stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>,
	"Eric W. Biederman" <ebiederm@xmission.com>
Subject: [PATCH 4.9 36/83] ptrace: Dont allow accessing an undumpable mm
Date: Wed,  4 Jan 2017 21:06:28 +0100	[thread overview]
Message-ID: <20170104200448.029330188@linuxfoundation.org> (raw)
In-Reply-To: <20170104200446.541604386@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric W. Biederman <ebiederm@xmission.com>

commit 84d77d3f06e7e8dea057d10e8ec77ad71f721be3 upstream.

It is the reasonable expectation that if an executable file is not
readable there will be no way for a user without special privileges to
read the file.  This is enforced in ptrace_attach but if ptrace
is already attached before exec there is no enforcement for read-only
executables.

As the only way to read such an mm is through access_process_vm
spin a variant called ptrace_access_vm that will fail if the
target process is not being ptraced by the current process, or
the current process did not have sufficient privileges when ptracing
began to read the target processes mm.

In the ptrace implementations replace access_process_vm by
ptrace_access_vm.  There remain several ptrace sites that still use
access_process_vm as they are reading the target executables
instructions (for kernel consumption) or register stacks.  As such it
does not appear necessary to add a permission check to those calls.

This bug has always existed in Linux.

Fixes: v1.0
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/alpha/kernel/ptrace.c         |    2 -
 arch/blackfin/kernel/ptrace.c      |    4 +--
 arch/cris/arch-v32/kernel/ptrace.c |    2 -
 arch/ia64/kernel/ptrace.c          |    2 -
 arch/mips/kernel/ptrace32.c        |    4 +--
 arch/powerpc/kernel/ptrace32.c     |    4 +--
 include/linux/mm.h                 |    2 +
 include/linux/ptrace.h             |    3 ++
 kernel/ptrace.c                    |   42 +++++++++++++++++++++++++++++++------
 mm/memory.c                        |    2 -
 mm/nommu.c                         |    2 -
 11 files changed, 52 insertions(+), 17 deletions(-)

--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -283,7 +283,7 @@ long arch_ptrace(struct task_struct *chi
 	/* When I and D space are separate, these will need to be fixed.  */
 	case PTRACE_PEEKTEXT: /* read word at location addr. */
 	case PTRACE_PEEKDATA:
-		copied = access_process_vm(child, addr, &tmp, sizeof(tmp),
+		copied = ptrace_access_vm(child, addr, &tmp, sizeof(tmp),
 				FOLL_FORCE);
 		ret = -EIO;
 		if (copied != sizeof(tmp))
--- a/arch/blackfin/kernel/ptrace.c
+++ b/arch/blackfin/kernel/ptrace.c
@@ -270,7 +270,7 @@ long arch_ptrace(struct task_struct *chi
 			switch (bfin_mem_access_type(addr, to_copy)) {
 			case BFIN_MEM_ACCESS_CORE:
 			case BFIN_MEM_ACCESS_CORE_ONLY:
-				copied = access_process_vm(child, addr, &tmp,
+				copied = ptrace_access_vm(child, addr, &tmp,
 							   to_copy, FOLL_FORCE);
 				if (copied)
 					break;
@@ -323,7 +323,7 @@ long arch_ptrace(struct task_struct *chi
 			switch (bfin_mem_access_type(addr, to_copy)) {
 			case BFIN_MEM_ACCESS_CORE:
 			case BFIN_MEM_ACCESS_CORE_ONLY:
-				copied = access_process_vm(child, addr, &data,
+				copied = ptrace_access_vm(child, addr, &data,
 				                           to_copy,
 							   FOLL_FORCE | FOLL_WRITE);
 				break;
--- a/arch/cris/arch-v32/kernel/ptrace.c
+++ b/arch/cris/arch-v32/kernel/ptrace.c
@@ -147,7 +147,7 @@ long arch_ptrace(struct task_struct *chi
 				/* The trampoline page is globally mapped, no page table to traverse.*/
 				tmp = *(unsigned long*)addr;
 			} else {
-				copied = access_process_vm(child, addr, &tmp, sizeof(tmp), FOLL_FORCE);
+				copied = ptrace_access_vm(child, addr, &tmp, sizeof(tmp), FOLL_FORCE);
 
 				if (copied != sizeof(tmp))
 					break;
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1159,7 +1159,7 @@ arch_ptrace (struct task_struct *child,
 	case PTRACE_PEEKTEXT:
 	case PTRACE_PEEKDATA:
 		/* read word at location addr */
-		if (access_process_vm(child, addr, &data, sizeof(data),
+		if (ptrace_access_vm(child, addr, &data, sizeof(data),
 				FOLL_FORCE)
 		    != sizeof(data))
 			return -EIO;
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -69,7 +69,7 @@ long compat_arch_ptrace(struct task_stru
 		if (get_user(addrOthers, (u32 __user * __user *) (unsigned long) addr) != 0)
 			break;
 
-		copied = access_process_vm(child, (u64)addrOthers, &tmp,
+		copied = ptrace_access_vm(child, (u64)addrOthers, &tmp,
 				sizeof(tmp), FOLL_FORCE);
 		if (copied != sizeof(tmp))
 			break;
@@ -178,7 +178,7 @@ long compat_arch_ptrace(struct task_stru
 		if (get_user(addrOthers, (u32 __user * __user *) (unsigned long) addr) != 0)
 			break;
 		ret = 0;
-		if (access_process_vm(child, (u64)addrOthers, &data,
+		if (ptrace_access_vm(child, (u64)addrOthers, &data,
 					sizeof(data),
 					FOLL_FORCE | FOLL_WRITE) == sizeof(data))
 			break;
--- a/arch/powerpc/kernel/ptrace32.c
+++ b/arch/powerpc/kernel/ptrace32.c
@@ -73,7 +73,7 @@ long compat_arch_ptrace(struct task_stru
 		if (get_user(addrOthers, (u32 __user * __user *)addr) != 0)
 			break;
 
-		copied = access_process_vm(child, (u64)addrOthers, &tmp,
+		copied = ptrace_access_vm(child, (u64)addrOthers, &tmp,
 				sizeof(tmp), FOLL_FORCE);
 		if (copied != sizeof(tmp))
 			break;
@@ -178,7 +178,7 @@ long compat_arch_ptrace(struct task_stru
 		if (get_user(addrOthers, (u32 __user * __user *)addr) != 0)
 			break;
 		ret = 0;
-		if (access_process_vm(child, (u64)addrOthers, &tmp,
+		if (ptrace_access_vm(child, (u64)addrOthers, &tmp,
 					sizeof(tmp),
 					FOLL_FORCE | FOLL_WRITE) == sizeof(tmp))
 			break;
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1270,6 +1270,8 @@ extern int access_process_vm(struct task
 		unsigned int gup_flags);
 extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
 		void *buf, int len, unsigned int gup_flags);
+extern int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+		unsigned long addr, void *buf, int len, unsigned int gup_flags);
 
 long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm,
 			    unsigned long start, unsigned long nr_pages,
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -8,6 +8,9 @@
 #include <linux/pid_namespace.h>	/* For task_active_pid_ns.  */
 #include <uapi/linux/ptrace.h>
 
+extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
+			    void *buf, int len, unsigned int gup_flags);
+
 /*
  * Ptrace flags
  *
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -27,6 +27,35 @@
 #include <linux/cn_proc.h>
 #include <linux/compat.h>
 
+/*
+ * Access another process' address space via ptrace.
+ * Source/target buffer must be kernel space,
+ * Do not walk the page table directly, use get_user_pages
+ */
+int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
+		     void *buf, int len, unsigned int gup_flags)
+{
+	struct mm_struct *mm;
+	int ret;
+
+	mm = get_task_mm(tsk);
+	if (!mm)
+		return 0;
+
+	if (!tsk->ptrace ||
+	    (current != tsk->parent) ||
+	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
+	     !ptracer_capable(tsk, mm->user_ns))) {
+		mmput(mm);
+		return 0;
+	}
+
+	ret = __access_remote_vm(tsk, mm, addr, buf, len, gup_flags);
+	mmput(mm);
+
+	return ret;
+}
+
 
 /*
  * ptrace a task: make the debugger its new parent and
@@ -535,7 +564,8 @@ int ptrace_readdata(struct task_struct *
 		int this_len, retval;
 
 		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
-		retval = access_process_vm(tsk, src, buf, this_len, FOLL_FORCE);
+		retval = ptrace_access_vm(tsk, src, buf, this_len, FOLL_FORCE);
+
 		if (!retval) {
 			if (copied)
 				break;
@@ -562,7 +592,7 @@ int ptrace_writedata(struct task_struct
 		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 		if (copy_from_user(buf, src, this_len))
 			return -EFAULT;
-		retval = access_process_vm(tsk, dst, buf, this_len,
+		retval = ptrace_access_vm(tsk, dst, buf, this_len,
 				FOLL_FORCE | FOLL_WRITE);
 		if (!retval) {
 			if (copied)
@@ -1126,7 +1156,7 @@ int generic_ptrace_peekdata(struct task_
 	unsigned long tmp;
 	int copied;
 
-	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), FOLL_FORCE);
+	copied = ptrace_access_vm(tsk, addr, &tmp, sizeof(tmp), FOLL_FORCE);
 	if (copied != sizeof(tmp))
 		return -EIO;
 	return put_user(tmp, (unsigned long __user *)data);
@@ -1137,7 +1167,7 @@ int generic_ptrace_pokedata(struct task_
 {
 	int copied;
 
-	copied = access_process_vm(tsk, addr, &data, sizeof(data),
+	copied = ptrace_access_vm(tsk, addr, &data, sizeof(data),
 			FOLL_FORCE | FOLL_WRITE);
 	return (copied == sizeof(data)) ? 0 : -EIO;
 }
@@ -1155,7 +1185,7 @@ int compat_ptrace_request(struct task_st
 	switch (request) {
 	case PTRACE_PEEKTEXT:
 	case PTRACE_PEEKDATA:
-		ret = access_process_vm(child, addr, &word, sizeof(word),
+		ret = ptrace_access_vm(child, addr, &word, sizeof(word),
 				FOLL_FORCE);
 		if (ret != sizeof(word))
 			ret = -EIO;
@@ -1165,7 +1195,7 @@ int compat_ptrace_request(struct task_st
 
 	case PTRACE_POKETEXT:
 	case PTRACE_POKEDATA:
-		ret = access_process_vm(child, addr, &data, sizeof(data),
+		ret = ptrace_access_vm(child, addr, &data, sizeof(data),
 				FOLL_FORCE | FOLL_WRITE);
 		ret = (ret != sizeof(data) ? -EIO : 0);
 		break;
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3868,7 +3868,7 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
  * Access another process' address space as given in mm.  If non-NULL, use the
  * given task for page fault accounting.
  */
-static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
 		unsigned long addr, void *buf, int len, unsigned int gup_flags)
 {
 	struct vm_area_struct *vma;
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1808,7 +1808,7 @@ void filemap_map_pages(struct fault_env
 }
 EXPORT_SYMBOL(filemap_map_pages);
 
-static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
 		unsigned long addr, void *buf, int len, unsigned int gup_flags)
 {
 	struct vm_area_struct *vma;



  parent reply	other threads:[~2017-01-04 20:11 UTC|newest]

Thread overview: 86+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <CGME20170104200710epcas5p1339068db1097bb4b4df5379cb539f508@epcas5p1.samsung.com>
2017-01-04 20:05 ` [PATCH 4.9 00/83] 4.9.1-stable review Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 01/83] hotplug: Make register and unregister notifier API symmetric Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 02/83] btrfs: limit async_work allocation and worker func duration Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 03/83] Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 04/83] Btrfs: fix deadlock caused by fsync when logging directory entries Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 05/83] Btrfs: fix tree search logic when replaying directory entry deletes Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 06/83] Btrfs: fix relocation incorrectly dropping data references Greg Kroah-Hartman
2017-01-04 20:05   ` [PATCH 4.9 07/83] btrfs: store and load values of stripes_min/stripes_max in balance status item Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 08/83] Btrfs: fix emptiness check for dirtied extent buffers at check_leaf() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 09/83] Btrfs: fix qgroup rescan worker initialization Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 10/83] USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 11/83] USB: serial: option: add dlink dwm-158 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 12/83] USB: serial: kl5kusb105: fix open error path Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 13/83] USB: cdc-acm: add device id for GW Instek AFG-125 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 14/83] usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 15/83] usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 17/83] usb: gadget: f_uac2: fix error handling at afunc_bind Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 18/83] usb: gadget: composite: correctly initialize ep->maxpacket Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 19/83] USB: UHCI: report non-PME wakeup signalling for Intel hardware Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 20/83] usbip: vudc: fix: Clear already_seen flag also for ep0 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 21/83] ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 22/83] ALSA: hiface: Fix M2Tech hiFace driver sampling rate change Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 23/83] ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 24/83] ALSA: hda - ignore the assoc and seq when comparing pin configurations Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 25/83] ALSA: hda - fix headset-mic problem on a Dell laptop Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 26/83] ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 27/83] ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 28/83] clk: ti: omap36xx: Work around sprz319 advisory 2.1 Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 29/83] exec: Ensure mm->user_ns contains the execed files Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 30/83] fs: exec: apply CLOEXEC before changing dumpable task flags Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 31/83] splice: reinstate SIGPIPE/EPIPE handling Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 32/83] block_dev: dont test bdev->bd_contains when it is not stable Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 33/83] mm: Add a user_ns owner to mm_struct and fix ptrace permission checks Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 34/83] vfs,mm: fix return value of read() at s_maxbytes Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 35/83] ptrace: Capture the ptracers creds not PT_PTRACE_CAP Greg Kroah-Hartman
2017-01-04 20:06   ` Greg Kroah-Hartman [this message]
2017-01-04 20:06   ` [PATCH 4.9 38/83] ext4: dont lock buffer in ext4_commit_super if holding spinlock Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 39/83] ext4: fix mballoc breakage with 64k block size Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 40/83] ext4: fix stack memory corruption " Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 41/83] ext4: use more strict checks for inodes_per_block on mount Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 42/83] ext4: fix in-superblock mount options processing Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 43/83] ext4: add sanity checking to count_overhead() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 44/83] ext4: reject inodes with negative size Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 45/83] ext4: return -ENOMEM instead of success Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 46/83] ext4: do not perform data journaling when data is encrypted Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 47/83] Revert "f2fs: use percpu_counter for # of dirty pages in inode" Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 48/83] f2fs: set ->owner for debugfs status files file_operations Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 49/83] f2fs: fix overflow due to condition check order Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 50/83] f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 51/83] loop: return proper error from loop_queue_rq() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 52/83] nvmet: Fix possible infinite loop triggered on hot namespace removal Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 53/83] mm/vmscan.c: set correct defer count for shrinker Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 54/83] mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 55/83] usb: gadget: composite: always set ep->mult to a sensible value Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 56/83] PM / OPP: Pass opp_table to dev_pm_opp_put_regulator() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 57/83] PM / OPP: Dont use OPP structure outside of rcu protected section Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 58/83] blk-mq: Do not invoke .queue_rq() for a stopped queue Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 59/83] dm table: fix all_blk_mq inconsistency when an empty table is loaded Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 60/83] dm table: an all_blk_mq table must be loaded for a blk-mq DM device Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 61/83] dm flakey: return -EINVAL on interval bounds error in flakey_ctr() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 62/83] dm crypt: mark key as invalid until properly loaded Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 63/83] dm rq: fix a race condition in rq_completed() Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 64/83] dm raid: fix discard support regression Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 65/83] dm space map metadata: fix struct sm_metadata leak on failed create Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 66/83] ASoC: intel: Fix crash at suspend/resume without card registration Greg Kroah-Hartman
2017-01-04 20:06   ` [PATCH 4.9 67/83] cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 68/83] CIFS: Fix a possible memory corruption during reconnect Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 69/83] CIFS: Fix missing nls unload in smb2_reconnect() Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 70/83] CIFS: Fix a possible double locking of mutex during reconnect Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 71/83] CIFS: Decrease verbosity of ioctl call Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 72/83] CIFS: Fix a possible memory corruption in push locks Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 73/83] kernel/watchdog: use nmi registers snapshot in hardlockup handler Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 74/83] watchdog: mei_wdt: request stop on reboot to prevent false positive event Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 75/83] watchdog: qcom: fix kernel panic due to external abort on non-linefetch Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 76/83] kernel/debug/debug_core.c: more properly delay for secondary CPUs Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 77/83] tpm xen: Remove bogus tpm_chip_unregister Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 78/83] xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 79/83] arm/xen: Use alloc_percpu rather than __alloc_percpu Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 80/83] xfs: fix up xfs_swap_extent_forks inline extent handling Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 81/83] xfs: set AGI buffer type in xlog_recover_clear_agi_bucket Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 82/83] builddeb: fix cross-building to arm64 producing host-arch debs Greg Kroah-Hartman
2017-01-04 20:07   ` [PATCH 4.9 83/83] x86/kbuild: enable modversions for symbols exported from asm Greg Kroah-Hartman
2017-01-05  0:41   ` [PATCH 4.9 00/83] 4.9.1-stable review Shuah Khan
2017-01-05  7:52     ` Greg Kroah-Hartman
2017-01-05  4:50   ` Guenter Roeck
2017-01-05  7:53     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170104200448.029330188@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=ebiederm@xmission.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).