stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Yu Kuai <yukuai3@huawei.com>,
	Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 5.16 063/186] blktrace: fix use after free for struct blk_trace
Date: Mon,  7 Mar 2022 10:18:21 +0100	[thread overview]
Message-ID: <20220307091655.856433453@linuxfoundation.org> (raw)
In-Reply-To: <20220307091654.092878898@linuxfoundation.org>

From: Yu Kuai <yukuai3@huawei.com>

commit 30939293262eb433c960c4532a0d59c4073b2b84 upstream.

When tracing the whole disk, 'dropped' and 'msg' will be created
under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free()
won't remove those files. What's worse, the following UAF can be
triggered because of accessing stale 'dropped' and 'msg':

==================================================================
BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100
Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188

CPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_address_description.constprop.0.cold+0xab/0x381
 ? blk_dropped_read+0x89/0x100
 ? blk_dropped_read+0x89/0x100
 kasan_report.cold+0x83/0xdf
 ? blk_dropped_read+0x89/0x100
 kasan_check_range+0x140/0x1b0
 blk_dropped_read+0x89/0x100
 ? blk_create_buf_file_callback+0x20/0x20
 ? kmem_cache_free+0xa1/0x500
 ? do_sys_openat2+0x258/0x460
 full_proxy_read+0x8f/0xc0
 vfs_read+0xc6/0x260
 ksys_read+0xb9/0x150
 ? vfs_write+0x3d0/0x3d0
 ? fpregs_assert_state_consistent+0x55/0x60
 ? exit_to_user_mode_prepare+0x39/0x1e0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbc080d92fd
Code: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1
RSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd
RDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045
RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd
R10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0
R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8
 </TASK>

Allocated by task 1050:
 kasan_save_stack+0x1e/0x40
 __kasan_kmalloc+0x81/0xa0
 do_blk_trace_setup+0xcb/0x410
 __blk_trace_setup+0xac/0x130
 blk_trace_ioctl+0xe9/0x1c0
 blkdev_ioctl+0xf1/0x390
 __x64_sys_ioctl+0xa5/0xe0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 1050:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_set_free_info+0x20/0x30
 __kasan_slab_free+0x103/0x180
 kfree+0x9a/0x4c0
 __blk_trace_remove+0x53/0x70
 blk_trace_ioctl+0x199/0x1c0
 blkdev_common_ioctl+0x5e9/0xb30
 blkdev_ioctl+0x1a5/0x390
 __x64_sys_ioctl+0xa5/0xe0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff88816912f380
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 88 bytes inside of
 96-byte region [ffff88816912f380, ffff88816912f3e0)
The buggy address belongs to the page:
page:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f
flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
raw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
                                                    ^
 ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================

Fixes: c0ea57608b69 ("blktrace: remove debugfs file dentries from struct blk_trace")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20220228034354.4047385-1-yukuai3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/blktrace.c |   26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -310,10 +310,20 @@ record_it:
 	local_irq_restore(flags);
 }
 
-static void blk_trace_free(struct blk_trace *bt)
+static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
 {
 	relay_close(bt->rchan);
-	debugfs_remove(bt->dir);
+
+	/*
+	 * If 'bt->dir' is not set, then both 'dropped' and 'msg' are created
+	 * under 'q->debugfs_dir', thus lookup and remove them.
+	 */
+	if (!bt->dir) {
+		debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir));
+		debugfs_remove(debugfs_lookup("msg", q->debugfs_dir));
+	} else {
+		debugfs_remove(bt->dir);
+	}
 	free_percpu(bt->sequence);
 	free_percpu(bt->msg_data);
 	kfree(bt);
@@ -335,10 +345,10 @@ static void put_probe_ref(void)
 	mutex_unlock(&blk_probe_mutex);
 }
 
-static void blk_trace_cleanup(struct blk_trace *bt)
+static void blk_trace_cleanup(struct request_queue *q, struct blk_trace *bt)
 {
 	synchronize_rcu();
-	blk_trace_free(bt);
+	blk_trace_free(q, bt);
 	put_probe_ref();
 }
 
@@ -352,7 +362,7 @@ static int __blk_trace_remove(struct req
 		return -EINVAL;
 
 	if (bt->trace_state != Blktrace_running)
-		blk_trace_cleanup(bt);
+		blk_trace_cleanup(q, bt);
 
 	return 0;
 }
@@ -572,7 +582,7 @@ static int do_blk_trace_setup(struct req
 	ret = 0;
 err:
 	if (ret)
-		blk_trace_free(bt);
+		blk_trace_free(q, bt);
 	return ret;
 }
 
@@ -1616,7 +1626,7 @@ static int blk_trace_remove_queue(struct
 
 	put_probe_ref();
 	synchronize_rcu();
-	blk_trace_free(bt);
+	blk_trace_free(q, bt);
 	return 0;
 }
 
@@ -1647,7 +1657,7 @@ static int blk_trace_setup_queue(struct
 	return 0;
 
 free_bt:
-	blk_trace_free(bt);
+	blk_trace_free(q, bt);
 	return ret;
 }
 



  parent reply	other threads:[~2022-03-07 10:04 UTC|newest]

Thread overview: 188+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-07  9:17 [PATCH 5.16 000/186] 5.16.13-rc1 review Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 001/186] mac80211_hwsim: report NOACK frames in tx_status Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 002/186] mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 003/186] i2c: bcm2835: Avoid clock stretching timeouts Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 004/186] ASoC: rt5682s: do not block workqueue if card is unbound Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 005/186] ASoC: rt5668: " Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 006/186] ASoC: rt5682: " Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 007/186] regulator: core: fix false positive in regulator_late_cleanup() Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 008/186] Input: clear BTN_RIGHT/MIDDLE on buttonpads Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 009/186] btrfs: get rid of warning on transaction commit when using flushoncommit Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 010/186] KVM: arm64: vgic: Read HW interrupt pending state from the HW Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 011/186] block: loop:use kstatfs.f_bsize of backing file to set discard granularity Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 012/186] tipc: fix a bit overflow in tipc_crypto_key_rcv() Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 013/186] cifs: do not use uninitialized data in the owner/group sid Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 014/186] cifs: fix double free race when mount fails in cifs_get_root() Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 015/186] HID: amd_sfh: Handle amd_sfh work buffer in PM ops Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 016/186] HID: amd_sfh: Add functionality to clear interrupts Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 017/186] HID: amd_sfh: Add interrupt handler to process interrupts Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 018/186] cifs: modefromsids must add an ACE for authenticated users Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 019/186] selftests/seccomp: Fix seccomp failure by adding missing headers Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 020/186] drm/amd/pm: correct UMD pstate clocks for Dimgrey Cavefish and Beige Goby Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 021/186] selftests/ftrace: Do not trace do_softirq because of PREEMPT_RT Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 022/186] dmaengine: shdma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 023/186] i2c: cadence: allow COMPILE_TEST Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 024/186] i2c: imx: " Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 025/186] i2c: qup: " Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 026/186] net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 027/186] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 028/186] usb: gadget: dont release an existing dev->buf Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 029/186] usb: gadget: clear related members when goto fail Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 030/186] exfat: reuse exfat_inode_info variable instead of calling EXFAT_I() Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 031/186] exfat: fix i_blocks for files truncated over 4 GiB Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 032/186] tracing: Add test for user space strings when filtering on string pointers Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 033/186] arm64: Mark start_backtrace() notrace and NOKPROBE_SYMBOL Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 034/186] serial: stm32: prevent TDR register overwrite when sending x_char Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 035/186] KVM: arm64: Workaround Cortex-A510s single-step and PAC trap errata Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 036/186] ext4: drop ineligible txn start stop APIs Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 037/186] ext4: simplify updating of fast commit stats Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 038/186] ext4: fast commit may not fallback for ineligible commit Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 039/186] ext4: fast commit may miss file actions Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 040/186] sched/fair: Fix fault in reweight_entity Greg Kroah-Hartman
2022-03-07  9:17 ` [PATCH 5.16 041/186] KVM: x86: Add KVM_CAP_ENABLE_CAP to x86 Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 042/186] ata: pata_hpt37x: fix PCI clock detection Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 043/186] drm/amdgpu: check vm ready by amdgpu_vm->evicting flag Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 044/186] tracing: Add ustring operation to filtering string pointers Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 045/186] ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report() Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 046/186] btrfs: defrag: bring back the old file extent search behavior Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 047/186] btrfs: defrag: dont use merged extent map for their generation check Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 048/186] ALSA: intel_hdmi: Fix reference to PCM buffer address Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 049/186] ucounts: Fix systemd LimitNPROC with private users regression Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 050/186] binfmt_elf: Avoid total_mapping_size for ET_EXEC Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 051/186] riscv/efi_stub: Fix get_boot_hartid_from_fdt() return value Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 052/186] riscv: Fix config KASAN && SPARSEMEM && !SPARSE_VMEMMAP Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 053/186] riscv: Fix config KASAN && DEBUG_VIRTUAL Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 054/186] iwlwifi: mvm: check debugfs_dir ptr before use Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 055/186] ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 056/186] iommu/vt-d: Fix double list_add when enabling VMD in scalable mode Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 057/186] iommu/amd: Recover from event log overflow Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 058/186] drm/i915: s/JSP2/ICP2/ PCH Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 059/186] drm/amd/display: Reduce dmesg error to a debug print Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 060/186] xen/netfront: destroy queues before real_num_tx_queues is zeroed Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 061/186] thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 062/186] mac80211: fix EAPoL rekey fail in 802.3 rx path Greg Kroah-Hartman
2022-03-07  9:18 ` Greg Kroah-Hartman [this message]
2022-03-07  9:18 ` [PATCH 5.16 064/186] ntb: intel: fix port config status offset for SPR Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 065/186] mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 066/186] xfrm: fix MTU regression Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 067/186] netfilter: fix use-after-free in __nf_register_net_hook() Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 068/186] bpf, sockmap: Do not ignore orig_len parameter Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 069/186] xfrm: fix the if_id check in changelink Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 070/186] xfrm: enforce validity of offload input flags Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 071/186] e1000e: Correct NVM checksum verification flow Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 072/186] net: fix up skbs delta_truesize in UDP GRO frag_list Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 073/186] netfilter: nf_queue: dont assume sk is full socket Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 074/186] netfilter: nf_queue: fix possible use-after-free Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 075/186] netfilter: nf_queue: handle socket prefetch Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 076/186] batman-adv: Request iflink once in batadv-on-batadv check Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 077/186] batman-adv: Request iflink once in batadv_get_real_netdevice Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 078/186] batman-adv: Dont expect inter-netns unique iflink indices Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 079/186] net: ipv6: ensure we call ipv6_mc_down() at most once Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 080/186] net: dcb: flush lingering app table entries for unregistered devices Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 081/186] net: ipa: fix a build dependency Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 082/186] net: ipa: add an interconnect dependency Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 083/186] net/smc: fix connection leak Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 084/186] net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 085/186] net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 086/186] btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 087/186] platform/x86: amd-pmc: Set QOS during suspend on CZN w/ timer wakeup Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 088/186] net: dsa: microchip: fix bridging with more than two member ports Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 089/186] mac80211: fix forwarded mesh frames AC & queue selection Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 090/186] net: stmmac: fix return value of __setup handler Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 091/186] mac80211: treat some SAE auth steps as final Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 092/186] iavf: Fix missing check for running netdev Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 093/186] net: sxgbe: fix return value of __setup handler Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 094/186] ibmvnic: register netdev after init of adapter Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 095/186] net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 096/186] ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 097/186] iavf: Fix deadlock in iavf_reset_task Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 098/186] efivars: Respect "block" flag in efivar_entry_set_safe() Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 099/186] auxdisplay: lcd2s: Fix lcd2s_redefine_char() feature Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 100/186] firmware: arm_scmi: Remove space in MODULE_ALIAS name Greg Kroah-Hartman
2022-03-07  9:18 ` [PATCH 5.16 101/186] ASoC: cs4265: Fix the duplicated control name Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 102/186] auxdisplay: lcd2s: Fix memory leak in ->remove() Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 103/186] auxdisplay: lcd2s: Use proper API to free the instance of charlcd object Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 104/186] can: gs_usb: change active_channelss type from atomic_t to u8 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 105/186] iommu/tegra-smmu: Fix missing put_device() call in tegra_smmu_find Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 106/186] arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 107/186] igc: igc_read_phy_reg_gpy: drop premature return Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 108/186] ARM: Fix kgdb breakpoint for Thumb2 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 109/186] mips: setup: fix setnocoherentio() boolean setting Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 110/186] ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 111/186] mptcp: Correctly set DATA_FIN timeout when number of retransmits is large Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 112/186] selftests: mlxsw: tc_police_scale: Make test more robust Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 113/186] pinctrl: sunxi: Use unique lockdep classes for IRQs Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 114/186] igc: igc_write_phy_reg_gpy: drop premature return Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 115/186] ibmvnic: free reset-work-item when flushing Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 116/186] memfd: fix F_SEAL_WRITE after shmem huge page allocated Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 117/186] s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 118/186] s390/extable: fix exception table sorting Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 119/186] sched: Fix yet more sched_fork() races Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 120/186] arm64: dts: rockchip: drop pclk_xpcs from gmac0 on rk3568 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 121/186] arm64: dts: juno: Remove GICv2m dma-range Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 122/186] arm64: dts: rockchip: fix Quartz64-A ddr regulator voltage Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 123/186] arm64: dts: imx8mm: Fix VPU Hanging Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 124/186] iommu/amd: Simplify pagetable freeing Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 125/186] iommu/amd: Use put_pages_list Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 126/186] iommu/amd: Fix I/O page table memory leak Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 127/186] MIPS: ralink: mt7621: do memory detection on KSEG1 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 128/186] ARM: dts: switch timer config to common devkit8000 devicetree Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 129/186] ARM: dts: Use 32KiHz oscillator on devkit8000 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 130/186] soc: fsl: guts: Revert commit 3c0d64e867ed Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 131/186] soc: fsl: guts: Add a missing memory allocation failure check Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 132/186] soc: fsl: qe: Check of ioremap return value Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 133/186] soc: imx: gpcv2: Fix clock disabling imbalance in error path Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 134/186] netfilter: nf_tables: prefer kfree_rcu(ptr, rcu) variant Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 135/186] ARM: tegra: Move panels to AUX bus Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 136/186] Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 137/186] can: etas_es58x: change opened_channel_cnts type from atomic_t to u8 Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 138/186] net: stmmac: enhance XDP ZC driver level switching performance Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 139/186] net: stmmac: only enable DMA interrupts when ready Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 140/186] ibmvnic: initialize rc before completing wait Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 141/186] ibmvnic: define flush_reset_queue helper Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 142/186] ibmvnic: complete init_done on transport events Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 143/186] ibmvnic: Update driver return codes Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 144/186] ibmvnic: init init_done_rc earlier Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 145/186] ibmvnic: clear fop when retrying probe Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 146/186] ibmvnic: Allow queueing resets during probe Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 147/186] net: chelsio: cxgb3: check the return value of pci_find_capability() Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 148/186] net: sparx5: Fix add vlan when invalid operation Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 149/186] iavf: Add trace while removing device Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 150/186] iavf: Rework mutexes for better synchronisation Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 151/186] iavf: Add waiting so the port is initialized in remove Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 152/186] iavf: Fix init state closure on remove Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 153/186] iavf: Fix locking for VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 154/186] iavf: Fix race in init state Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 155/186] iavf: Fix __IAVF_RESETTING state usage Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 156/186] drm/i915/guc/slpc: Correct the param count for unset param Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 157/186] drm/bridge: ti-sn65dsi86: Properly undo autosuspend Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 158/186] e1000e: Fix possible HW unit hang after an s0ix exit Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 159/186] MIPS: ralink: mt7621: use bitwise NOT instead of logical Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 160/186] nl80211: Handle nla_memdup failures in handle_nan_filter Greg Kroah-Hartman
2022-03-07  9:19 ` [PATCH 5.16 161/186] ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 162/186] drm/amdgpu: fix suspend/resume hang regression Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 163/186] net: dcb: disable softirqs in dcbnl_flush_dev() Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 164/186] selftests: mlxsw: resource_scale: Fix return value Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 165/186] net: stmmac: perserve TX and RX coalesce value during XDP setup Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 166/186] Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 167/186] Input: elan_i2c - fix regulator enable count imbalance after suspend/resume Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 168/186] Input: samsung-keypad - properly state IOMEM dependency Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 169/186] HID: add mapping for KEY_DICTATE Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 170/186] HID: add mapping for KEY_ALL_APPLICATIONS Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 171/186] tracing/histogram: Fix sorting on old "cpu" value Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 172/186] tracing: Fix return value of __setup handlers Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 173/186] btrfs: fix lost prealloc extents beyond eof after full fsync Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 174/186] btrfs: fix relocation crash due to premature return from btrfs_commit_transaction() Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 175/186] btrfs: subpage: fix a wrong check on subpage->writers Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 176/186] btrfs: do not WARN_ON() if we have PageError set Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 177/186] btrfs: qgroup: fix deadlock between rescan worker and remove qgroup Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 178/186] btrfs: add missing run of delayed items after unlink during log replay Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 179/186] btrfs: fallback to blocking mode when doing async dio over multiple extents Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 180/186] btrfs: do not start relocation until in progress drops are done Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 181/186] Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 182/186] proc: fix documentation and description of pagemap Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 183/186] x86/kvmclock: Fix Hyper-V Isolated VMs boot issue when vCPUs > 64 Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 184/186] s390/ftrace: fix arch_ftrace_get_regs implementation Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 185/186] s390/ftrace: fix ftrace_caller/ftrace_regs_caller generation Greg Kroah-Hartman
2022-03-07  9:20 ` [PATCH 5.16 186/186] KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() Greg Kroah-Hartman
2022-03-07 14:29 ` [PATCH 5.16 000/186] 5.16.13-rc1 review Fox Chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220307091655.856433453@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=axboe@kernel.dk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=yukuai3@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).