From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, valis <sec@valis.email>,
Jamal Hadi Salim <jhs@mojatatu.com>,
Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 138/186] net: sched: sch_qfq: Fix UAF in qfq_dequeue()
Date: Wed, 20 Sep 2023 13:30:41 +0200 [thread overview]
Message-ID: <20230920112841.980710280@linuxfoundation.org> (raw)
In-Reply-To: <20230920112836.799946261@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: valis <sec@valis.email>
[ Upstream commit 8fc134fee27f2263988ae38920bc03da416b03d8 ]
When the plug qdisc is used as a class of the qfq qdisc it could trigger a
UAF. This issue can be reproduced with following commands:
tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1
and boom:
[ 285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0
[ 285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144
[ 285.355903]
[ 285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4
[ 285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[ 285.358376] Call Trace:
[ 285.358773] <IRQ>
[ 285.359109] dump_stack_lvl+0x44/0x60
[ 285.359708] print_address_description.constprop.0+0x2c/0x3c0
[ 285.360611] kasan_report+0x10c/0x120
[ 285.361195] ? qfq_dequeue+0xa7/0x7f0
[ 285.361780] qfq_dequeue+0xa7/0x7f0
[ 285.362342] __qdisc_run+0xf1/0x970
[ 285.362903] net_tx_action+0x28e/0x460
[ 285.363502] __do_softirq+0x11b/0x3de
[ 285.364097] do_softirq.part.0+0x72/0x90
[ 285.364721] </IRQ>
[ 285.365072] <TASK>
[ 285.365422] __local_bh_enable_ip+0x77/0x90
[ 285.366079] __dev_queue_xmit+0x95f/0x1550
[ 285.366732] ? __pfx_csum_and_copy_from_iter+0x10/0x10
[ 285.367526] ? __pfx___dev_queue_xmit+0x10/0x10
[ 285.368259] ? __build_skb_around+0x129/0x190
[ 285.368960] ? ip_generic_getfrag+0x12c/0x170
[ 285.369653] ? __pfx_ip_generic_getfrag+0x10/0x10
[ 285.370390] ? csum_partial+0x8/0x20
[ 285.370961] ? raw_getfrag+0xe5/0x140
[ 285.371559] ip_finish_output2+0x539/0xa40
[ 285.372222] ? __pfx_ip_finish_output2+0x10/0x10
[ 285.372954] ip_output+0x113/0x1e0
[ 285.373512] ? __pfx_ip_output+0x10/0x10
[ 285.374130] ? icmp_out_count+0x49/0x60
[ 285.374739] ? __pfx_ip_finish_output+0x10/0x10
[ 285.375457] ip_push_pending_frames+0xf3/0x100
[ 285.376173] raw_sendmsg+0xef5/0x12d0
[ 285.376760] ? do_syscall_64+0x40/0x90
[ 285.377359] ? __static_call_text_end+0x136578/0x136578
[ 285.378173] ? do_syscall_64+0x40/0x90
[ 285.378772] ? kasan_enable_current+0x11/0x20
[ 285.379469] ? __pfx_raw_sendmsg+0x10/0x10
[ 285.380137] ? __sock_create+0x13e/0x270
[ 285.380673] ? __sys_socket+0xf3/0x180
[ 285.381174] ? __x64_sys_socket+0x3d/0x50
[ 285.381725] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.382425] ? __rcu_read_unlock+0x48/0x70
[ 285.382975] ? ip4_datagram_release_cb+0xd8/0x380
[ 285.383608] ? __pfx_ip4_datagram_release_cb+0x10/0x10
[ 285.384295] ? preempt_count_sub+0x14/0xc0
[ 285.384844] ? __list_del_entry_valid+0x76/0x140
[ 285.385467] ? _raw_spin_lock_bh+0x87/0xe0
[ 285.386014] ? __pfx__raw_spin_lock_bh+0x10/0x10
[ 285.386645] ? release_sock+0xa0/0xd0
[ 285.387148] ? preempt_count_sub+0x14/0xc0
[ 285.387712] ? freeze_secondary_cpus+0x348/0x3c0
[ 285.388341] ? aa_sk_perm+0x177/0x390
[ 285.388856] ? __pfx_aa_sk_perm+0x10/0x10
[ 285.389441] ? check_stack_object+0x22/0x70
[ 285.390032] ? inet_send_prepare+0x2f/0x120
[ 285.390603] ? __pfx_inet_sendmsg+0x10/0x10
[ 285.391172] sock_sendmsg+0xcc/0xe0
[ 285.391667] __sys_sendto+0x190/0x230
[ 285.392168] ? __pfx___sys_sendto+0x10/0x10
[ 285.392727] ? kvm_clock_get_cycles+0x14/0x30
[ 285.393328] ? set_normalized_timespec64+0x57/0x70
[ 285.393980] ? _raw_spin_unlock_irq+0x1b/0x40
[ 285.394578] ? __x64_sys_clock_gettime+0x11c/0x160
[ 285.395225] ? __pfx___x64_sys_clock_gettime+0x10/0x10
[ 285.395908] ? _copy_to_user+0x3e/0x60
[ 285.396432] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.397086] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.397734] ? do_syscall_64+0x71/0x90
[ 285.398258] __x64_sys_sendto+0x74/0x90
[ 285.398786] do_syscall_64+0x64/0x90
[ 285.399273] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.399949] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.400605] ? do_syscall_64+0x71/0x90
[ 285.401124] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.401807] RIP: 0033:0x495726
[ 285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09
[ 285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726
[ 285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000
[ 285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c
[ 285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634
[ 285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000
[ 285.410403] </TASK>
[ 285.410704]
[ 285.410929] Allocated by task 144:
[ 285.411402] kasan_save_stack+0x1e/0x40
[ 285.411926] kasan_set_track+0x21/0x30
[ 285.412442] __kasan_slab_alloc+0x55/0x70
[ 285.412973] kmem_cache_alloc_node+0x187/0x3d0
[ 285.413567] __alloc_skb+0x1b4/0x230
[ 285.414060] __ip_append_data+0x17f7/0x1b60
[ 285.414633] ip_append_data+0x97/0xf0
[ 285.415144] raw_sendmsg+0x5a8/0x12d0
[ 285.415640] sock_sendmsg+0xcc/0xe0
[ 285.416117] __sys_sendto+0x190/0x230
[ 285.416626] __x64_sys_sendto+0x74/0x90
[ 285.417145] do_syscall_64+0x64/0x90
[ 285.417624] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.418306]
[ 285.418531] Freed by task 144:
[ 285.418960] kasan_save_stack+0x1e/0x40
[ 285.419469] kasan_set_track+0x21/0x30
[ 285.419988] kasan_save_free_info+0x27/0x40
[ 285.420556] ____kasan_slab_free+0x109/0x1a0
[ 285.421146] kmem_cache_free+0x1c2/0x450
[ 285.421680] __netif_receive_skb_core+0x2ce/0x1870
[ 285.422333] __netif_receive_skb_one_core+0x97/0x140
[ 285.423003] process_backlog+0x100/0x2f0
[ 285.423537] __napi_poll+0x5c/0x2d0
[ 285.424023] net_rx_action+0x2be/0x560
[ 285.424510] __do_softirq+0x11b/0x3de
[ 285.425034]
[ 285.425254] The buggy address belongs to the object at ffff8880bad31280
[ 285.425254] which belongs to the cache skbuff_head_cache of size 224
[ 285.426993] The buggy address is located 40 bytes inside of
[ 285.426993] freed 224-byte region [ffff8880bad31280, ffff8880bad31360)
[ 285.428572]
[ 285.428798] The buggy address belongs to the physical page:
[ 285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31
[ 285.430758] flags: 0x100000000000200(slab|node=0|zone=1)
[ 285.431447] page_type: 0xffffffff()
[ 285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000
[ 285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 285.433562] page dumped because: kasan: bad access detected
[ 285.434144]
[ 285.434320] Memory state around the buggy address:
[ 285.434828] ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.435580] ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 285.436777] ^
[ 285.437106] ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 285.437616] ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.438126] ==================================================================
[ 285.438662] Disabling lock debugging due to kernel taint
Fix this by:
1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a
function compatible with non-work-conserving qdiscs
2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq.
Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: valis <sec@valis.email>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_plug.c | 2 +-
net/sched/sch_qfq.c | 22 +++++++++++++++++-----
2 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
index 1c6cbab3e7b99..27a0c028ba338 100644
--- a/net/sched/sch_plug.c
+++ b/net/sched/sch_plug.c
@@ -212,7 +212,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
.priv_size = sizeof(struct plug_sched_data),
.enqueue = plug_enqueue,
.dequeue = plug_dequeue,
- .peek = qdisc_peek_head,
+ .peek = qdisc_peek_dequeued,
.init = plug_init,
.change = plug_change,
.reset = qdisc_reset_queue,
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 1a1366b037fb7..594c2ac319e02 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -984,10 +984,13 @@ static void qfq_update_eligible(struct qfq_sched *q)
}
/* Dequeue head packet of the head class in the DRR queue of the aggregate. */
-static void agg_dequeue(struct qfq_aggregate *agg,
- struct qfq_class *cl, unsigned int len)
+static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
+ struct qfq_class *cl, unsigned int len)
{
- qdisc_dequeue_peeked(cl->qdisc);
+ struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);
+
+ if (!skb)
+ return NULL;
cl->deficit -= (int) len;
@@ -997,6 +1000,8 @@ static void agg_dequeue(struct qfq_aggregate *agg,
cl->deficit += agg->lmax;
list_move_tail(&cl->alist, &agg->active);
}
+
+ return skb;
}
static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
@@ -1142,11 +1147,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
if (!skb)
return NULL;
- qdisc_qstats_backlog_dec(sch, skb);
sch->q.qlen--;
+
+ skb = agg_dequeue(in_serv_agg, cl, len);
+
+ if (!skb) {
+ sch->q.qlen++;
+ return NULL;
+ }
+
+ qdisc_qstats_backlog_dec(sch, skb);
qdisc_bstats_update(sch, skb);
- agg_dequeue(in_serv_agg, cl, len);
/* If lmax is lowered, through qfq_change_class, for a class
* owning pending packets with larger size than the new value
* of lmax, then the following condition may hold.
--
2.40.1
next prev parent reply other threads:[~2023-09-20 12:07 UTC|newest]
Thread overview: 192+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-20 11:28 [PATCH 4.14 000/186] 4.14.326-rc1 review Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 001/186] ARM: pxa: remove use of symbol_get() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 002/186] mmc: au1xmmc: force non-modular build and remove symbol_get usage Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 003/186] rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 004/186] modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 005/186] USB: serial: option: add Quectel EM05G variant (0x030e) Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 006/186] USB: serial: option: add FOXCONN T99W368/T99W373 product Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 007/186] HID: wacom: remove the battery when the EKR is off Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 008/186] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 009/186] serial: sc16is7xx: fix bug when first setting GPIO direction Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 010/186] nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 011/186] nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 012/186] pinctrl: amd: Dont show `Invalid config param` errors Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 013/186] lib/ubsan: remove returns-nonnull-attribute checks Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 014/186] 9p: virtio: make sure offs is initialized in zc_request Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 015/186] ASoC: da7219: Flush pending AAD IRQ when suspending Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 016/186] ethernet: atheros: fix return value check in atl1c_tso_csum() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 017/186] m68k: Fix invalid .section syntax Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 018/186] s390/dasd: use correct number of retries for ERP requests Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 019/186] fs/nls: make load_nls() take a const parameter Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 020/186] ASoc: codecs: ES8316: Fix DMIC config Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 021/186] security: keys: perform capable check only on privileged operations Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 022/186] net: usb: qmi_wwan: add Quectel EM05GV2 Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 023/186] idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 024/186] scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 025/186] netlabel: fix shift wrapping bug in netlbl_catmap_setlong() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 026/186] bnx2x: fix page fault following EEH recovery Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 027/186] sctp: handle invalid error codes without calling BUG() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 028/186] cifs: add a warning when the in-flight count goes negative Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 029/186] ALSA: seq: oss: Fix racy open/close of MIDI devices Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 030/186] powerpc/32: Include .branch_lt in data section Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 031/186] powerpc/32s: Fix assembler warning about r0 Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 032/186] udf: Check consistency of Space Bitmap Descriptor Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 033/186] udf: Handle error when adding extent to a file Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 034/186] Revert "net: macsec: preserve ingress frame ordering" Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 035/186] reiserfs: Check the return value from __getblk() Greg Kroah-Hartman
2023-09-20 11:28 ` [PATCH 4.14 036/186] fs: Fix error checking for d_hash_and_lookup() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 037/186] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 038/186] regmap: rbtree: Use alloc_flags for memory allocations Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 039/186] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 040/186] can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 041/186] wifi: mwifiex: Fix OOB and integer underflow when rx packets Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 042/186] Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 043/186] net: tcp: fix unexcepted socket die when snd_wnd is 0 Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 044/186] crypto: caam - fix unchecked return value error Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 045/186] lwt: Check LWTUNNEL_XMIT_CONTINUE strictly Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 046/186] fs: ocfs2: namei: check return value of ocfs2_add_entry() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 047/186] wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 048/186] wifi: mwifiex: Fix missed return in oob checks failed path Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 049/186] wifi: ath9k: protect WMI command response buffer replacement with a lock Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 050/186] wifi: mwifiex: avoid possible NULL skb pointer dereference Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 051/186] wifi: ath9k: use IS_ERR() with debugfs_create_dir() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 052/186] net: arcnet: Do not call kfree_skb() under local_irq_disable() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 053/186] netrom: Deny concurrent connect() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 054/186] ARM: dts: BCM53573: Add cells sizes to PCIe node Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 055/186] ARM: dts: BCM53573: Use updated "spi-gpio" binding properties Greg Kroah-Hartman
2023-09-20 12:49 ` Rafał Miłecki
2023-09-21 8:52 ` Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 056/186] ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 057/186] ARM: dts: samsung: s5pv210-smdkv210: " Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 058/186] drm: adv7511: Fix low refresh rate register for ADV7533/5 Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 059/186] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 060/186] smackfs: Prevent underflow in smk_set_cipso() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 061/186] audit: fix possible soft lockup in __audit_inode_child() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 062/186] ALSA: ac97: Fix possible error value of *rac97 Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 063/186] drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 064/186] clk: sunxi-ng: Modify mismatched function name Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 065/186] PCI: Mark NVIDIA T4 GPUs to avoid bus reset Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 066/186] PCI: pciehp: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 067/186] wifi: ath10k: " Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 068/186] nfs/blocklayout: Use the passed in gfp flags Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 069/186] powerpc/iommu: Fix notifiers being shared by PCI and VIO buses Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 070/186] jfs: validate max amount of blocks before allocation Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 071/186] fs: lockd: avoid possible wrong NULL parameter Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 072/186] NFSD: da_addr_body field missing in some GETDEVICEINFO replies Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 073/186] drivers: usb: smsusb: fix error handling code in smsusb_init_device Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 074/186] media: dib7000p: Fix potential division by zero Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 075/186] media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 076/186] media: cx24120: Add retval check for cx24120_message_send() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 077/186] media: mediatek: vcodec: Return NULL if no vdec_fb is found Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 078/186] usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 079/186] scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 080/186] scsi: be2iscsi: Add length check when parsing nlattrs Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 081/186] scsi: qla4xxx: " Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 082/186] x86/APM: drop the duplicate APM_MINOR_DEV macro Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 083/186] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 084/186] scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 085/186] dma-buf/sync_file: Fix docs syntax Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 086/186] media: go7007: Remove redundant if statement Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 087/186] USB: gadget: f_mass_storage: Fix unused variable warning Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 088/186] cgroup:namespace: Remove unused cgroup_namespaces_init() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 089/186] scsi: core: Use 32-bit hostnum in scsi_host_lookup() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 090/186] scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 091/186] serial: tegra: handle clk prepare error in tegra_uart_hw_init() Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 092/186] amba: bus: fix refcount leak Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 093/186] Revert "IB/isert: Fix incorrect release of isert connection" Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 094/186] HID: multitouch: Correct devm device reference for hidinput input_dev name Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 095/186] rpmsg: glink: Add check for kstrdup Greg Kroah-Hartman
2023-09-20 11:29 ` [PATCH 4.14 096/186] dmaengine: ste_dma40: Add missing IRQ check in d40_probe Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 097/186] igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 098/186] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 099/186] netfilter: xt_u32: validate user space input Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 100/186] netfilter: xt_sctp: validate the flag_info count Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 101/186] igb: set max size RX buffer when store bad packet is enabled Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 102/186] PM / devfreq: Fix leak in devfreq_dev_release() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 103/186] ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 104/186] ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 105/186] backlight/gpio_backlight: Compare against struct fb_info.device Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 106/186] backlight/bd6107: " Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 107/186] backlight/lv5207lp: " Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 108/186] media: dvb: symbol fixup for dvb_attach() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 109/186] ntb: Drop packets when qp link is down Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 110/186] ntb: Clean up tx tail index on link down Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 111/186] ntb: Fix calculation ntb_transport_tx_free_entry() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 112/186] Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 113/186] procfs: block chmod on /proc/thread-self/comm Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 114/186] parisc: Fix /proc/cpuinfo output for lscpu Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 115/186] dccp: Fix out of bounds access in DCCP error handler Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 116/186] X.509: if signature is unsupported skip validation Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 117/186] net: handle ARPHRD_PPP in dev_is_mac_header_xmit() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 118/186] pstore/ram: Check start of empty przs during init Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 119/186] crypto: stm32 - fix loop iterating through scatterlist for DMA Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 120/186] scsi: qla2xxx: fix inconsistent TMF timeout Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 121/186] scsi: qla2xxx: Turn off noisy message log Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 122/186] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 123/186] drm/ast: Fix DRAM init on AST2200 Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 124/186] parisc: led: Fix LAN receive and transmit LEDs Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 125/186] parisc: led: Reduce CPU overhead for disk & lan LED computation Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 126/186] clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 127/186] NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 128/186] x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 129/186] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 130/186] pwm: lpc32xx: Remove handling of PWM channels Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 131/186] net: read sk->sk_family once in sk_mc_loop() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 132/186] igb: disable virtualization features on 82580 Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 133/186] net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 134/186] af_unix: Fix data-races around user->unix_inflight Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 135/186] af_unix: Fix data-race around unix_tot_inflight Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 136/186] af_unix: Fix data-races around sk->sk_shutdown Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 137/186] af_unix: Fix data race around sk->sk_err Greg Kroah-Hartman
2023-09-20 11:30 ` Greg Kroah-Hartman [this message]
2023-09-20 11:30 ` [PATCH 4.14 139/186] kcm: Destroy mutex in kcm_exit_net() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 140/186] igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 141/186] igb: Change IGB_MIN " Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 142/186] ata: sata_gemini: Add missing MODULE_DESCRIPTION Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 143/186] ata: pata_ftide010: " Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 144/186] net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 145/186] kcm: Fix memory leak in error path of kcm_sendmsg() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 146/186] ixgbe: fix timestamp configuration code Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 147/186] kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 148/186] parisc: Drop loops_per_jiffy from per_cpu struct Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 149/186] autofs: fix memory leak of waitqueues in autofs_catatonic_mode Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 150/186] btrfs: output extra debug info if we failed to find an inline backref Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 151/186] ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 152/186] ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 153/186] hw_breakpoint: fix single-stepping when using bpf_overflow_handler Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 154/186] wifi: ath9k: fix printk specifier Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 155/186] wifi: mwifiex: fix fortify warning Greg Kroah-Hartman
2023-09-20 11:30 ` [PATCH 4.14 156/186] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 157/186] tpm_tis: Resend command to recover from data transfer errors Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 158/186] alx: fix OOB-read compiler warning Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 159/186] drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 160/186] md: raid1: fix potential OOB in raid1_remove_disk() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 161/186] ext2: fix datatype of block number in ext2_xattr_set2() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 162/186] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 163/186] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 164/186] powerpc/pseries: fix possible memory leak in ibmebus_bus_init() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 165/186] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 166/186] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 167/186] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 168/186] media: anysee: fix null-ptr-deref in anysee_master_xfer Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 169/186] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 170/186] iio: core: Use min() instead of min_t() to make code more robust Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 171/186] media: tuners: qt1010: replace BUG_ON with a regular error Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 172/186] media: pci: cx23885: replace BUG with error return Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 173/186] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 174/186] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 175/186] serial: cpm_uart: Avoid suspicious locking Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 176/186] kobject: Add sanity check for kset->kobj.ktype in kset_register() Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 177/186] md/raid1: fix error: ISO C90 forbids mixed declarations Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 178/186] attr: block mode changes of symlinks Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 179/186] btrfs: fix lockdep splat and potential deadlock after failure running delayed items Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 180/186] nfsd: fix change_info in NFSv4 RENAME replies Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 181/186] mtd: rawnand: brcmnand: Fix crash during the panic_write Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 182/186] mtd: rawnand: brcmnand: Fix potential false time out warning Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 183/186] mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 184/186] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 185/186] net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free Greg Kroah-Hartman
2023-09-20 11:31 ` [PATCH 4.14 186/186] net/sched: Retire rsvp classifier Greg Kroah-Hartman
2023-09-21 12:47 ` [PATCH 4.14 000/186] 4.14.326-rc1 review Naresh Kamboju
2023-09-21 15:51 ` Guenter Roeck
2023-09-22 9:46 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230920112841.980710280@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jhs@mojatatu.com \
--cc=pabeni@redhat.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=sec@valis.email \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).