From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Dokyung Song <dokyungs@yonsei.ac.kr>,
Jisoo Jang <jisoo.jang@yonsei.ac.kr>,
Minsuk Kang <linuxlovemin@yonsei.ac.kr>,
Arend van Spriel <arend.vanspriel@broadcom.com>,
Kalle Valo <kvalo@kernel.org>
Subject: [PATCH 6.1 205/208] wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
Date: Tue, 7 Feb 2023 13:57:39 +0100 [thread overview]
Message-ID: <20230207125643.804784297@linuxfoundation.org> (raw)
In-Reply-To: <20230207125634.292109991@linuxfoundation.org>
From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
commit 4920ab131b2dbae7464b72bdcac465d070254209 upstream.
This patch fixes slab-out-of-bounds reads in brcmfmac that occur in
brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count
value of channel specifications provided by the device is greater than
the length of 'list->element[]', decided by the size of the 'list'
allocated with kzalloc(). The patch adds checks that make the functions
free the buffer and return -EINVAL if that is the case. Note that the
negative return is handled by the caller, brcmf_setup_wiphybands() or
brcmf_cfg80211_attach().
Found by a modified version of syzkaller.
Crash Report from brcmf_construct_chaninfo():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430
Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_setup_wiphybands+0x1238/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_setup_wiphybands+0x290/0x1430
brcmf_cfg80211_attach+0x2118/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888115f24000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888115f24000, ffff888115f24800)
Memory state around the buggy address:
ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Crash Report from brcmf_enable_bw40_2g():
==================================================================
BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0
Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896
CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0.cold+0x93/0x334
kasan_report.cold+0x83/0xdf
brcmf_cfg80211_attach+0x3d11/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
Allocated by task 1896:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
kmem_cache_alloc_trace+0x19e/0x330
brcmf_cfg80211_attach+0x3302/0x3fd0
brcmf_attach+0x389/0xd40
brcmf_usb_probe+0x12de/0x1690
usb_probe_interface+0x25f/0x710
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_set_configuration+0x984/0x1770
usb_generic_driver_probe+0x69/0x90
usb_probe_device+0x9c/0x220
really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460
driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250
bus_for_each_drv+0x123/0x1a0
__device_attach+0x207/0x330
bus_probe_device+0x1a2/0x260
device_add+0xa61/0x1ce0
usb_new_device.cold+0x463/0xf66
hub_event+0x10d5/0x3330
process_one_work+0x873/0x13e0
worker_thread+0x8b/0xd10
kthread+0x379/0x450
ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff888103787000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1536 bytes inside of
2048-byte region [ffff888103787000, ffff888103787800)
Memory state around the buggy address:
ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221116142952.518241-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 17 ++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -91,6 +91,9 @@
#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
+#define BRCMF_MAX_CHANSPEC_LIST \
+ (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
+
static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
{
if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
@@ -6556,6 +6559,13 @@ static int brcmf_construct_chaninfo(stru
band->channels[i].flags = IEEE80211_CHAN_DISABLED;
total = le32_to_cpu(list->count);
+ if (total > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ total);
+ err = -EINVAL;
+ goto fail_pbuf;
+ }
+
for (i = 0; i < total; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
@@ -6701,6 +6711,13 @@ static int brcmf_enable_bw40_2g(struct b
band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
list = (struct brcmf_chanspec_list *)pbuf;
num_chan = le32_to_cpu(list->count);
+ if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
+ num_chan);
+ kfree(pbuf);
+ return -EINVAL;
+ }
+
for (i = 0; i < num_chan; i++) {
ch.chspec = (u16)le32_to_cpu(list->element[i]);
cfg->d11inf.decchspec(&ch);
next prev parent reply other threads:[~2023-02-07 13:08 UTC|newest]
Thread overview: 222+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-07 12:54 [PATCH 6.1 000/208] 6.1.11-rc1 review Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 001/208] firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 002/208] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 003/208] arm64: dts: imx8m-venice: Remove incorrect uart-has-rtscts Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 004/208] arm64: dts: freescale: imx8dxl: fix sc_pwrkeys property name linux,keycode Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 005/208] ASoC: amd: acp-es8336: Drop reference count of ACPI device after use Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 006/208] ASoC: Intel: bytcht_es8316: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 007/208] ASoC: Intel: bytcr_rt5651: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 008/208] ASoC: Intel: bytcr_rt5640: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 009/208] ASoC: Intel: bytcr_wm5102: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 010/208] ASoC: Intel: sof_es8336: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 011/208] ASoC: Intel: avs: Implement PCI shutdown Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 012/208] selftests/vm: remove __USE_GNU in hugetlb-madvise.c Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 013/208] bpf: Fix off-by-one error in bpf_mem_cache_idx() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 014/208] bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 015/208] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 016/208] bpf: Fix to preserve reg parent/live fields when copying range info Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 017/208] selftests/filesystems: grant executable permission to run_fat_tests.sh Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 018/208] ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 019/208] bpf: Add missing btf_put to register_btf_id_dtor_kfuncs Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 020/208] media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 021/208] bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 022/208] arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 023/208] arm64: dts: imx8mm-verdin: Do not power down eth-phy Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 024/208] drm/vc4: hdmi: make CEC adapter name unique Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 025/208] drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 026/208] scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 027/208] bpf: Fix the kernel crash caused by bpf_setsockopt() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 028/208] ALSA: memalloc: Workaround for Xen PV Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 029/208] vhost/net: Clear the pending messages when the backend is removed Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 030/208] copy_oldmem_kernel() - WRITE is "data source", not destination Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 031/208] " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 032/208] READ is "data destination", not source Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 033/208] zcore: WRITE is "data source", not destination Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 034/208] memcpy_real(): " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 035/208] fix iov_iter_bvec() "direction" argument Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 036/208] fix direction argument of iov_iter_{init,bvec}() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 037/208] fix "direction" argument of iov_iter_kvec() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 038/208] use less confusing names for iov_iter direction initializers Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 039/208] vhost-scsi: unbreak any layout for response Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 040/208] ice: Prevent set_channel from changing queues while RDMA active Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 041/208] qede: execute xdp_do_flush() before napi_complete_done() Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 042/208] virtio-net: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 043/208] dpaa_eth: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 044/208] dpaa2-eth: " Greg Kroah-Hartman
2023-02-07 12:54 ` [PATCH 6.1 045/208] skb: Do mix page pool and page referenced frags in GRO Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 046/208] sfc: correctly advertise tunneled IPv6 segmentation Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 047/208] net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 048/208] net: wwan: t7xx: Fix Runtime PM initialization Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 049/208] block, bfq: replace 0/1 with false/true in bic apis Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 050/208] block, bfq: fix uaf for bfqq in bic_set_bfqq() Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 051/208] netrom: Fix use-after-free caused by accept on already connected socket Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 052/208] fscache: Use wait_on_bit() to wait for the freeing of relinquished volume Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 053/208] platform/x86/amd/pmf: update to auto-mode limits only after AMT event Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 054/208] platform/x86/amd/pmf: Add helper routine to update SPS thermals Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 055/208] platform/x86/amd/pmf: Fix to update SPS default pprof thermals Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 056/208] platform/x86/amd/pmf: Add helper routine to check pprof is balanced Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 057/208] platform/x86/amd/pmf: Fix to update SPS thermals when power supply change Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 058/208] platform/x86/amd/pmf: Ensure mutexes are initialized before use Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 059/208] platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255 Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 060/208] drm/i915/guc: Fix locking when searching for a hung request Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 061/208] drm/i915: Fix request ref counting during error capture & debugfs dump Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 062/208] drm/i915: Fix up locking around dumping requests lists Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 063/208] drm/i915/adlp: Fix typo for reference clock Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 064/208] net/tls: tls_is_tx_ready() checked list_entry Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 065/208] ALSA: firewire-motu: fix unreleased lock warning in hwdep device Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 066/208] netfilter: br_netfilter: disable sabotage_in hook after first suppression Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 067/208] block: ublk: extending queue_size to fix overflow Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 068/208] kunit: fix kunit_test_init_section_suites(...) Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 069/208] squashfs: harden sanity check in squashfs_read_xattr_id_table Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 070/208] maple_tree: should get pivots boundary by type Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 071/208] sctp: do not check hb_timer.expires when resetting hb_timer Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 072/208] net: phy: meson-gxl: Add generic dummy stubs for MMD register access Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 073/208] drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 074/208] ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 075/208] ip/ip6_gre: Fix non-point-to-point tunnel " Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 076/208] riscv: kprobe: Fixup kernel panic when probing an illegal position Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 077/208] igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 078/208] octeontx2-af: Fix devlink unregister Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 079/208] can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 080/208] can: raw: fix CAN FD frame transmissions over CAN XL devices Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 081/208] can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 082/208] ata: libata: Fix sata_down_spd_limit() when no link speed is reported Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 083/208] selftests: net: udpgso_bench_rx: Fix used uninitialized compiler warning Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 084/208] selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 085/208] selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 086/208] selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 087/208] virtio-net: Keep stop() to follow mirror sequence of open() Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 088/208] net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 089/208] efi: fix potential NULL deref in efi_mem_reserve_persistent Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 090/208] rtc: sunplus: fix format string for printing resource Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 091/208] certs: Fix build error when PKCS#11 URI contains semicolon Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 092/208] kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 093/208] i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 094/208] i2c: mxs: suppress probe-deferral error message Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 095/208] scsi: target: core: Fix warning on RT kernels Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 096/208] x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 097/208] perf/x86/intel: Add Emerald Rapids Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 098/208] perf/x86/intel/cstate: " Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 099/208] scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 100/208] scsi: iscsi_tcp: Fix UAF during login " Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 101/208] i2c: rk3x: fix a bunch of kernel-doc warnings Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 102/208] Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one" Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 103/208] x86/build: Move -mindirect-branch-cs-prefix out of GCC-only block Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 104/208] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Greg Kroah-Hartman
2023-02-07 12:55 ` [PATCH 6.1 105/208] platform/x86: hp-wmi: Handle Omen Key event Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 106/208] platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 107/208] platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 108/208] net/x25: Fix to not accept on connected socket Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 109/208] drm/amd/display: Fix timing not changning when freesync video is enabled Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 110/208] bcache: Silence memcpy() run-time false positive warnings Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 111/208] iio: adc: stm32-dfsdm: fill module aliases Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 112/208] usb: dwc3: qcom: enable vbus override when in OTG dr-mode Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 113/208] usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 114/208] vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 115/208] fbcon: Check font dimension limits Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 116/208] cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 117/208] hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 118/208] ARM: dts: imx7d-smegw01: Fix USB host over-current polarity Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 119/208] net: qrtr: free memory on error path in radix_tree_insert() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 120/208] can: isotp: split tx timer into transmission and timeout Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 121/208] can: isotp: handle wait_event_interruptible() return values Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 122/208] watchdog: diag288_wdt: do not use stack buffers for hardware data Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 123/208] watchdog: diag288_wdt: fix __diag288() inline assembly Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 124/208] ALSA: hda/realtek: Add Acer Predator PH315-54 Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 125/208] ALSA: hda/realtek: fix mute/micmute LEDs, speaker dont work for a HP platform Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 126/208] ASoC: codecs: wsa883x: correct playback min/max rates Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 127/208] ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0 Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 128/208] ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 129/208] ASoC: SOF: keep prepare/unprepare widgets in sink path Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 130/208] efi: Accept version 2 of memory attributes table Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 131/208] rtc: efi: Enable SET/GET WAKEUP services as optional Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 132/208] iio: hid: fix the retval in accel_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 133/208] iio: hid: fix the retval in gyro_3d_capture_sample Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 134/208] iio: adc: xilinx-ams: fix devm_krealloc() return value check Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 135/208] iio: adc: berlin2-adc: Add missing of_node_put() in error path Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 136/208] iio: imx8qxp-adc: fix irq flood when call imx8qxp_adc_read_raw() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 137/208] iio:adc:twl6030: Enable measurements of VUSB, VBAT and others Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 138/208] iio: light: cm32181: Fix PM support on system with 2 I2C resources Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 139/208] iio: imu: fxos8700: fix ACCEL measurement range selection Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 140/208] iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 141/208] iio: imu: fxos8700: fix IMU data bits returned to user space Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 142/208] iio: imu: fxos8700: fix map label of channel type to MAGN sensor Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 143/208] iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 144/208] iio: imu: fxos8700: fix incorrect ODR mode readback Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 145/208] iio: imu: fxos8700: fix failed initialization ODR mode assignment Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 146/208] iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 147/208] iio: imu: fxos8700: fix MAGN sensor scale and unit Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 148/208] nvmem: brcm_nvram: Add check for kzalloc Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 149/208] nvmem: sunxi_sid: Always use 32-bit MMIO reads Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 150/208] nvmem: qcom-spmi-sdam: fix module autoloading Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 151/208] parisc: Fix return code of pdc_iodc_print() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 152/208] parisc: Replace hardcoded value with PRIV_USER constant in ptrace.c Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 153/208] parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 154/208] riscv: disable generation of unwind tables Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 155/208] Revert "mm: kmemleak: alloc gray object for reserved region with direct map" Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 156/208] mm: multi-gen LRU: fix crash during cgroup migration Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 157/208] mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 158/208] mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 159/208] usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 160/208] usb: typec: ucsi: Dont attempt to resume the ports before they exist Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 161/208] usb: gadget: udc: do not clear gadget driver.bus Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 162/208] kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 163/208] HV: hv_balloon: " Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 164/208] x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses Greg Kroah-Hartman
2023-02-07 12:56 ` [PATCH 6.1 165/208] fpga: m10bmc-sec: Fix probe rollback Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 166/208] fpga: stratix10-soc: Fix return value check in s10_ops_write_init() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 167/208] mm/uffd: fix pte marker when fork() without fork event Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 168/208] mm/swapfile: add cond_resched() in get_swap_pages() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 169/208] mm/khugepaged: fix ->anon_vma race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 170/208] mm, mremap: fix mremap() expanding for vmas with vm_ops->close() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 171/208] mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 172/208] highmem: round down the address passed to kunmap_flush_on_unmap() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 173/208] ia64: fix build error due to switch case label appearing next to declaration Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 174/208] Squashfs: fix handling and sanity checking of xattr_ids count Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 175/208] maple_tree: fix mas_empty_area_rev() lower bound validation Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 176/208] migrate: hugetlb: check for hugetlb shared PMD in node migration Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 177/208] dma-buf: actually set signaling bit for private stub fences Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 178/208] serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 179/208] drm/i915: Avoid potential vm use-after-free Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 180/208] drm/i915: Fix potential bit_17 double-free Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 181/208] drm/amd: Fix initialization for nbio 4.3.0 Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 182/208] drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11 Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 183/208] drm/amdgpu: update wave data type to 3 for gfx11 Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 184/208] nvmem: core: initialise nvmem->id early Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 185/208] nvmem: core: remove nvmem_config wp_gpio Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 186/208] nvmem: core: fix cleanup after dev_set_name() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 187/208] nvmem: core: fix registration vs use race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 188/208] nvmem: core: fix device node refcounting Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 189/208] nvmem: core: fix cell removal on error Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 190/208] nvmem: core: fix return value Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 191/208] phy: qcom-qmp-combo: fix runtime suspend Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 192/208] serial: 8250_dma: Fix DMA Rx completion race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 193/208] serial: 8250_dma: Fix DMA Rx rearm race Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 194/208] platform/x86/amd: pmc: add CONFIG_SERIO dependency Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 195/208] ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on sink failure Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 196/208] iio:adc:twl6030: Enable measurement of VAC Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 197/208] powerpc/64s/radix: Fix crash with unaligned relocated kernel Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 198/208] powerpc/64s: Fix local irq disable when PMIs are disabled Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 199/208] powerpc/imc-pmu: Revert nest_init_lock to being a mutex Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 200/208] fs/ntfs3: Validate attribute data and valid sizes Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 201/208] ovl: Use "buf" flexible array for memcpy() destination Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 202/208] f2fs: initialize locks earlier in f2fs_fill_super() Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 203/208] fbdev: smscufx: fix error handling code in ufx_usb_probe Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 204/208] f2fs: fix to do sanity check on i_extra_isize in is_alive() Greg Kroah-Hartman
2023-02-07 12:57 ` Greg Kroah-Hartman [this message]
2023-02-07 12:57 ` [PATCH 6.1 206/208] gfs2: Cosmetic gfs2_dinode_{in,out} cleanup Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 207/208] gfs2: Always check inode size of inline inodes Greg Kroah-Hartman
2023-02-07 12:57 ` [PATCH 6.1 208/208] bpf: Skip invalid kfunc call in backtrack_insn Greg Kroah-Hartman
2023-02-07 14:57 ` [PATCH 6.1 000/208] 6.1.11-rc1 review Conor Dooley
2023-02-07 15:08 ` Jon Hunter
2023-02-07 17:05 ` Naresh Kamboju
2023-02-07 17:26 ` Peter Xu
2023-02-09 10:24 ` Greg Kroah-Hartman
2023-02-07 21:21 ` Shuah Khan
2023-02-08 1:52 ` Florian Fainelli
2023-02-08 3:39 ` Bagas Sanjaya
2023-02-08 5:21 ` Guenter Roeck
2023-02-08 9:10 ` Ron Economos
2023-02-08 12:43 ` Rudi Heitbaum
2023-02-08 17:05 ` Allen Pais
2023-02-08 18:45 ` Justin Forbes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230207125643.804784297@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=arend.vanspriel@broadcom.com \
--cc=dokyungs@yonsei.ac.kr \
--cc=jisoo.jang@yonsei.ac.kr \
--cc=kvalo@kernel.org \
--cc=linuxlovemin@yonsei.ac.kr \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.