Stable Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Taehee Yoo <ap420073@gmail.com>,
	Eric Dumazet <eric.dumazet@gmail.com>,
	"David S . Miller" <davem@davemloft.net>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 4.9 140/191] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
Date: Mon, 29 Jun 2020 11:39:16 -0400
Message-ID: <20200629154007.2495120-141-sashal@kernel.org> (raw)
In-Reply-To: <20200629154007.2495120-1-sashal@kernel.org>

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit dafabb6590cb15f300b77c095d50312e2c7c8e0f ]

In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses
fallback tunnel device pointer, which is fb_tunnel_dev.
This pointer variable should be set to NULL when a fb interface is deleted.
But there is no routine to set fb_tunnel_dev pointer to NULL.
So, this pointer will be still used after interface is deleted and
it eventually results in the use-after-free problem.

Test commands:
    ip netns add A
    ip netns add B
    ip link add eth0 type veth peer name eth1
    ip link set eth0 netns A
    ip link set eth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set eth0 up
    ip netns exec A ip link add ip6gre1 type ip6gre local fc:0::1 \
	    remote fc:0::2
    ip netns exec A ip -6 a a fc:100::1/64 dev ip6gre1
    ip netns exec A ip link set ip6gre1 up
    ip netns exec A ip -6 a a fc:0::1/64 dev eth0
    ip netns exec A ip link set ip6gre0 up

    ip netns exec B ip link set lo up
    ip netns exec B ip link set eth1 up
    ip netns exec B ip link add ip6gre1 type ip6gre local fc:0::2 \
	    remote fc:0::1
    ip netns exec B ip -6 a a fc:100::2/64 dev ip6gre1
    ip netns exec B ip link set ip6gre1 up
    ip netns exec B ip -6 a a fc:0::2/64 dev eth1
    ip netns exec B ip link set ip6gre0 up
    ip netns exec A ping fc:100::2 -s 60000 &
    ip netns del B

Splat looks like:
[   73.087285][    C1] BUG: KASAN: use-after-free in ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.088361][    C1] Read of size 4 at addr ffff888040559218 by task ping/1429
[   73.089317][    C1]
[   73.089638][    C1] CPU: 1 PID: 1429 Comm: ping Not tainted 5.7.0+ #602
[   73.090531][    C1] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   73.091725][    C1] Call Trace:
[   73.092160][    C1]  <IRQ>
[   73.092556][    C1]  dump_stack+0x96/0xdb
[   73.093122][    C1]  print_address_description.constprop.6+0x2cc/0x450
[   73.094016][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.094894][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.095767][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.096619][    C1]  kasan_report+0x154/0x190
[   73.097209][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.097989][    C1]  ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.098750][    C1]  ? gre_del_protocol+0x60/0x60 [gre]
[   73.099500][    C1]  gre_rcv+0x1c5/0x1450 [ip6_gre]
[   73.100199][    C1]  ? ip6gre_header+0xf00/0xf00 [ip6_gre]
[   73.100985][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.101830][    C1]  ? ip6_input_finish+0x5/0xf0
[   73.102483][    C1]  ip6_protocol_deliver_rcu+0xcbb/0x1510
[   73.103296][    C1]  ip6_input_finish+0x5b/0xf0
[   73.103920][    C1]  ip6_input+0xcd/0x2c0
[   73.104473][    C1]  ? ip6_input_finish+0xf0/0xf0
[   73.105115][    C1]  ? rcu_read_lock_held+0x90/0xa0
[   73.105783][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.106548][    C1]  ipv6_rcv+0x1f1/0x300
[ ... ]

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_gre.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index caee5530ae2ce..ca001ecb7197c 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -124,6 +124,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
 	int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
 		       ARPHRD_ETHER : ARPHRD_IP6GRE;
 	int score, cand_score = 4;
+	struct net_device *ndev;
 
 	for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
@@ -226,9 +227,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
 	if (cand)
 		return cand;
 
-	dev = ign->fb_tunnel_dev;
-	if (dev->flags & IFF_UP)
-		return netdev_priv(dev);
+	ndev = READ_ONCE(ign->fb_tunnel_dev);
+	if (ndev && ndev->flags & IFF_UP)
+		return netdev_priv(ndev);
 
 	return NULL;
 }
@@ -364,6 +365,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
 
 	ip6gre_tunnel_unlink(ign, t);
+	if (ign->fb_tunnel_dev == dev)
+		WRITE_ONCE(ign->fb_tunnel_dev, NULL);
 	dst_cache_reset(&t->dst_cache);
 	dev_put(dev);
 }
-- 
2.25.1


  parent reply index

Thread overview: 199+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-29 15:36 [PATCH 4.9 000/191] 4.9.229-rc1 review Sasha Levin
2020-06-29 15:36 ` [PATCH 4.9 001/191] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select Sasha Levin
2020-06-29 15:36 ` [PATCH 4.9 002/191] clk: sunxi: Fix incorrect usage of round_down() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.9 003/191] i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 004/191] iio: pressure: bmp280: Tolerate IRQ before registering Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 005/191] clk: qcom: msm8916: Fix the address location of pll->config_reg Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 006/191] backlight: lp855x: Ensure regulators are disabled on probe failure Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 007/191] ARM: integrator: Add some Kconfig selections Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 008/191] ALSA: isa/wavefront: prevent out of bounds write in ioctl Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 009/191] scsi: qla2xxx: Fix issue with adapter's stopping state Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 010/191] iio: bmp280: fix compensation of humidity Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 011/191] i2c: pxa: clear all master action bits in i2c_pxa_stop_message() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 012/191] usblp: poison URBs upon disconnect Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 013/191] PCI: aardvark: Don't blindly enable ASPM L0s and don't write to read-only register Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 014/191] ps3disk: use the default segment boundary Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 015/191] vfio/pci: fix memory leaks in alloc_perm_bits() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 016/191] mfd: wm8994: Fix driver operation if loaded as modules Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 017/191] scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 018/191] clk: clk-flexgen: fix clock-critical handling Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 019/191] powerpc/perf/hv-24x7: Fix inconsistent output values incase multiple hv-24x7 events run Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 020/191] nfsd: Fix svc_xprt refcnt leak when setup callback client failed Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 021/191] powerpc/crashkernel: Take "mem=" option into account Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 022/191] yam: fix possible memory leak in yam_init_driver Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 023/191] mksysmap: Fix the mismatch of '.L' symbols in System.map Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 024/191] scsi: sr: Fix sr_probe() missing deallocate of device minor Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 025/191] scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 026/191] ALSA: usb-audio: Improve frames size computation Sasha Levin
2020-06-30 10:49   ` Alexander Tsoy
2020-06-30 16:54     ` Sasha Levin
2020-06-30 18:33       ` Greg KH
2020-07-01  6:45         ` Takashi Iwai
2020-06-29 15:37 ` [PATCH 4.9 027/191] s390/qdio: put thinint indicator after early error Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 028/191] tty: hvc: Fix data abort due to race in hvc_open Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 029/191] staging: sm750fb: add missing case while setting FB_VISUAL Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 030/191] i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 031/191] serial: amba-pl011: Make sure we initialize the port.lock spinlock Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 032/191] drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 033/191] PCI: rcar: Fix incorrect programming of OB windows Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 034/191] PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 035/191] power: supply: lp8788: Fix an error handling path in 'lp8788_charger_probe()' Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 036/191] power: supply: smb347-charger: IRQSTAT_D is volatile Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 037/191] scsi: mpt3sas: Fix double free warnings Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 038/191] dlm: remove BUG() before panic() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 039/191] clk: ti: composite: fix memory leak Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 040/191] tty: n_gsm: Fix SOF skipping Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 041/191] tty: n_gsm: Fix waking up upper tty layer when room available Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 042/191] powerpc/pseries/ras: Fix FWNMI_VALID off by one Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 043/191] powerpc/ps3: Fix kexec shutdown hang Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 044/191] vfio-pci: Mask cap zero Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 045/191] usb/ohci-platform: Fix a warning when hibernating Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 046/191] drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 047/191] USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 048/191] tty: n_gsm: Fix bogus i++ in gsm_data_kick Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 049/191] clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 050/191] powerpc/64s/pgtable: fix an undefined behaviour Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 051/191] PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 052/191] IB/cma: Fix ports memory leak in cma_configfs Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 053/191] watchdog: da9062: No need to ping manually before setting timeout Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 054/191] usb: dwc2: gadget: move gadget resume after the core is in L0 state Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 055/191] USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 056/191] usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 057/191] usb: gadget: fix potential double-free in m66592_probe Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 058/191] usb: gadget: Fix issue with config_ep_by_speed function Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 059/191] clk: bcm2835: Fix return type of bcm2835_register_gate Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 060/191] net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 061/191] NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 062/191] extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()' Sasha Levin
2020-06-29 15:37 ` [PATCH 4.9 063/191] ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 064/191] openrisc: Fix issue with argument clobbering for clone/fork Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 065/191] gfs2: Allow lock_nolock mount to specify jid=X Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 066/191] scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 067/191] pinctrl: imxl: Fix an error handling path in 'imx1_pinctrl_core_probe()' Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 068/191] crypto: omap-sham - add proper load balancing support for multicore Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 069/191] lib/zlib: remove outdated and incorrect pre-increment optimization Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 070/191] include/linux/bitops.h: avoid clang shift-count-overflow warnings Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 071/191] elfnote: mark all .note sections SHF_ALLOC Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 072/191] selftests/vm/pkeys: fix alloc_random_pkey() to make it really random Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 073/191] selftests/net: in timestamping, strncpy needs to preserve null byte Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 074/191] scsi: acornscsi: Fix an error handling path in acornscsi_probe() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 075/191] usb/xhci-plat: Set PM runtime as active on resume Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 076/191] usb/ehci-platform: " Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 077/191] perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 078/191] bcache: fix potential deadlock problem in btree_gc_coalesce Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 079/191] block: Fix use-after-free in blkdev_get() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 080/191] libata: Use per port sync for detach Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 081/191] drm: encoder_slave: fix refcouting error for modules Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 082/191] drm/dp_mst: Reformat drm_dp_check_act_status() a bit Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 083/191] drm/qxl: Use correct notify port address when creating cursor ring Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 084/191] selinux: fix double free Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 085/191] ext4: fix partial cluster initialization when splitting extent Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 086/191] drm/dp_mst: Increase ACT retry timeout to 3s Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 087/191] x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 088/191] block: nr_sects_write(): Disable preemption on seqcount write Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 089/191] s390: fix syscall_get_error for compat processes Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 090/191] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 091/191] crypto: algboss - don't wait during notifier callback Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 092/191] kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 093/191] powerpc/kprobes: Fixes for kprobe_lookup_name() on BE Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 094/191] x86/kprobes: Avoid kretprobe recursion bug Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 095/191] kretprobe: Prevent triggering kretprobe from within kprobe_flush_task Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 096/191] e1000e: Do not wake up the system via WOL if device wakeup is disabled Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 097/191] sched/rt, net: Use CONFIG_PREEMPTION.patch Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 098/191] net: core: device_rename: Use rwsem instead of a seqcount Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 099/191] media: dvb_frontend: initialize variable s with FE_NONE instead of 0 Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 100/191] media: dvb/frontend.h: move out a private internal structure Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 101/191] media: dvb/frontend.h: document the uAPI file Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 102/191] media: dvb_frontend: get rid of get_property() callback Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 103/191] media: stv0288: get rid of set_property boilerplate Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 104/191] media: stv6110: get rid of a srate dead code Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 105/191] media: friio-fe: get rid of set_property() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 106/191] media: dvb_frontend: get rid of set_property() callback Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 107/191] media: dvb_frontend: cleanup dvb_frontend_ioctl_properties() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 108/191] media: dvb_frontend: cleanup ioctl handling logic Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 109/191] media: dvb_frontend: get rid of property cache's state Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 110/191] media: dvb_frontend: better document the -EPERM condition Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 111/191] media: dvb_frontend: fix return values for FE_SET_PROPERTY Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 112/191] media: dvb_frontend: dtv_property_process_set() cleanups Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 113/191] media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 114/191] media: dvb_frontend: Add unlocked_ioctl in dvb_frontend.c Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 115/191] media: dvb_frontend: Add compat_ioctl callback Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 116/191] media: dvb_frontend: Add commands implementation for compat ioct Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 117/191] media: dvb_frontend: fix wrong cast in compat_ioctl Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 118/191] media: dvb_frontend: fix return error code Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 119/191] mtd: rawnand: Pass a nand_chip object to nand_release() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 120/191] mtd: rawnand: diskonchip: Fix the probe error path Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 121/191] mtd: rawnand: sharpsl: " Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 122/191] mtd: rawnand: xway: " Sasha Levin
2020-06-29 15:38 ` [PATCH 4.9 123/191] mtd: rawnand: orion: " Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 124/191] mtd: rawnand: socrates: " Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 125/191] mtd: rawnand: plat_nand: " Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 126/191] mtd: rawnand: mtk: " Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 127/191] mtd: rawnand: tmio: " Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 128/191] scsi: scsi_devinfo: handle non-terminated strings Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 129/191] l2tp: Allow duplicate session creation with UDP Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 130/191] net: sched: export __netdev_watchdog_up() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 131/191] fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 132/191] mld: fix memory leak in ipv6_mc_destroy_dev() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 133/191] net: fix memleak in register_netdevice() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 134/191] net: usb: ax88179_178a: fix packet alignment padding Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 135/191] rocker: fix incorrect error handling in dma_rings_init Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 136/191] rxrpc: Fix notification call on completion of discarded calls Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 137/191] tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 138/191] ip_tunnel: fix use-after-free in ip_tunnel_lookup() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 139/191] tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT Sasha Levin
2020-06-29 15:39 ` Sasha Levin [this message]
2020-06-29 15:39 ` [PATCH 4.9 141/191] tcp: grow window for OOO packets only for SACK flows Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 142/191] sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 143/191] net: Fix the arp error in some cases Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 144/191] net: Do not clear the sock TX queue in sk_set_socket() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 145/191] net: core: reduce recursion limit value Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 146/191] USB: ohci-sm501: Add missed iounmap() in remove Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 147/191] usb: dwc2: Postponed gadget registration to the udc class driver Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 148/191] usb: add USB_QUIRK_DELAY_INIT for Logitech C922 Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 149/191] USB: ehci: reopen solution for Synopsys HC bug Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 150/191] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 151/191] ALSA: usb-audio: add quirk for Denon DCD-1500RE Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 152/191] xhci: Fix incorrect EP_STATE_MASK Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 153/191] xhci: Fix enumeration issue when setting max packet size for FS devices Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 154/191] cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 155/191] ALSA: usb-audio: uac1: Invalidate ctl on interrupt Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 156/191] ALSA: usb-audio: Clean up mixer element list traverse Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 157/191] ALSA: usb-audio: Fix OOB access of mixer element list Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 158/191] xhci: Poll for U0 after disabling USB2 LPM Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 159/191] cifs/smb3: Fix data inconsistent when punch hole Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 160/191] cifs/smb3: Fix data inconsistent when zero file range Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 161/191] efi/esrt: Fix reference count leak in esre_create_sysfs_entry Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 162/191] RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 163/191] net: qed: fix left elements count calculation Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 164/191] net: qed: fix NVMe login fails over VFs Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 165/191] net: qed: fix excessive QM ILT lines consumption Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 166/191] ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 167/191] usb: gadget: udc: Potential Oops in error handling code Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 168/191] netfilter: ipset: fix unaligned atomic access Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 169/191] sched/core: Fix PI boosting between RT and DEADLINE tasks Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 170/191] ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 171/191] net: alx: fix race condition in alx_remove Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 172/191] s390/ptrace: fix setting syscall number Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 173/191] kbuild: improve cc-option to clean up all temporary files Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 174/191] blktrace: break out of blktrace setup on concurrent calls Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 175/191] ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 176/191] ACPI: sysfs: Fix pm_profile_attr type Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 177/191] KVM: X86: Fix MSR range of APIC registers in X2APIC mode Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 178/191] mm/slab: use memzero_explicit() in kzfree() Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 179/191] ocfs2: load global_inode_alloc Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 180/191] ocfs2: fix value of OCFS2_INVALID_SLOT Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 181/191] ocfs2: fix panic on nfs server over ocfs2 Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 182/191] arm64: perf: Report the PC value in REGS_ABI_32 mode Sasha Levin
2020-06-29 15:39 ` [PATCH 4.9 183/191] tracing: Fix event trigger to accept redundant spaces Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 184/191] drm/radeon: fix fb_div check in ni_init_smc_spll_table() Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 185/191] sunrpc: fixed rollback in rpc_gssd_dummy_populate() Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 186/191] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 187/191] pNFS/flexfiles: Fix list corruption if the mirror count changes Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 188/191] NFSv4 fix CLOSE not waiting for direct IO compeletion Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 189/191] ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 190/191] xfs: add agf freeblocks verify in xfs_agf_verify Sasha Levin
2020-06-29 15:40 ` [PATCH 4.9 191/191] Linux 4.9.229-rc1 Sasha Levin
2020-06-30  7:45 ` [PATCH 4.9 000/191] 4.9.229-rc1 review Naresh Kamboju
2020-06-30  9:13 ` Jon Hunter
2020-06-30 17:20 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200629154007.2495120-141-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ap420073@gmail.com \
    --cc=davem@davemloft.net \
    --cc=eric.dumazet@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git