From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 25/93] dccp: fix use-after-free in dccp_feat_activate_values
Date: Mon, 20 Mar 2017 18:51:00 +0100 [thread overview]
Message-ID: <20170320174736.537667253@linuxfoundation.org> (raw)
In-Reply-To: <20170320174735.243147498@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 62f8f4d9066c1c6f2474845d1ca7e2891f2ae3fd ]
Dmitry reported crashes in DCCP stack [1]
Problem here is that when I got rid of listener spinlock, I missed the
fact that DCCP stores a complex state in struct dccp_request_sock,
while TCP does not.
Since multiple cpus could access it at the same time, we need to add
protection.
[1]
BUG: KASAN: use-after-free in dccp_feat_activate_values+0x967/0xab0
net/dccp/feat.c:1541 at addr ffff88003713be68
Read of size 8 by task syz-executor2/8457
CPU: 2 PID: 8457 Comm: syz-executor2 Not tainted 4.10.0-rc7+ #127
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x292/0x398 lib/dump_stack.c:51
kasan_object_err+0x1c/0x70 mm/kasan/report.c:162
print_address_description mm/kasan/report.c:200 [inline]
kasan_report_error mm/kasan/report.c:289 [inline]
kasan_report.part.1+0x20e/0x4e0 mm/kasan/report.c:311
kasan_report mm/kasan/report.c:332 [inline]
__asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:332
dccp_feat_activate_values+0x967/0xab0 net/dccp/feat.c:1541
dccp_create_openreq_child+0x464/0x610 net/dccp/minisocks.c:121
dccp_v6_request_recv_sock+0x1f6/0x1960 net/dccp/ipv6.c:457
dccp_check_req+0x335/0x5a0 net/dccp/minisocks.c:186
dccp_v6_rcv+0x69e/0x1d00 net/dccp/ipv6.c:711
ip6_input_finish+0x46d/0x17a0 net/ipv6/ip6_input.c:279
NF_HOOK include/linux/netfilter.h:257 [inline]
ip6_input+0xdb/0x590 net/ipv6/ip6_input.c:322
dst_input include/net/dst.h:507 [inline]
ip6_rcv_finish+0x289/0x890 net/ipv6/ip6_input.c:69
NF_HOOK include/linux/netfilter.h:257 [inline]
ipv6_rcv+0x12ec/0x23d0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x1ae5/0x3400 net/core/dev.c:4190
__netif_receive_skb+0x2a/0x170 net/core/dev.c:4228
process_backlog+0xe5/0x6c0 net/core/dev.c:4839
napi_poll net/core/dev.c:5202 [inline]
net_rx_action+0xe70/0x1900 net/core/dev.c:5267
__do_softirq+0x2fb/0xb7d kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902
</IRQ>
do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328
do_softirq kernel/softirq.c:176 [inline]
__local_bh_enable_ip+0x1f2/0x200 kernel/softirq.c:181
local_bh_enable include/linux/bottom_half.h:31 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:971 [inline]
ip6_finish_output2+0xbb0/0x23d0 net/ipv6/ip6_output.c:123
ip6_finish_output+0x302/0x960 net/ipv6/ip6_output.c:148
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip6_output+0x1cb/0x8d0 net/ipv6/ip6_output.c:162
ip6_xmit+0xcdf/0x20d0 include/net/dst.h:501
inet6_csk_xmit+0x320/0x5f0 net/ipv6/inet6_connection_sock.c:179
dccp_transmit_skb+0xb09/0x1120 net/dccp/output.c:141
dccp_xmit_packet+0x215/0x760 net/dccp/output.c:280
dccp_write_xmit+0x168/0x1d0 net/dccp/output.c:362
dccp_sendmsg+0x79c/0xb10 net/dccp/proto.c:796
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
SYSC_sendto+0x660/0x810 net/socket.c:1687
SyS_sendto+0x40/0x50 net/socket.c:1655
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x4458b9
RSP: 002b:00007f8ceb77bb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 00000000004458b9
RDX: 0000000000000023 RSI: 0000000020e60000 RDI: 0000000000000017
RBP: 00000000006e1b90 R08: 00000000200f9fe1 R09: 0000000000000020
R10: 0000000000008010 R11: 0000000000000282 R12: 00000000007080a8
R13: 0000000000000000 R14: 00007f8ceb77c9c0 R15: 00007f8ceb77c700
Object at ffff88003713be50, in cache kmalloc-64 size: 64
Allocated:
PID = 8446
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:502
set_track mm/kasan/kasan.c:514 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:605
kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2738
kmalloc include/linux/slab.h:490 [inline]
dccp_feat_entry_new+0x214/0x410 net/dccp/feat.c:467
dccp_feat_push_change+0x38/0x220 net/dccp/feat.c:487
__feat_register_sp+0x223/0x2f0 net/dccp/feat.c:741
dccp_feat_propagate_ccid+0x22b/0x2b0 net/dccp/feat.c:949
dccp_feat_server_ccid_dependencies+0x1b3/0x250 net/dccp/feat.c:1012
dccp_make_response+0x1f1/0xc90 net/dccp/output.c:423
dccp_v6_send_response+0x4ec/0xc20 net/dccp/ipv6.c:217
dccp_v6_conn_request+0xaba/0x11b0 net/dccp/ipv6.c:377
dccp_rcv_state_process+0x51e/0x1650 net/dccp/input.c:606
dccp_v6_do_rcv+0x213/0x350 net/dccp/ipv6.c:632
sk_backlog_rcv include/net/sock.h:893 [inline]
__sk_receive_skb+0x36f/0xcc0 net/core/sock.c:479
dccp_v6_rcv+0xba5/0x1d00 net/dccp/ipv6.c:742
ip6_input_finish+0x46d/0x17a0 net/ipv6/ip6_input.c:279
NF_HOOK include/linux/netfilter.h:257 [inline]
ip6_input+0xdb/0x590 net/ipv6/ip6_input.c:322
dst_input include/net/dst.h:507 [inline]
ip6_rcv_finish+0x289/0x890 net/ipv6/ip6_input.c:69
NF_HOOK include/linux/netfilter.h:257 [inline]
ipv6_rcv+0x12ec/0x23d0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x1ae5/0x3400 net/core/dev.c:4190
__netif_receive_skb+0x2a/0x170 net/core/dev.c:4228
process_backlog+0xe5/0x6c0 net/core/dev.c:4839
napi_poll net/core/dev.c:5202 [inline]
net_rx_action+0xe70/0x1900 net/core/dev.c:5267
__do_softirq+0x2fb/0xb7d kernel/softirq.c:284
Freed:
PID = 15
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:502
set_track mm/kasan/kasan.c:514 [inline]
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:578
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2954 [inline]
kfree+0xe8/0x2b0 mm/slub.c:3874
dccp_feat_entry_destructor.part.4+0x48/0x60 net/dccp/feat.c:418
dccp_feat_entry_destructor net/dccp/feat.c:416 [inline]
dccp_feat_list_pop net/dccp/feat.c:541 [inline]
dccp_feat_activate_values+0x57f/0xab0 net/dccp/feat.c:1543
dccp_create_openreq_child+0x464/0x610 net/dccp/minisocks.c:121
dccp_v6_request_recv_sock+0x1f6/0x1960 net/dccp/ipv6.c:457
dccp_check_req+0x335/0x5a0 net/dccp/minisocks.c:186
dccp_v6_rcv+0x69e/0x1d00 net/dccp/ipv6.c:711
ip6_input_finish+0x46d/0x17a0 net/ipv6/ip6_input.c:279
NF_HOOK include/linux/netfilter.h:257 [inline]
ip6_input+0xdb/0x590 net/ipv6/ip6_input.c:322
dst_input include/net/dst.h:507 [inline]
ip6_rcv_finish+0x289/0x890 net/ipv6/ip6_input.c:69
NF_HOOK include/linux/netfilter.h:257 [inline]
ipv6_rcv+0x12ec/0x23d0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x1ae5/0x3400 net/core/dev.c:4190
__netif_receive_skb+0x2a/0x170 net/core/dev.c:4228
process_backlog+0xe5/0x6c0 net/core/dev.c:4839
napi_poll net/core/dev.c:5202 [inline]
net_rx_action+0xe70/0x1900 net/core/dev.c:5267
__do_softirq+0x2fb/0xb7d kernel/softirq.c:284
Memory state around the buggy address:
ffff88003713bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88003713bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88003713be00: fc fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb
^
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/dccp.h | 1 +
net/dccp/minisocks.c | 24 ++++++++++++++++--------
2 files changed, 17 insertions(+), 8 deletions(-)
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -163,6 +163,7 @@ struct dccp_request_sock {
__u64 dreq_isr;
__u64 dreq_gsr;
__be32 dreq_service;
+ spinlock_t dreq_lock;
struct list_head dreq_featneg;
__u32 dreq_timestamp_echo;
__u32 dreq_timestamp_time;
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -146,6 +146,13 @@ struct sock *dccp_check_req(struct sock
struct dccp_request_sock *dreq = dccp_rsk(req);
bool own_req;
+ /* TCP/DCCP listeners became lockless.
+ * DCCP stores complex state in its request_sock, so we need
+ * a protection for them, now this code runs without being protected
+ * by the parent (listener) lock.
+ */
+ spin_lock_bh(&dreq->dreq_lock);
+
/* Check for retransmitted REQUEST */
if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
@@ -160,7 +167,7 @@ struct sock *dccp_check_req(struct sock
inet_rtx_syn_ack(sk, req);
}
/* Network Duplicate, discard packet */
- return NULL;
+ goto out;
}
DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
@@ -186,20 +193,20 @@ struct sock *dccp_check_req(struct sock
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
req, &own_req);
- if (!child)
- goto listen_overflow;
-
- return inet_csk_complete_hashdance(sk, child, req, own_req);
+ if (child) {
+ child = inet_csk_complete_hashdance(sk, child, req, own_req);
+ goto out;
+ }
-listen_overflow:
- dccp_pr_debug("listen_overflow!\n");
DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
drop:
if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET)
req->rsk_ops->send_reset(sk, skb);
inet_csk_reqsk_queue_drop(sk, req);
- return NULL;
+out:
+ spin_unlock_bh(&dreq->dreq_lock);
+ return child;
}
EXPORT_SYMBOL_GPL(dccp_check_req);
@@ -250,6 +257,7 @@ int dccp_reqsk_init(struct request_sock
{
struct dccp_request_sock *dreq = dccp_rsk(req);
+ spin_lock_init(&dreq->dreq_lock);
inet_rsk(req)->ir_rmt_port = dccp_hdr(skb)->dccph_sport;
inet_rsk(req)->ir_num = ntohs(dccp_hdr(skb)->dccph_dport);
inet_rsk(req)->acked = 0;
next prev parent reply other threads:[~2017-03-20 18:35 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-20 17:50 [PATCH 4.9 00/93] 4.9.17-stable review Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 01/93] net/mlx5e: Register/unregister vport representors on interface attach/detach Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 02/93] net/mlx5e: Do not reduce LRO WQE size when not using build_skb Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 03/93] net/mlx5e: Fix wrong CQE decompression Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 04/93] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 05/93] vti6: return GRE_KEY for vti6 Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 06/93] vxlan: dont allow overwrite of config src addr Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 07/93] ipv4: mask tos for input route Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 08/93] net sched actions: decrement module reference count after table flush Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 10/93] net: phy: Avoid deadlock during phy_error() Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 11/93] vxlan: lock RCU on TX path Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 12/93] geneve: " Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 13/93] mlxsw: spectrum_router: Avoid potential packets loss Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 14/93] tcp/dccp: block BH for SYN processing Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 15/93] net: bridge: allow IPv6 when multicast flood is disabled Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 16/93] net: dont call strlen() on the user buffer in packet_bind_spkt() Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 17/93] net: net_enable_timestamp() can be called from irq contexts Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 18/93] ipv6: orphan skbs in reassembly unit Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 19/93] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 20/93] strparser: destroy workqueue on module exit Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 21/93] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 22/93] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 23/93] net: fix socket refcounting in skb_complete_tx_timestamp() Greg Kroah-Hartman
2017-03-20 17:50 ` [PATCH 4.9 24/93] net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump Greg Kroah-Hartman
2017-03-20 17:51 ` Greg Kroah-Hartman [this message]
2017-03-20 17:51 ` [PATCH 4.9 26/93] vrf: Fix use-after-free in vrf_xmit Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 27/93] net/tunnel: set inner protocol in network gro hooks Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 28/93] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 30/93] mpls: Send route delete notifications when router module is unloaded Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 31/93] mpls: Do not decrement alive counter for unregister events Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 32/93] ipv6: make ECMP route replacement less greedy Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 33/93] ipv6: avoid write to a possibly cloned skb Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 34/93] bridge: drop netfilter fake rtable unconditionally Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 37/93] dccp: fix memory leak during tear-down of unsuccessful connection request Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 38/93] bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 39/93] bpf: fix state equivalence Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 40/93] bpf: fix regression on verifier pruning wrt map lookups Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 41/93] bpf: fix mark_reg_unknown_value for spilled regs on map value marking Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 42/93] dmaengine: iota: ioat_alloc_chan_resources should not perform sleeping allocations Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 43/93] xen: do not re-use pirq number cached in pci device msi msg data Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 44/93] igb: Workaround for igb i210 firmware issue Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 45/93] igb: add i211 to i210 PHY workaround Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 46/93] scsi: ibmvscsis: Issues from Dan Carpenter/Smatch Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 47/93] scsi: ibmvscsis: Return correct partition name/# to client Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 48/93] scsi: ibmvscsis: Clean up properly if target_submit_cmd/tmr fails Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 49/93] scsi: ibmvscsis: Rearrange functions for future patches Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 50/93] scsi: ibmvscsis: Synchronize cmds at tpg_enable_store time Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 51/93] scsi: ibmvscsis: Synchronize cmds at remove time Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 52/93] x86/hyperv: Handle unknown NMIs on one CPU when unknown_nmi_panic Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 53/93] PCI: Separate VF BAR updates from standard BAR updates Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 54/93] PCI: Remove pci_resource_bar() and pci_iov_resource_bar() Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 55/93] PCI: Add comments about ROM BAR updating Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 56/93] PCI: Decouple IORESOURCE_ROM_ENABLE and PCI_ROM_ADDRESS_ENABLE Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 57/93] PCI: Dont update VF BARs while VF memory space is enabled Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 58/93] PCI: Update BARs using property bits appropriate for type Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 59/93] PCI: Ignore BAR updates on virtual functions Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 60/93] PCI: Do any VF BAR updates before enabling the BARs Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 61/93] ibmveth: calculate gso_segs for large packets Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 62/93] Drivers: hv: ring_buffer: count on wrap around mappings in get_next_pkt_raw() (v2) Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 63/93] vfio/spapr: Postpone allocation of userspace version of TCE table Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 64/93] powerpc/iommu: Pass mm_struct to init/cleanup helpers Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 65/93] powerpc/iommu: Stop using @current in mm_iommu_xxx Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 66/93] vfio/spapr: Reference mm in tce_container Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 67/93] powerpc/mm/iommu, vfio/spapr: Put pages on VFIO container shutdown Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 68/93] vfio/spapr: Add a helper to create default DMA window Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 69/93] vfio/spapr: Postpone default window creation Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 70/93] drm/nouveau/disp/gp102: fix cursor/overlay immediate channel indices Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 71/93] drm/nouveau/disp/nv50-: split chid into chid.ctrl and chid.user Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 72/93] drm/nouveau/disp/nv50-: specify ctrl/user separately when constructing classes Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 73/93] block: allow WRITE_SAME commands with the SG_IO ioctl Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 74/93] s390/zcrypt: Introduce CEX6 toleration Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 75/93] [media] uvcvideo: uvc_scan_fallback() for webcams with broken chain Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 76/93] slub: move synchronize_sched out of slab_mutex on shrink Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 77/93] ACPI / blacklist: add _REV quirks for Dell Precision 5520 and 3520 Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 78/93] ACPI / blacklist: Make Dell Latitude 3350 ethernet work Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 79/93] serial: 8250_pci: Detach low-level driver during PCI error recovery Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 80/93] usb: gadget: udc: atmel: remove memory leak Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 82/93] clk: bcm2835: Fix ->fixed_divider of pllh_aux Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 83/93] drm/vc4: Fix race between page flip completion event and clean-up Greg Kroah-Hartman
2017-03-20 17:51 ` [PATCH 4.9 84/93] drm/vc4: Fix ->clock_select setting for the VEC encoder Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 85/93] arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 86/93] irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065 Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 87/93] x86/tsc: Fix ART for TSC_KNOWN_FREQ Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 88/93] x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 89/93] x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 90/93] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 91/93] futex: Add missing error handling to FUTEX_REQUEUE_PI Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 92/93] locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y Greg Kroah-Hartman
2017-03-20 17:52 ` [PATCH 4.9 93/93] crypto: powerpc - Fix initialisation of crc32c context Greg Kroah-Hartman
2017-03-21 0:12 ` [PATCH 4.9 00/93] 4.9.17-stable review Shuah Khan
2017-03-21 2:13 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170320174736.537667253@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).