From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Martijn Coenen <maco@android.com>,
syzbot+3ae18325f96190606754@syzkaller.appspotmail.com,
Dan Carpenter <dan.carpenter@oracle.com>,
Todd Kjos <tkjos@google.com>
Subject: [PATCH 5.1 126/138] binder: return errors from buffer copy functions
Date: Fri, 12 Jul 2019 14:19:50 +0200 [thread overview]
Message-ID: <20190712121633.569417329@linuxfoundation.org> (raw)
In-Reply-To: <20190712121628.731888964@linuxfoundation.org>
From: Todd Kjos <tkjos@android.com>
commit bb4a2e48d5100ed3ff614df158a636bca3c6bf9f upstream.
The buffer copy functions assumed the caller would ensure
correct alignment and that the memory to be copied was
completely within the binder buffer. There have been
a few cases discovered by syzkallar where a malformed
transaction created by a user could violated the
assumptions and resulted in a BUG_ON.
The fix is to remove the BUG_ON and always return the
error to be handled appropriately by the caller.
Acked-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com
Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 151 ++++++++++++++++++++++++-----------------
drivers/android/binder_alloc.c | 44 ++++++-----
drivers/android/binder_alloc.h | 20 ++---
3 files changed, 124 insertions(+), 91 deletions(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2068,10 +2068,9 @@ static size_t binder_get_object(struct b
read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
- !IS_ALIGNED(offset, sizeof(u32)))
+ binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
+ offset, read_size))
return 0;
- binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
- offset, read_size);
/* Ok, now see if we read a complete object. */
hdr = &object->hdr;
@@ -2140,8 +2139,10 @@ static struct binder_buffer_object *bind
return NULL;
buffer_offset = start_offset + sizeof(binder_size_t) * index;
- binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
- b, buffer_offset, sizeof(object_offset));
+ if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
+ b, buffer_offset,
+ sizeof(object_offset)))
+ return NULL;
object_size = binder_get_object(proc, b, object_offset, object);
if (!object_size || object->hdr.type != BINDER_TYPE_PTR)
return NULL;
@@ -2221,10 +2222,12 @@ static bool binder_validate_fixup(struct
return false;
last_min_offset = last_bbo->parent_offset + sizeof(uintptr_t);
buffer_offset = objects_start_offset +
- sizeof(binder_size_t) * last_bbo->parent,
- binder_alloc_copy_from_buffer(&proc->alloc, &last_obj_offset,
- b, buffer_offset,
- sizeof(last_obj_offset));
+ sizeof(binder_size_t) * last_bbo->parent;
+ if (binder_alloc_copy_from_buffer(&proc->alloc,
+ &last_obj_offset,
+ b, buffer_offset,
+ sizeof(last_obj_offset)))
+ return false;
}
return (fixup_offset >= last_min_offset);
}
@@ -2310,15 +2313,15 @@ static void binder_transaction_buffer_re
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
buffer_offset += sizeof(binder_size_t)) {
struct binder_object_header *hdr;
- size_t object_size;
+ size_t object_size = 0;
struct binder_object object;
binder_size_t object_offset;
- binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
- buffer, buffer_offset,
- sizeof(object_offset));
- object_size = binder_get_object(proc, buffer,
- object_offset, &object);
+ if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
+ buffer, buffer_offset,
+ sizeof(object_offset)))
+ object_size = binder_get_object(proc, buffer,
+ object_offset, &object);
if (object_size == 0) {
pr_err("transaction release %d bad object at offset %lld, size %zd\n",
debug_id, (u64)object_offset, buffer->data_size);
@@ -2441,15 +2444,16 @@ static void binder_transaction_buffer_re
for (fd_index = 0; fd_index < fda->num_fds;
fd_index++) {
u32 fd;
+ int err;
binder_size_t offset = fda_offset +
fd_index * sizeof(fd);
- binder_alloc_copy_from_buffer(&proc->alloc,
- &fd,
- buffer,
- offset,
- sizeof(fd));
- binder_deferred_fd_close(fd);
+ err = binder_alloc_copy_from_buffer(
+ &proc->alloc, &fd, buffer,
+ offset, sizeof(fd));
+ WARN_ON(err);
+ if (!err)
+ binder_deferred_fd_close(fd);
}
} break;
default:
@@ -2692,11 +2696,12 @@ static int binder_translate_fd_array(str
int ret;
binder_size_t offset = fda_offset + fdi * sizeof(fd);
- binder_alloc_copy_from_buffer(&target_proc->alloc,
- &fd, t->buffer,
- offset, sizeof(fd));
- ret = binder_translate_fd(fd, offset, t, thread,
- in_reply_to);
+ ret = binder_alloc_copy_from_buffer(&target_proc->alloc,
+ &fd, t->buffer,
+ offset, sizeof(fd));
+ if (!ret)
+ ret = binder_translate_fd(fd, offset, t, thread,
+ in_reply_to);
if (ret < 0)
return ret;
}
@@ -2749,8 +2754,12 @@ static int binder_fixup_parent(struct bi
}
buffer_offset = bp->parent_offset +
(uintptr_t)parent->buffer - (uintptr_t)b->user_data;
- binder_alloc_copy_to_buffer(&target_proc->alloc, b, buffer_offset,
- &bp->buffer, sizeof(bp->buffer));
+ if (binder_alloc_copy_to_buffer(&target_proc->alloc, b, buffer_offset,
+ &bp->buffer, sizeof(bp->buffer))) {
+ binder_user_error("%d:%d got transaction with invalid parent offset\n",
+ proc->pid, thread->pid);
+ return -EINVAL;
+ }
return 0;
}
@@ -3160,15 +3169,20 @@ static void binder_transaction(struct bi
goto err_binder_alloc_buf_failed;
}
if (secctx) {
+ int err;
size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
ALIGN(tr->offsets_size, sizeof(void *)) +
ALIGN(extra_buffers_size, sizeof(void *)) -
ALIGN(secctx_sz, sizeof(u64));
t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset;
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, buf_offset,
- secctx, secctx_sz);
+ err = binder_alloc_copy_to_buffer(&target_proc->alloc,
+ t->buffer, buf_offset,
+ secctx, secctx_sz);
+ if (err) {
+ t->security_ctx = 0;
+ WARN_ON(1);
+ }
security_release_secctx(secctx, secctx_sz);
secctx = NULL;
}
@@ -3234,11 +3248,16 @@ static void binder_transaction(struct bi
struct binder_object object;
binder_size_t object_offset;
- binder_alloc_copy_from_buffer(&target_proc->alloc,
- &object_offset,
- t->buffer,
- buffer_offset,
- sizeof(object_offset));
+ if (binder_alloc_copy_from_buffer(&target_proc->alloc,
+ &object_offset,
+ t->buffer,
+ buffer_offset,
+ sizeof(object_offset))) {
+ return_error = BR_FAILED_REPLY;
+ return_error_param = -EINVAL;
+ return_error_line = __LINE__;
+ goto err_bad_offset;
+ }
object_size = binder_get_object(target_proc, t->buffer,
object_offset, &object);
if (object_size == 0 || object_offset < off_min) {
@@ -3262,15 +3281,17 @@ static void binder_transaction(struct bi
fp = to_flat_binder_object(hdr);
ret = binder_translate_binder(fp, t, thread);
- if (ret < 0) {
+
+ if (ret < 0 ||
+ binder_alloc_copy_to_buffer(&target_proc->alloc,
+ t->buffer,
+ object_offset,
+ fp, sizeof(*fp))) {
return_error = BR_FAILED_REPLY;
return_error_param = ret;
return_error_line = __LINE__;
goto err_translate_failed;
}
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, object_offset,
- fp, sizeof(*fp));
} break;
case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE: {
@@ -3278,15 +3299,16 @@ static void binder_transaction(struct bi
fp = to_flat_binder_object(hdr);
ret = binder_translate_handle(fp, t, thread);
- if (ret < 0) {
+ if (ret < 0 ||
+ binder_alloc_copy_to_buffer(&target_proc->alloc,
+ t->buffer,
+ object_offset,
+ fp, sizeof(*fp))) {
return_error = BR_FAILED_REPLY;
return_error_param = ret;
return_error_line = __LINE__;
goto err_translate_failed;
}
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, object_offset,
- fp, sizeof(*fp));
} break;
case BINDER_TYPE_FD: {
@@ -3296,16 +3318,17 @@ static void binder_transaction(struct bi
int ret = binder_translate_fd(fp->fd, fd_offset, t,
thread, in_reply_to);
- if (ret < 0) {
+ fp->pad_binder = 0;
+ if (ret < 0 ||
+ binder_alloc_copy_to_buffer(&target_proc->alloc,
+ t->buffer,
+ object_offset,
+ fp, sizeof(*fp))) {
return_error = BR_FAILED_REPLY;
return_error_param = ret;
return_error_line = __LINE__;
goto err_translate_failed;
}
- fp->pad_binder = 0;
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, object_offset,
- fp, sizeof(*fp));
} break;
case BINDER_TYPE_FDA: {
struct binder_object ptr_object;
@@ -3393,15 +3416,16 @@ static void binder_transaction(struct bi
num_valid,
last_fixup_obj_off,
last_fixup_min_off);
- if (ret < 0) {
+ if (ret < 0 ||
+ binder_alloc_copy_to_buffer(&target_proc->alloc,
+ t->buffer,
+ object_offset,
+ bp, sizeof(*bp))) {
return_error = BR_FAILED_REPLY;
return_error_param = ret;
return_error_line = __LINE__;
goto err_translate_failed;
}
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, object_offset,
- bp, sizeof(*bp));
last_fixup_obj_off = object_offset;
last_fixup_min_off = 0;
} break;
@@ -4139,20 +4163,27 @@ static int binder_apply_fd_fixups(struct
trace_binder_transaction_fd_recv(t, fd, fixup->offset);
fd_install(fd, fixup->file);
fixup->file = NULL;
- binder_alloc_copy_to_buffer(&proc->alloc, t->buffer,
- fixup->offset, &fd,
- sizeof(u32));
+ if (binder_alloc_copy_to_buffer(&proc->alloc, t->buffer,
+ fixup->offset, &fd,
+ sizeof(u32))) {
+ ret = -EINVAL;
+ break;
+ }
}
list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
if (fixup->file) {
fput(fixup->file);
} else if (ret) {
u32 fd;
+ int err;
- binder_alloc_copy_from_buffer(&proc->alloc, &fd,
- t->buffer, fixup->offset,
- sizeof(fd));
- binder_deferred_fd_close(fd);
+ err = binder_alloc_copy_from_buffer(&proc->alloc, &fd,
+ t->buffer,
+ fixup->offset,
+ sizeof(fd));
+ WARN_ON(err);
+ if (!err)
+ binder_deferred_fd_close(fd);
}
list_del(&fixup->fixup_entry);
kfree(fixup);
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -1128,15 +1128,16 @@ binder_alloc_copy_user_to_buffer(struct
return 0;
}
-static void binder_alloc_do_buffer_copy(struct binder_alloc *alloc,
- bool to_buffer,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- void *ptr,
- size_t bytes)
+static int binder_alloc_do_buffer_copy(struct binder_alloc *alloc,
+ bool to_buffer,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ void *ptr,
+ size_t bytes)
{
/* All copies must be 32-bit aligned and 32-bit size */
- BUG_ON(!check_buffer(alloc, buffer, buffer_offset, bytes));
+ if (!check_buffer(alloc, buffer, buffer_offset, bytes))
+ return -EINVAL;
while (bytes) {
unsigned long size;
@@ -1164,25 +1165,26 @@ static void binder_alloc_do_buffer_copy(
ptr = ptr + size;
buffer_offset += size;
}
+ return 0;
}
-void binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- void *src,
- size_t bytes)
+int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ void *src,
+ size_t bytes)
{
- binder_alloc_do_buffer_copy(alloc, true, buffer, buffer_offset,
- src, bytes);
+ return binder_alloc_do_buffer_copy(alloc, true, buffer, buffer_offset,
+ src, bytes);
}
-void binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
- void *dest,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- size_t bytes)
+int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
+ void *dest,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ size_t bytes)
{
- binder_alloc_do_buffer_copy(alloc, false, buffer, buffer_offset,
- dest, bytes);
+ return binder_alloc_do_buffer_copy(alloc, false, buffer, buffer_offset,
+ dest, bytes);
}
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -168,17 +168,17 @@ binder_alloc_copy_user_to_buffer(struct
const void __user *from,
size_t bytes);
-void binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- void *src,
- size_t bytes);
+int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ void *src,
+ size_t bytes);
-void binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
- void *dest,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- size_t bytes);
+int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
+ void *dest,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ size_t bytes);
#endif /* _LINUX_BINDER_ALLOC_H */
next prev parent reply other threads:[~2019-07-12 12:31 UTC|newest]
Thread overview: 156+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-12 12:17 [PATCH 5.1 000/138] 5.1.18-stable review Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 001/138] crypto: talitos - fix hash on SEC1 Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 002/138] crypto: lrw - use correct alignmask Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 003/138] crypto: talitos - rename alternative AEAD algos Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 004/138] ARM: dts: dra76x: Disable rtc target module Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 005/138] ARM: dts: dra76x: Disable usb4_tm " Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 006/138] ARM: dts: dra71x: Disable rtc " Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 007/138] ARM: dts: dra71x: Disable usb4_tm " Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 008/138] soc: brcmstb: Fix error path for unsupported CPUs Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 009/138] soc: bcm: brcmstb: biuctrl: Register writes require a barrier Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 010/138] Input: elantech - enable middle button support on 2 ThinkPads Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 011/138] samples, bpf: fix to change the buffer size for read() Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 012/138] samples, bpf: suppress compiler warning Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 013/138] bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32 Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 014/138] bpf: sockmap, restore sk_write_space when psock gets dropped Greg Kroah-Hartman
2019-07-12 12:17 ` [PATCH 5.1 015/138] mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he() Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 016/138] bpf: sockmap, fix use after free from sleep in psock backlog workqueue Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 017/138] soundwire: stream: fix out of boundary access on port properties Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 018/138] staging:iio:ad7150: fix threshold mode config bit Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 019/138] mac80211: mesh: fix RCU warning Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 020/138] mac80211: free peer keys before vif down in mesh Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 021/138] ARM: dts: Drop bogus CLKSEL for timer12 on dra7 Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 022/138] mwifiex: Fix possible buffer overflows at parsing bss descriptor Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 023/138] bpf, riscv: clear high 32 bits for ALU32 add/sub/neg/lsh/rsh/arsh Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 024/138] iwlwifi: fix load in rfkill flow for unified firmware Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 025/138] iwlwifi: clear persistence bit according to device family Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 026/138] iwlwifi: fix AX201 killer sku loading firmware issue Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 027/138] iwlwifi: Fix double-free problems in iwl_req_fw_callback() Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 028/138] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 029/138] netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 030/138] tools: bpftool: Fix JSON output when lookup fails Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 031/138] soundwire: stream: fix bad unlock balance Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 032/138] soundwire: intel: set dai min and max channels correctly Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 033/138] netfilter: ipv6: nf_defrag: accept duplicate fragments again Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 034/138] dt-bindings: can: mcp251x: add mcp25625 support Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 035/138] can: mcp251x: add support for mcp25625 Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 036/138] can: m_can: implement errata "Needless activation of MRAF irq" Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 037/138] can: af_can: Fix error path of can_init() Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 038/138] can: flexcan: Remove unneeded registration message Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 039/138] net: phy: rename Asix Electronics PHY driver Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 040/138] ibmvnic: Do not close unopened driver during reset Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 041/138] ibmvnic: Refresh device multicast list after reset Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 042/138] ibmvnic: Fix unchecked return codes of memory allocations Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 043/138] ARM: dts: am335x phytec boards: Fix cd-gpios active level Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 044/138] s390/boot: disable address-of-packed-member warning Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 045/138] RISC-V: defconfig: enable clocks, serial console Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 046/138] drm/vmwgfx: Honor the sg list segment size limitation Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 047/138] drm/vmwgfx: fix a warning due to missing dma_parms Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 048/138] riscv: Fix udelay in RV32 Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 049/138] Input: imx_keypad - make sure keyboard can always wake up system Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 050/138] xdp: check device pointer before clearing Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 051/138] KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 052/138] mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 053/138] KVM: nVMX: use correct clean fields when copying from eVMCS Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 054/138] bpf: fix div64 overflow tests to properly detect errors Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 055/138] ARM: davinci: da850-evm: call regulator_has_full_constraints() Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 056/138] ARM: davinci: da8xx: specify dma_coherent_mask for lcdc Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 057/138] gpu: ipu-v3: image-convert: Fix input bytesperline width/height align Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 058/138] gpu: ipu-v3: image-convert: Fix input bytesperline for packed formats Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 059/138] gpu: ipu-v3: image-convert: Fix image downsize coefficients Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 060/138] mac80211: only warn once on chanctx_conf being NULL Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 061/138] mac80211: do not start any work during reconfigure flow Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 062/138] cfg80211: util: fix bit count off by one Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 063/138] cfg80211: report measurement start TSF correctly Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 064/138] bpf, devmap: Fix premature entry free on destroying map Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 065/138] bpf, devmap: Add missing bulk queue free Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 066/138] bpf, devmap: Add missing RCU read lock on flush Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 067/138] bpf, x64: fix stack layout of JITed bpf code Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 068/138] qmi_wwan: add support for QMAP padding in the RX path Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 069/138] qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 070/138] qmi_wwan: extend permitted QMAP mux_id value range Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 071/138] mmc: core: complete HS400 before checking status Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 072/138] IB/hfi1: Create inline to get extended headers Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 073/138] IB/hfi1: Use aborts to trigger RC throttling Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 074/138] IB/hfi1: Wakeup QPs orphaned on wait list after flush Greg Kroah-Hartman
2019-07-12 12:18 ` [PATCH 5.1 075/138] IB/hfi1: Handle wakeup of orphaned QPs for pio Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 076/138] IB/hfi1: Handle port down properly in pio Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 077/138] md: fix for divide error in status_resync Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 078/138] bnx2x: Check if transceiver implements DDM before access Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 079/138] drm: return -EFAULT if copy_to_user() fails Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 080/138] ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 081/138] net: lio_core: fix potential sign-extension overflow on large shift Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 082/138] scsi: qedi: Check targetname while finding boot target information Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 083/138] powerpc: enable a 30-bit ZONE_DMA for 32-bit pmac Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 084/138] quota: fix a problem about transfer quota Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 085/138] net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 086/138] KVM: arm/arm64: Fix emulated ptimer irq injection Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 087/138] NFS4: Only set creation opendata if O_CREAT Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 088/138] fscrypt: dont set policy for a dead directory Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 089/138] udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 090/138] media: stv0297: fix frequency range limit Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 091/138] ALSA: usb-audio: Fix parse of UAC2 Extension Units Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 092/138] ALSA: hda/realtek - Headphone Mic cant record after S3 Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 093/138] tpm: Actually fail on TPM errors during "get random" Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 094/138] tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 095/138] block, bfq: NULL out the bic when its no longer valid Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 096/138] perf intel-pt: Fix itrace defaults for perf script Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 097/138] perf auxtrace: " Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 098/138] perf intel-pt: Fix itrace defaults for perf script intel-pt documentation Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 099/138] perf pmu: Fix uncore PMU alias list for ARM64 Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 100/138] perf thread-stack: Fix thread stack return from kernel for kernel-only case Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 101/138] perf header: Assign proper ff->ph in perf_event__synthesize_features() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 102/138] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 103/138] x86/tls: Fix possible spectre-v1 in do_get_thread_area() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 104/138] Documentation: Add section about CPU vulnerabilities for Spectre Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 105/138] Documentation/admin: Remove the vsyscall=native documentation Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 106/138] mwifiex: Abort at too short BSS descriptor element Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 107/138] mwifiex: Dont abort on small, spec-compliant vendor IEs Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 108/138] USB: serial: ftdi_sio: add ID for isodebug v1 Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 109/138] USB: serial: option: add support for GosunCn ME3630 RNDIS mode Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 110/138] Revert "serial: 8250: Dont service RX FIFO if interrupts are disabled" Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 111/138] p54usb: Fix race between disconnect and firmware loading Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 112/138] usb: gadget: f_fs: data_len used before properly set Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 113/138] usb: gadget: ether: Fix race between gether_disconnect and rx_submit Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 114/138] usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 115/138] usb: renesas_usbhs: add a workaround for a race condition of workqueue Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 116/138] drivers/usb/typec/tps6598x.c: fix portinfo width Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 117/138] drivers/usb/typec/tps6598x.c: fix 4CC cmd write Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 118/138] p54: fix crash during initialization Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 119/138] staging: comedi: dt282x: fix a null pointer deref on interrupt Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 120/138] staging: wilc1000: fix error path cleanup in wilc_wlan_initialize() Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 121/138] staging: comedi: amplc_pci230: fix null pointer deref on interrupt Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 122/138] staging: mt7621-pci: fix PCIE_FTS_NUM_LO macro Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 123/138] HID: Add another Primax PIXART OEM mouse quirk Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 124/138] lkdtm: support llvm-objcopy Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 125/138] binder: fix memory leak in error path Greg Kroah-Hartman
2019-07-12 12:19 ` Greg Kroah-Hartman [this message]
2019-07-12 12:19 ` [PATCH 5.1 127/138] iio: adc: stm32-adc: add missing vdda-supply Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 128/138] carl9170: fix misuse of device driver API Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 129/138] VMCI: Fix integer overflow in VMCI handle arrays Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 130/138] staging: vchiq_2835_arm: revert "quit using custom down_interruptible()" Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 131/138] staging: vchiq: revert "switch to wait_for_completion_killable" Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 132/138] staging: vchiq: make wait events interruptible Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 133/138] staging: fsl-dpaa2/ethsw: fix memory leak of switchdev_work Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 134/138] staging: bcm2835-camera: Replace spinlock protecting context_map with mutex Greg Kroah-Hartman
2019-07-12 12:19 ` [PATCH 5.1 135/138] staging: bcm2835-camera: Ensure all buffers are returned on disable Greg Kroah-Hartman
2019-07-12 12:20 ` [PATCH 5.1 136/138] staging: bcm2835-camera: Remove check of the number of buffers supplied Greg Kroah-Hartman
2019-07-12 12:20 ` [PATCH 5.1 137/138] staging: bcm2835-camera: Handle empty EOS buffers whilst streaming Greg Kroah-Hartman
2019-07-12 12:20 ` [PATCH 5.1 138/138] staging: rtl8712: reduce stack usage, again Greg Kroah-Hartman
2019-07-12 13:26 ` [PATCH 5.1 000/138] 5.1.18-stable review Jon Hunter
2019-07-12 15:30 ` Greg Kroah-Hartman
2019-07-12 20:21 ` Guenter Roeck
2019-07-13 8:22 ` Greg Kroah-Hartman
2019-07-13 13:16 ` Guenter Roeck
2019-07-13 14:25 ` Greg Kroah-Hartman
2019-07-13 9:16 ` Jon Hunter
2019-07-13 14:31 ` Greg Kroah-Hartman
2019-07-13 18:56 ` Jon Hunter
2019-07-14 6:01 ` Greg Kroah-Hartman
2019-07-12 22:05 ` shuah
2019-07-13 1:46 ` Jiunn Chang
2019-07-13 15:22 ` Greg Kroah-Hartman
2019-07-13 3:03 ` Naresh Kamboju
2019-07-13 20:42 ` Luke Nowakowski-Krijger
2019-07-13 22:03 ` Guenter Roeck
2019-07-14 5:36 ` Kelsey Skunberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190712121633.569417329@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+3ae18325f96190606754@syzkaller.appspotmail.com \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).