072/160] usb: Increase quirk delay for USB devices Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 073/160] USB: fix out-of-bounds in usb_set_configuration Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 074/160] usb: xhci: Free the right ring in xhci_add_endpoint() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 075/160] xhci: fix finding correct bus_state structure for USB 3.1 hosts Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 076/160] xhci: fix wrong endpoint ESIT value shown in tracing Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 077/160] usb: host: xhci-plat: allow sysdev to inherit from ACPI Greg Kroah-Hartman
     [not found]   ` <CAKrQpStfip1YroPqVsc+d4hUjoLKAsnd3ob5YPGaUnBg4pVXbw@mail.gmail.com>
2017-10-11  7:41     ` Mathias Nyman
2017-10-11 11:53     ` Greg Kroah-Hartman
2017-10-11 14:43       ` Adam Wallis
2017-10-10 19:50 ` [PATCH 4.13 078/160] xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 079/160] xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 080/160] Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts" Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 081/160] iio: adc: twl4030: Fix an error handling path in twl4030_madc_probe() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 082/160] iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of twl4030_madc_probe() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 083/160] iio: ad_sigma_delta: Implement a dedicated reset function Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 084/160] staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 085/160] iio: core: Return error for failed read_reg Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 086/160] IIO: BME280: Updates to Humidity readings need ctrl_reg write! Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 087/160] iio: trigger: stm32-timer: preset shouldnt be buffered Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 088/160] iio: trigger: stm32-timer: fix a corner case to write preset Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 089/160] iio: ad7793: Fix the serial interface reset Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 090/160] iio: adc: stm32: fix bad error check on max_channels Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 091/160] iio: adc: mcp320x: Fix readout of negative voltages Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 092/160] iio: adc: mcp320x: Fix oops on module unload Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 093/160] uwb: properly check kthread_run return value Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 094/160] uwb: ensure that endpoint is interrupt Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 095/160] staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 096/160] ksm: fix unlocked iteration over vmas in cmp_and_merge_page() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 097/160] mm, hugetlb, soft_offline: save compound page order before page migration Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 098/160] mm, oom_reaper: skip mm structs with mmu notifiers Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 099/160] mm: fix RODATA_TEST failure "rodata_test: test data was not read only" Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 100/160] mm: avoid marking swap cached page as lazyfree Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 101/160] mm: fix data corruption caused by lazyfree page Greg Kroah-Hartman
2017-10-10 19:50 ` Greg Kroah-Hartman [this message]
2017-10-10 19:50 ` [PATCH 4.13 103/160] lib/ratelimit.c: use deferred printk() version Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 104/160] lsm: fix smack_inode_removexattr and xattr_getsecurity memleak Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 105/160] ALSA: compress: Remove unused variable Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 106/160] Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members" Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 107/160] ALSA: usx2y: Suppress kernel warning at page allocation failures Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 108/160] powerpc/powernv: Increase memory block size to 1GB on radix Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 109/160] powerpc: Fix action argument for cpufeatures-based TLB flush Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 110/160] powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 111/160] powerpc/tm: Fix illegal TM state in signal handler Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 112/160] percpu: make this_cpu_generic_read() atomic w.r.t. interrupts Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 113/160] intel_th: pci: Add Lewisburg PCH support Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 114/160] driver core: platform: Dont read past the end of "driver_override" buffer Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 115/160] cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 116/160] Drivers: hv: fcopy: restore correct transfer length Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 117/160] vmbus: dont acquire the mutex in vmbus_hvsock_device_unregister() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 118/160] stm class: Fix a use-after-free Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 119/160] auxdisplay: charlcd: properly restore atomic counter on error path Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 120/160] ftrace: Fix kmemleak in unregister_ftrace_graph Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 121/160] ovl: fix error value printed in ovl_lookup_index() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 122/160] ovl: fix dput() of ERR_PTR in ovl_cleanup_index() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 123/160] ovl: fix dentry leak in ovl_indexdir_cleanup() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 124/160] ovl: fix missing unlock_rename() in ovl_do_copy_up() Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 125/160] ovl: fix regression caused by exclusive upper/work dir protection Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 126/160] arm64: dt marvell: Fix AP806 system controller size Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 127/160] arm64: Ensure the instruction emulation is ready for userspace Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 128/160] HID: rmi: Make sure the HID device is opened on resume Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 129/160] HID: i2c-hid: allocate hid buffers for real worst case Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 130/160] HID: wacom: leds: Dont try to control the EKRs read-only LEDs Greg Kroah-Hartman
2017-10-10 19:50 ` [PATCH 4.13 131/160] HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 132/160] HID: wacom: Correct coordinate system of touchring and pen twist Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 133/160] HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 134/160] HID: wacom: generic: Clear ABS_MISC when tool leaves proximity Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 135/160] HID: wacom: Always increment hdev refcount within wacom_get_hdev_data Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 136/160] HID: wacom: bits shifted too much for 9th and 10th buttons Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 137/160] btrfs: avoid overflow when sector_t is 32 bit Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 138/160] Btrfs: fix overlap of fs_info::flags values Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 139/160] rocker: fix rocker_tlv_put_* functions for KASAN Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 140/160] netlink: fix nla_put_{u8,u16,u32} " Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 141/160] dm crypt: reject sector_size feature if device length is not aligned to it Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 142/160] dm ioctl: fix alignment of event number in the device list Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 143/160] dm crypt: fix memory leak in crypt_ctr_cipher_old() Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 146/160] iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 147/160] scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 148/160] scsi: sd: Do not override max_sectors_kb sysfs setting Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 149/160] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 150/160] brcmfmac: setup passive scan if requested by user-space Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 153/160] bsg-lib: fix use-after-free under memory-pressure Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 154/160] nvme-pci: Use PCI bus address for data/queues in CMB Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 155/160] mmc: core: add driver strength selection when selecting hs400es Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 156/160] nl80211: Define policy for packet pattern attributes Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 157/160] clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 158/160] udp: perform source validation for mcast early demux Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 159/160] udp: fix bcast packet reception Greg Kroah-Hartman
2017-10-10 19:51 ` [PATCH 4.13 160/160] base: arch_topology: fix section mismatch build warnings Greg Kroah-Hartman
2017-10-11 13:19 ` [PATCH 4.13 000/160] 4.13.6-stable review Guenter Roeck
2017-10-11 14:07   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171010190552.780951490@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=aarcange@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=dgilbert@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=mike.kravetz@oracle.com \
    --cc=rppt@linux.vnet.ibm.com \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=xemul@virtuozzo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).