From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Dokyung Song <dokyungs@yonsei.ac.kr>,
Jisoo Jang <jisoo.jang@yonsei.ac.kr>,
Minsuk Kang <linuxlovemin@yonsei.ac.kr>,
Arend van Spriel <arend.vanspriel@broadcom.com>,
Kalle Valo <kvalo@kernel.org>
Subject: [PATCH 5.15 117/120] wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
Date: Tue, 7 Feb 2023 13:58:08 +0100 [thread overview]
Message-ID: <20230207125623.765174136@linuxfoundation.org> (raw)
In-Reply-To: <20230207125618.699726054@linuxfoundation.org>
From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
commit 4920ab131b2dbae7464b72bdcac465d070254209 upstream.
This patch fixes slab-out-of-bounds reads in brcmfmac that occur in
brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count
value of channel specifications provided by the device is greater than
the length of 'list->element[]', decided by the size of the 'list'
allocated with kzalloc(). The patch adds checks that make the functions
free the buffer and return -EINVAL if that is the case. Note that the
negative return is handled by the caller, brcmf_setup_wiphybands() or
brcmf_cfg80211_attach().
Found by a modified version of syzkaller.
Crash Report from brcmf_construct_chaninfo():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430
Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_setup_wiphybands+0x1238/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_setup_wiphybands+0x290/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888115f24000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888115f24000, ffff888115f24800)
Memory state around the buggy address:
ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Crash Report from brcmf_enable_bw40_2g():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0
Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_cfg80211_attach+0x3d11/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_cfg80211_attach+0x3302/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888103787000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888103787000, ffff888103787800)
Memory state around the buggy address:
ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221116142952.518241-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 17 ++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -90,6 +90,9 @@
#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
+#define BRCMF_MAX_CHANSPEC_LIST \
+ (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
+
static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
{
if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
@@ -6557,6 +6560,13 @@ static int brcmf_construct_chaninfo(stru
band->channels[i].flags = IEEE80211_CHAN_DISABLED;
total = le32_to_cpu(list->count);
+ if (total > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ total);
+ err = -EINVAL;
+ goto fail_pbuf;
+ }
+
for (i = 0; i < total; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
@@ -6702,6 +6712,13 @@ static int brcmf_enable_bw40_2g(struct b
band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
list = (struct brcmf_chanspec_list *)pbuf;
num_chan = le32_to_cpu(list->count);
+ if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ num_chan);
+ kfree(pbuf);
+ return -EINVAL;
+ }
+
for (i = 0; i < num_chan; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
next prev parent reply other threads:[~2023-02-07 13:14 UTC|newest]
Thread overview: 129+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-07 12:56 [PATCH 5.15 000/120] 5.15.93-rc1 review Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 001/120] firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 002/120] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 003/120] ASoC: Intel: boards: fix spelling in comments Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 004/120] ASoC: Intel: bytcht_es8316: move comment to the right place Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 005/120] ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 006/120] ASoC: Intel: bytcr_rt5651: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 007/120] ASoC: Intel: bytcr_rt5640: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 008/120] ASoC: Intel: bytcr_wm5102: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 009/120] bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 010/120] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 011/120] bpf: Support <8-byte scalar spill and refill Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 012/120] bpf: Fix to preserve reg parent/live fields when copying range info Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 013/120] bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 014/120] arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 015/120] drm/vc4: hdmi: make CEC adapter name unique Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 016/120] scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 017/120] vhost/net: Clear the pending messages when the backend is removed Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 018/120] WRITE is "data source", not destination Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 019/120] READ is "data destination", not source Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 020/120] fix iov_iter_bvec() "direction" argument Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 021/120] fix "direction" argument of iov_iter_kvec() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 022/120] ice: Prevent set_channel from changing queues while RDMA active Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 023/120] qede: execute xdp_do_flush() before napi_complete_done() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 024/120] virtio-net: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 025/120] dpaa_eth: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 026/120] dpaa2-eth: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 027/120] sfc: correctly advertise tunneled IPv6 segmentation Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 028/120] net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 029/120] block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 030/120] block, bfq: replace 0/1 with false/true in bic apis Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 031/120] block, bfq: fix uaf for bfqq in bic_set_bfqq() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 032/120] netrom: Fix use-after-free caused by accept on already connected socket Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 033/120] drm/i915/guc: Fix locking when searching for a hung request Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 034/120] drm/i915/adlp: Fix typo for reference clock Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 035/120] netfilter: br_netfilter: disable sabotage_in hook after first suppression Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 036/120] squashfs: harden sanity check in squashfs_read_xattr_id_table Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 037/120] net: phy: meson-gxl: Add generic dummy stubs for MMD register access Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 038/120] ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 039/120] ip/ip6_gre: Fix non-point-to-point tunnel " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 040/120] riscv: kprobe: Fixup kernel panic when probing an illegal position Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 041/120] igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 042/120] can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 043/120] ata: libata: Fix sata_down_spd_limit() when no link speed is reported Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 044/120] selftests: net: udpgso_bench_rx: Fix used uninitialized compiler warning Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 045/120] selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 046/120] selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 047/120] selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 5.15 048/120] virtio-net: Keep stop() to follow mirror sequence of open() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 049/120] net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 050/120] efi: fix potential NULL deref in efi_mem_reserve_persistent Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 051/120] i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 052/120] i2c: mxs: suppress probe-deferral error message Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 053/120] scsi: target: core: Fix warning on RT kernels Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 054/120] perf/x86/intel: Add Emerald Rapids Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 055/120] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 056/120] scsi: iscsi_tcp: Fix UAF during login " Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 057/120] i2c: rk3x: fix a bunch of kernel-doc warnings Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 058/120] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 059/120] platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 060/120] net/x25: Fix to not accept on connected socket Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 061/120] drm/amd/display: Fix timing not changning when freesync video is enabled Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 062/120] iio: adc: stm32-dfsdm: fill module aliases Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 063/120] usb: dwc3: qcom: enable vbus override when in OTG dr-mode Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 064/120] usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 065/120] vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 066/120] Input: i8042 - add Clevo PCX0DX to i8042 quirk table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 067/120] fbcon: Check font dimension limits Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 068/120] net: qrtr: free memory on error path in radix_tree_insert() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 069/120] watchdog: diag288_wdt: do not use stack buffers for hardware data Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 070/120] watchdog: diag288_wdt: fix __diag288() inline assembly Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 071/120] ALSA: hda/realtek: Add Acer Predator PH315-54 Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 072/120] efi: Accept version 2 of memory attributes table Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 073/120] iio: hid: fix the retval in accel_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 074/120] iio: hid: fix the retval in gyro_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 075/120] iio: adc: berlin2-adc: Add missing of_node_put() in error path Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 076/120] iio:adc:twl6030: Enable measurements of VUSB, VBAT and others Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 077/120] iio: imu: fxos8700: fix ACCEL measurement range selection Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 078/120] iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 079/120] iio: imu: fxos8700: fix IMU data bits returned to user space Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 080/120] iio: imu: fxos8700: fix map label of channel type to MAGN sensor Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 081/120] iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 082/120] iio: imu: fxos8700: fix incorrect ODR mode readback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 083/120] iio: imu: fxos8700: fix failed initialization ODR mode assignment Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 084/120] iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 085/120] iio: imu: fxos8700: fix MAGN sensor scale and unit Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 086/120] nvmem: qcom-spmi-sdam: fix module autoloading Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 087/120] parisc: Fix return code of pdc_iodc_print() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 088/120] parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 089/120] riscv: disable generation of unwind tables Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 090/120] mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 091/120] usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 092/120] kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 093/120] x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 094/120] fpga: stratix10-soc: Fix return value check in s10_ops_write_init() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 095/120] mm/swapfile: add cond_resched() in get_swap_pages() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 096/120] highmem: round down the address passed to kunmap_flush_on_unmap() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 097/120] Squashfs: fix handling and sanity checking of xattr_ids count Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 098/120] drm/i915: Fix potential bit_17 double-free Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 099/120] nvmem: core: initialise nvmem->id early Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 100/120] nvmem: core: remove nvmem_config wp_gpio Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 101/120] nvmem: core: fix cell removal on error Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 102/120] serial: 8250_dma: Fix DMA Rx completion race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 103/120] serial: 8250_dma: Fix DMA Rx rearm race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 104/120] phy: qcom-qmp-combo: disable runtime PM on unbind Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 105/120] phy: qcom-qmp-combo: fix memleak on probe deferral Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 106/120] phy: qcom-qmp-usb: " Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 107/120] phy: qcom-qmp-combo: fix broken power on Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 5.15 108/120] phy: qcom-qmp-combo: fix runtime suspend Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 109/120] bpf: Fix incorrect state pruning for <8B spill/fill Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 110/120] bpf: Do not reject when the stack read size is different from the tracked scalar size Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 111/120] iio:adc:twl6030: Enable measurement of VAC Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 112/120] powerpc/imc-pmu: Revert nest_init_lock to being a mutex Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 113/120] fs/ntfs3: Validate attribute data and valid sizes Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 114/120] ovl: Use "buf" flexible array for memcpy() destination Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 115/120] fbdev: smscufx: fix error handling code in ufx_usb_probe Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 116/120] f2fs: fix to do sanity check on i_extra_isize in is_alive() Greg Kroah-Hartman
2023-02-07 12:58 ` Greg Kroah-Hartman [this message]
2023-02-07 12:58 ` [PATCH 5.15 118/120] gfs2: Cosmetic gfs2_dinode_{in,out} cleanup Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 119/120] gfs2: Always check inode size of inline inodes Greg Kroah-Hartman
2023-02-07 12:58 ` [PATCH 5.15 120/120] bpf: Skip invalid kfunc call in backtrack_insn Greg Kroah-Hartman
2023-02-07 15:08 ` [PATCH 5.15 000/120] 5.15.93-rc1 review Jon Hunter
2023-02-07 18:20 ` Florian Fainelli
2023-02-07 21:24 ` Shuah Khan
2023-02-08 0:44 ` Allen Pais
2023-02-08 3:02 ` Bagas Sanjaya
2023-02-08 4:46 ` Naresh Kamboju
2023-02-08 5:21 ` Guenter Roeck
2023-02-09 1:10 ` Ron Economos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230207125623.765174136@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=arend.vanspriel@broadcom.com \
--cc=dokyungs@yonsei.ac.kr \
--cc=jisoo.jang@yonsei.ac.kr \
--cc=kvalo@kernel.org \
--cc=linuxlovemin@yonsei.ac.kr \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.