Stable Archive on lore.kernel.org
 help / color / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Christian Brauner <christian.brauner@ubuntu.com>,
	Todd Kjos <tkjos@google.com>
Subject: [PATCH 5.5 060/189] binder: prevent UAF for binderfs devices II
Date: Tue, 10 Mar 2020 13:38:17 +0100
Message-ID: <20200310123645.668752851@linuxfoundation.org> (raw)
In-Reply-To: <20200310123639.608886314@linuxfoundation.org>

From: Christian Brauner <christian.brauner@ubuntu.com>

commit f0fe2c0f050d31babcad7d65f1d550d462a40064 upstream.

This is a necessary follow up to the first fix I proposed and we merged
in 2669b8b0c79 ("binder: prevent UAF for binderfs devices"). I have been
overly optimistic that the simple fix I proposed would work. But alas,
ihold() + iput() won't work since the inodes won't survive the
destruction of the superblock.
So all we get with my prior fix is a different race with a tinier
race-window but it doesn't solve the issue. Fwiw, the problem lies with
generic_shutdown_super(). It even has this cozy Al-style comment:

          if (!list_empty(&sb->s_inodes)) {
                  printk("VFS: Busy inodes after unmount of %s. "
                     "Self-destruct in 5 seconds.  Have a nice day...\n",
                     sb->s_id);
          }

On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is
called which punts the actual cleanup operation to a workqueue. At some
point, binder_deferred_func() will be called which will end up calling
binder_deferred_release() which will retrieve and cleanup the
binder_context attach to this struct binder_proc.

If we trace back where this binder_context is attached to binder_proc we
see that it is set in binder_open() and is taken from the struct
binder_device it is associated with. This obviously assumes that the
struct binder_device that context is attached to is _never_ freed. While
that might be true for devtmpfs binder devices it is most certainly
wrong for binderfs binder devices.

So, assume binder_open() is called on a binderfs binder devices. We now
stash away the struct binder_context associated with that struct
binder_devices:
	proc->context = &binder_dev->context;
	/* binderfs stashes devices in i_private */
	if (is_binderfs_device(nodp)) {
		binder_dev = nodp->i_private;
		info = nodp->i_sb->s_fs_info;
		binder_binderfs_dir_entry_proc = info->proc_log_dir;
	} else {
	.
	.
	.
	proc->context = &binder_dev->context;

Now let's assume that the binderfs instance for that binder devices is
shutdown via umount() and/or the mount namespace associated with it goes
away. As long as there is still an fd open for that binderfs binder
device things are fine. But let's assume we now close the last fd for
that binderfs binder device. Now binder_release() is called and punts to
the workqueue. Assume that the workqueue has quite a bit of stuff to do
and doesn't get to cleaning up the struct binder_proc and the associated
struct binder_context with it for that binderfs binder device right
away. In the meantime, the VFS is killing the super block and is
ultimately calling sb->evict_inode() which means it will call
binderfs_evict_inode() which does:

static void binderfs_evict_inode(struct inode *inode)
{
	struct binder_device *device = inode->i_private;
	struct binderfs_info *info = BINDERFS_I(inode);

	clear_inode(inode);

	if (!S_ISCHR(inode->i_mode) || !device)
		return;

	mutex_lock(&binderfs_minors_mutex);
	--info->device_count;
	ida_free(&binderfs_minors, device->miscdev.minor);
	mutex_unlock(&binderfs_minors_mutex);

	kfree(device->context.name);
	kfree(device);
}

thereby freeing the struct binder_device including struct
binder_context.

Now the workqueue finally has time to get around to cleaning up struct
binder_proc and is now trying to access the associate struct
binder_context. Since it's already freed it will OOPs.

Fix this by introducing a refounct on binder devices.

This is an alternative fix to 51d8a7eca677 ("binder: prevent UAF read in
print_binder_transaction_log_entry()").

Fixes: 3ad20fe393b3 ("binder: implement binderfs")
Fixes: 2669b8b0c798 ("binder: prevent UAF for binderfs devices")
Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs")
Related : 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200303164340.670054-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/android/binder.c          |   12 +++++++++---
 drivers/android/binder_internal.h |   15 ++-------------
 drivers/android/binderfs.c        |    7 +++++--
 3 files changed, 16 insertions(+), 18 deletions(-)

--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5219,13 +5219,14 @@ static int binder_open(struct inode *nod
 	proc->default_priority = task_nice(current);
 	/* binderfs stashes devices in i_private */
 	if (is_binderfs_device(nodp)) {
-		binder_dev = binderfs_device_get(nodp->i_private);
+		binder_dev = nodp->i_private;
 		info = nodp->i_sb->s_fs_info;
 		binder_binderfs_dir_entry_proc = info->proc_log_dir;
 	} else {
 		binder_dev = container_of(filp->private_data,
 					  struct binder_device, miscdev);
 	}
+	refcount_inc(&binder_dev->ref);
 	proc->context = &binder_dev->context;
 	binder_alloc_init(&proc->alloc);
 
@@ -5420,6 +5421,12 @@ static void binder_deferred_release(stru
 		context->binder_context_mgr_node = NULL;
 	}
 	mutex_unlock(&context->context_mgr_node_lock);
+	device = container_of(proc->context, struct binder_device, context);
+	if (refcount_dec_and_test(&device->ref)) {
+		kfree(context->name);
+		kfree(device);
+	}
+	proc->context = NULL;
 	binder_inner_proc_lock(proc);
 	/*
 	 * Make sure proc stays alive after we
@@ -5483,8 +5490,6 @@ static void binder_deferred_release(stru
 		     outgoing_refs, active_transactions);
 
 	binder_proc_dec_tmpref(proc);
-	device = container_of(proc->context, struct binder_device, context);
-	binderfs_device_put(device);
 }
 
 static void binder_deferred_func(struct work_struct *work)
@@ -6078,6 +6083,7 @@ static int __init init_binder_device(con
 	binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
 	binder_device->miscdev.name = name;
 
+	refcount_set(&binder_device->ref, 1);
 	binder_device->context.binder_context_mgr_uid = INVALID_UID;
 	binder_device->context.name = name;
 	mutex_init(&binder_device->context.context_mgr_node_lock);
--- a/drivers/android/binder_internal.h
+++ b/drivers/android/binder_internal.h
@@ -8,6 +8,7 @@
 #include <linux/list.h>
 #include <linux/miscdevice.h>
 #include <linux/mutex.h>
+#include <linux/refcount.h>
 #include <linux/stddef.h>
 #include <linux/types.h>
 #include <linux/uidgid.h>
@@ -33,21 +34,9 @@ struct binder_device {
 	struct miscdevice miscdev;
 	struct binder_context context;
 	struct inode *binderfs_inode;
+	refcount_t ref;
 };
 
-static inline struct binder_device *binderfs_device_get(struct binder_device *dev)
-{
-	if (dev->binderfs_inode)
-		ihold(dev->binderfs_inode);
-	return dev;
-}
-
-static inline void binderfs_device_put(struct binder_device *dev)
-{
-	if (dev->binderfs_inode)
-		iput(dev->binderfs_inode);
-}
-
 /**
  * binderfs_mount_opts - mount options for binderfs
  * @max: maximum number of allocatable binderfs binder devices
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -154,6 +154,7 @@ static int binderfs_binder_device_create
 	if (!name)
 		goto err;
 
+	refcount_set(&device->ref, 1);
 	device->binderfs_inode = inode;
 	device->context.binder_context_mgr_uid = INVALID_UID;
 	device->context.name = name;
@@ -257,8 +258,10 @@ static void binderfs_evict_inode(struct
 	ida_free(&binderfs_minors, device->miscdev.minor);
 	mutex_unlock(&binderfs_minors_mutex);
 
-	kfree(device->context.name);
-	kfree(device);
+	if (refcount_dec_and_test(&device->ref)) {
+		kfree(device->context.name);
+		kfree(device);
+	}
 }
 
 /**



  parent reply index

Thread overview: 206+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-10 12:37 [PATCH 5.5 000/189] 5.5.9-stable review Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 001/189] ASoC: intel/skl/hda - export number of digital microphones via control components Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 002/189] block, bfq: get a ref to a group when adding it to a service tree Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 003/189] block, bfq: get extra ref to prevent a queue from being freed during a group move Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 004/189] block, bfq: do not insert oom queue into position tree Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 005/189] dm thin metadata: fix lockdep complaint Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 006/189] net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 007/189] RDMA/core: Fix pkey and port assignment in get_new_pps Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 008/189] RDMA/core: Fix use of logical OR " Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 009/189] blktrace: fix dereference after null check Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 010/189] netfilter: hashlimit: do not use indirect calls during gc Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 011/189] netfilter: xt_hashlimit: unregister proc file before releasing mutex Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 012/189] ALSA: hda: do not override bus codec_mask in link_get() Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 013/189] serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 014/189] Kernel selftests: tpm2: check for tpm support Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 015/189] selftests: fix too long argument Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 016/189] usb: gadget: composite: Support more than 500mA MaxPower Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 017/189] usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 018/189] usb: gadget: serial: fix Tx stall after buffer overflow Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 019/189] habanalabs: halt the engines before hard-reset Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 020/189] habanalabs: do not halt CoreSight during hard reset Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 021/189] habanalabs: patched cb equals user cb in device memset Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 022/189] drm/msm/mdp5: rate limit pp done timeout warnings Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 023/189] drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 024/189] drm/modes: Make sure to parse valid rotation value from cmdline Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 025/189] drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 026/189] scsi: megaraid_sas: silence a warning Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 027/189] drm/msm/dsi: save pll state before dsi host is powered off Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 028/189] drm/msm/dsi/pll: call vco set rate explicitly Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 029/189] selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 030/189] selftests: forwarding: vxlan_bridge_1d: fix tos value Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 031/189] net: atlantic: check rpc result and wait for rpc address Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 032/189] net: atlantic: ptp gpio adjustments Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 033/189] net: ks8851-ml: Remove 8-bit bus accessors Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 034/189] net: ks8851-ml: Fix 16-bit data access Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 035/189] net: ks8851-ml: Fix 16-bit IO operation Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 036/189] net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt() Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 037/189] watchdog: da9062: do not ping the hw during stop() Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 038/189] s390/cio: cio_ignore_proc_seq_next should increase position index Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 039/189] s390: make install not depend on vmlinux Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 040/189] efi: Only print errors about failing to get certs if EFI vars are found Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 041/189] net/mlx5: DR, Fix matching on vport gvmi Greg Kroah-Hartman
2020-03-10 12:37 ` [PATCH 5.5 042/189] iommu/amd: Disable IOMMU on Stoney Ridge systems Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 043/189] nvme/pci: Add sleep quirk for Samsung and Toshiba drives Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 044/189] nvme-pci: Use single IRQ vector for old Apple models Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 045/189] x86/boot/compressed: Dont declare __force_order in kaslr_64.c Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 046/189] s390/qdio: fill SL with absolute addresses Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 047/189] nvme: Fix uninitialized-variable warning Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 048/189] ice: Dont tell the OS that link is going down Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 049/189] x86/xen: Distribute switch variables for initialization Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 050/189] net: thunderx: workaround BGX TX Underflow issue Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 051/189] csky/mm: Fixup export invalid_pte_table symbol Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 052/189] csky: Set regs->usp to kernel sp, when the exception is from kernel Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 053/189] csky/smp: Fixup boot failed when CONFIG_SMP Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 054/189] csky: Fixup ftrace modify panic Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 055/189] csky: Fixup compile warning for three unimplemented syscalls Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 056/189] arch/csky: fix some Kconfig typos Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 057/189] selftests: forwarding: vxlan_bridge_1d: use more proper tos value Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 058/189] firmware: imx: scu: Ensure sequential TX Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 059/189] binder: prevent UAF for binderfs devices Greg Kroah-Hartman
2020-03-10 12:38 ` Greg Kroah-Hartman [this message]
2020-03-10 12:38 ` [PATCH 5.5 061/189] ALSA: hda/realtek - Add Headset Mic supported Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 062/189] ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 063/189] ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 064/189] ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 065/189] ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 066/189] driver core: Call sync_state() even if supplier has no consumers Greg Kroah-Hartman
2020-03-25 13:42   ` Jiri Slaby
2020-03-25 14:07     ` Greg Kroah-Hartman
2020-03-25 17:53       ` Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 067/189] cifs: dont leak -EAGAIN for stat() during reconnect Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 068/189] cifs: fix rename() by ensuring source handle opened with DELETE bit Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 069/189] usb: storage: Add quirk for Samsung Fit flash Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 070/189] usb: usb251xb: fix regulator probe and error handling Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 071/189] usb: quirks: add NO_LPM quirk for Logitech Screen Share Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 072/189] usb: dwc3: gadget: Update chain bit correctly when using sg list Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 073/189] usb: cdns3: gadget: link trb should point to next request Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 074/189] usb: cdns3: gadget: toggle cycle bit before reset endpoint Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 075/189] usb: core: hub: fix unhandled return by employing a void function Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 076/189] usb: core: hub: do error out if usb_autopm_get_interface() fails Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 077/189] usb: core: port: " Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 078/189] vgacon: Fix a UAF in vgacon_invert_region Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 079/189] mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 080/189] mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 081/189] mm: avoid data corruption on CoW fault into PFN-mapped VMA Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 082/189] mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 083/189] fat: fix uninit-memory access for partial initialized inode Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 084/189] btrfs: fix RAID direct I/O reads with alternate csums Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 085/189] arm64: dts: socfpga: agilex: Fix gmac compatible Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 086/189] arm: dts: dra76x: Fix mmc3 max-frequency Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 087/189] phy: allwinner: Fix GENMASK misuse Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 088/189] tty:serial:mvebu-uart:fix a wrong return Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 089/189] tty: serial: fsl_lpuart: free IDs allocated by IDA Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 090/189] serial: 8250_exar: add support for ACCES cards Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 091/189] serdev: Fix detection of UART devices on Apple machines Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 092/189] vt: selection, close sel_buffer race Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 093/189] vt: selection, push console lock down Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 094/189] vt: selection, push sel_lock up Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 095/189] media: hantro: Fix broken media controller links Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 096/189] media: mc-entity.c: use & to check pad flags, not == Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 097/189] media: vicodec: process all 4 components for RGB32 formats Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 098/189] media: v4l2-mem2mem.c: fix broken links Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 099/189] perf intel-pt: Fix endless record after being terminated Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 100/189] perf intel-bts: " Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 101/189] perf cs-etm: " Greg Kroah-Hartman
2020-03-10 12:38 ` [PATCH 5.5 102/189] perf arm-spe: " Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 103/189] spi: spidev: Fix CS polarity if GPIO descriptors are used Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 104/189] x86/ioperm: Add new paravirt function update_io_bitmap() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 105/189] x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 106/189] s390/pci: Fix unexpected write combine on resource Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 107/189] s390/mm: fix panic in gup_fast on large pud Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 108/189] selftests: pidfd: Add pidfd_fdinfo_test in .gitignore Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 109/189] powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 110/189] drm/virtio: fix mmap page attributes Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 111/189] drm/shmem: add support for per object caching flags Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 112/189] drm/amdgpu: disable 3D pipe 1 on Navi1x Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 113/189] drm/amd/powerplay: fix pre-check condition for setting clock range Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 114/189] dmaengine: imx-sdma: fix context cache Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 115/189] dmaengine: imx-sdma: Fix the event id check to include RX event for UART6 Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 116/189] dmaengine: tegra-apb: Fix use-after-free Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 117/189] dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 118/189] dm integrity: fix recalculation when moving from journal mode to bitmap mode Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 119/189] dm integrity: fix a deadlock due to offloading to an incorrect workqueue Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 120/189] dm integrity: fix invalid table returned due to argument count mismatch Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 121/189] dm cache: fix a crash due to incorrect work item cancelling Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 122/189] dm: report suspended device during destroy Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 123/189] dm writecache: verify watermark during resume Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 124/189] dm zoned: Fix reference counter initial value of chunk works Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 125/189] dm: fix congested_fn for request-based device Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 126/189] arm64: dts: meson-sm1-sei610: add missing interrupt-names Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 127/189] ARM: dts: ls1021a: Restore MDIO compatible to gianfar Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 128/189] spi: bcm63xx-hsspi: Really keep pll clk enabled Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 129/189] drm/virtio: fix resource id creation race Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 130/189] ASoC: topology: Fix memleak in soc_tplg_link_elems_load() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 131/189] ASoC: topology: Fix memleak in soc_tplg_manifest_load() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 132/189] ASoC: SOF: Fix snd_sof_ipc_stream_posn() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 133/189] ASoC: intel: skl: Fix pin debug prints Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 134/189] ASoC: intel: skl: Fix possible buffer overflow in debug outputs Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 135/189] ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 136/189] ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 137/189] ASoC: Intel: Skylake: Fix available clock counter incrementation Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 138/189] ASoC: dapm: Correct DAPM handling of active widgets during shutdown Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 139/189] ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 140/189] spi: atmel-quadspi: fix possible MMIO window size overrun Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 141/189] drm/panfrost: Dont try to map on error faults Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 142/189] drm/mediatek: Handle component type MTK_DISP_OVL_2L correctly Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 143/189] drm/ttm: fix leaking fences via ttm_buffer_object_transfer Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 144/189] drm: kirin: Revert "Fix for hikey620 display offset problem" Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 145/189] drm/sun4i: Add separate DE3 VI layer formats Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 146/189] drm/sun4i: Fix DE2 VI layer format support Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 147/189] drm/sun4i: de2/de3: Remove unsupported VI layer formats Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 148/189] drm/i915: Program MBUS with rmw during initialization Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 149/189] drm/i915/selftests: Fix return in assert_mmap_offset() Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 150/189] drm/i915/perf: Reintroduce wait on OA configuration completion Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 151/189] phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 152/189] phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 153/189] ARM: dts: imx6: phycore-som: fix emmc supply Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 154/189] arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 155/189] firmware: imx: misc: Align imx sc msg structs to 4 Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 156/189] firmware: imx: scu-pd: " Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 157/189] firmware: imx: Align imx_sc_msg_req_cpu_start " Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 158/189] soc: imx-scu: Align imx sc msg structs " Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 159/189] Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 160/189] RDMA/rw: Fix error flow during RDMA context initialization Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 161/189] RDMA/odp: Ensure the mm is still alive before creating an implicit child Greg Kroah-Hartman
2020-03-10 12:39 ` [PATCH 5.5 162/189] RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 163/189] RDMA/siw: Fix failure handling during device creation Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 164/189] RDMA/iwcm: Fix iwcm work deallocation Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 165/189] RDMA/core: Fix protection fault in ib_mr_pool_destroy Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 166/189] regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 167/189] regulator: qcom_spmi: Fix docs for PM8004 Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 168/189] RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 169/189] IB/mlx5: Fix implicit ODP race Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 170/189] IB/hfi1, qib: Ensure RCU is locked when accessing list Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 171/189] ARM: imx: build v7_cpu_resume() unconditionally Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 172/189] ARM: dts: imx7d: fix opp-supported-hw Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 173/189] ARM: dts: am437x-idk-evm: Fix incorrect OPP node names Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 174/189] ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 175/189] ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties Greg Kroah-Hartman
2020-03-10 15:05   ` Johan Hovold
2020-03-10 16:39     ` Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 176/189] ARM: dts: imx7-colibri: Fix frequency for sd/mmc Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 177/189] hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 178/189] dma-buf: free dmabuf->name in dma_buf_release() Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 179/189] dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 180/189] sched/fair: Fix statistics for find_idlest_group() Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 181/189] arm64: dts: meson: fix gxm-khadas-vim2 wifi Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 182/189] bus: ti-sysc: Fix 1-wire reset quirk Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 183/189] dt-bindings: arm: fsl: fix APF6Dev compatible Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 184/189] EDAC/synopsys: Do not print an error with back-to-back snprintf() calls Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 185/189] powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 186/189] efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 187/189] efi/x86: Handle by-ref arguments covering multiple pages in mixed mode Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 188/189] efi: READ_ONCE rng seed size before munmap Greg Kroah-Hartman
2020-03-10 12:40 ` [PATCH 5.5 189/189] net: stmmac: fix notifier registration Greg Kroah-Hartman
2020-03-10 16:02 ` [PATCH 5.5 000/189] 5.5.9-stable review Guenter Roeck
2020-03-11 18:10   ` Greg Kroah-Hartman
2020-03-10 20:08 ` Jon Hunter
2020-03-11 13:09   ` Greg Kroah-Hartman
2020-03-10 21:15 ` shuah
2020-03-11 18:28   ` Greg Kroah-Hartman
2020-03-10 22:05 ` Guenter Roeck
2020-03-11 18:11   ` Greg Kroah-Hartman
2020-03-11 18:13   ` Greg Kroah-Hartman
2020-03-11  8:13 ` Naresh Kamboju
2020-03-11 18:15   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200310123645.668752851@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=christian.brauner@ubuntu.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tkjos@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git