From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Chao Yu <yuchao0@huawei.com>,
Jaegeuk Kim <jaegeuk@kernel.org>,
Ben Hutchings <ben.hutchings@codethink.co.uk>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 055/146] f2fs: fix to do sanity check with i_extra_isize
Date: Tue, 4 Dec 2018 11:49:01 +0100 [thread overview]
Message-ID: <20181204103729.056519209@linuxfoundation.org> (raw)
In-Reply-To: <20181204103726.750894136@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
commit 18dd6470c2d14d10f5a2dd926925dc80dbd3abfd upstream.
If inode.i_extra_isize was fuzzed to an abnormal value, when
calculating inline data size, the result will overflow, result
in accessing invalid memory area when operating inline data.
Let's do sanity check with i_extra_isize during inode loading
for fixing.
https://bugzilla.kernel.org/show_bug.cgi?id=200421
- Reproduce
- POC (poc.c)
#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/xattr.h>
#include <dirent.h>
#include <errno.h>
#include <error.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <linux/falloc.h>
#include <linux/loop.h>
static void activity(char *mpoint) {
char *foo_bar_baz;
char *foo_baz;
char *xattr;
int err;
err = asprintf(&foo_bar_baz, "%s/foo/bar/baz", mpoint);
err = asprintf(&foo_baz, "%s/foo/baz", mpoint);
err = asprintf(&xattr, "%s/foo/bar/xattr", mpoint);
rename(foo_bar_baz, foo_baz);
char buf2[113];
memset(buf2, 0, sizeof(buf2));
listxattr(xattr, buf2, sizeof(buf2));
removexattr(xattr, "user.mime_type");
}
int main(int argc, char *argv[]) {
activity(argv[1]);
return 0;
}
- Kernel message
Umount the image will leave the following message
[ 2910.995489] F2FS-fs (loop0): Mounted with checkpoint version = 2
[ 2918.416465] ==================================================================
[ 2918.416807] BUG: KASAN: slab-out-of-bounds in f2fs_iget+0xcb9/0x1a80
[ 2918.417009] Read of size 4 at addr ffff88018efc2068 by task a.out/1229
[ 2918.417311] CPU: 1 PID: 1229 Comm: a.out Not tainted 4.17.0+ #1
[ 2918.417314] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 2918.417323] Call Trace:
[ 2918.417366] dump_stack+0x71/0xab
[ 2918.417401] print_address_description+0x6b/0x290
[ 2918.417407] kasan_report+0x28e/0x390
[ 2918.417411] ? f2fs_iget+0xcb9/0x1a80
[ 2918.417415] f2fs_iget+0xcb9/0x1a80
[ 2918.417422] ? f2fs_lookup+0x2e7/0x580
[ 2918.417425] f2fs_lookup+0x2e7/0x580
[ 2918.417433] ? __recover_dot_dentries+0x400/0x400
[ 2918.417447] ? legitimize_path.isra.29+0x5a/0xa0
[ 2918.417453] __lookup_slow+0x11c/0x220
[ 2918.417457] ? may_delete+0x2a0/0x2a0
[ 2918.417475] ? deref_stack_reg+0xe0/0xe0
[ 2918.417479] ? __lookup_hash+0xb0/0xb0
[ 2918.417483] lookup_slow+0x3e/0x60
[ 2918.417488] walk_component+0x3ac/0x990
[ 2918.417492] ? generic_permission+0x51/0x1e0
[ 2918.417495] ? inode_permission+0x51/0x1d0
[ 2918.417499] ? pick_link+0x3e0/0x3e0
[ 2918.417502] ? link_path_walk+0x4b1/0x770
[ 2918.417513] ? _raw_spin_lock_irqsave+0x25/0x50
[ 2918.417518] ? walk_component+0x990/0x990
[ 2918.417522] ? path_init+0x2e6/0x580
[ 2918.417526] path_lookupat+0x13f/0x430
[ 2918.417531] ? trailing_symlink+0x3a0/0x3a0
[ 2918.417534] ? do_renameat2+0x270/0x7b0
[ 2918.417538] ? __kasan_slab_free+0x14c/0x190
[ 2918.417541] ? do_renameat2+0x270/0x7b0
[ 2918.417553] ? kmem_cache_free+0x85/0x1e0
[ 2918.417558] ? do_renameat2+0x270/0x7b0
[ 2918.417563] filename_lookup+0x13c/0x280
[ 2918.417567] ? filename_parentat+0x2b0/0x2b0
[ 2918.417572] ? kasan_unpoison_shadow+0x31/0x40
[ 2918.417575] ? kasan_kmalloc+0xa6/0xd0
[ 2918.417593] ? strncpy_from_user+0xaa/0x1c0
[ 2918.417598] ? getname_flags+0x101/0x2b0
[ 2918.417614] ? path_listxattr+0x87/0x110
[ 2918.417619] path_listxattr+0x87/0x110
[ 2918.417623] ? listxattr+0xc0/0xc0
[ 2918.417637] ? mm_fault_error+0x1b0/0x1b0
[ 2918.417654] do_syscall_64+0x73/0x160
[ 2918.417660] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 2918.417676] RIP: 0033:0x7f2f3a3480d7
[ 2918.417677] Code: f0 ff ff 73 01 c3 48 8b 0d be dd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 c2 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 dd 2b 00 f7 d8 64 89 01 48
[ 2918.417732] RSP: 002b:00007fff4095b7d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000c2
[ 2918.417744] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2f3a3480d7
[ 2918.417746] RDX: 0000000000000071 RSI: 00007fff4095b810 RDI: 000000000126a0c0
[ 2918.417749] RBP: 00007fff4095b890 R08: 000000000126a010 R09: 0000000000000000
[ 2918.417751] R10: 00000000000001ab R11: 0000000000000206 R12: 00000000004005e0
[ 2918.417753] R13: 00007fff4095b990 R14: 0000000000000000 R15: 0000000000000000
[ 2918.417853] Allocated by task 329:
[ 2918.418002] kasan_kmalloc+0xa6/0xd0
[ 2918.418007] kmem_cache_alloc+0xc8/0x1e0
[ 2918.418023] mempool_init_node+0x194/0x230
[ 2918.418027] mempool_init+0x12/0x20
[ 2918.418042] bioset_init+0x2bd/0x380
[ 2918.418052] blk_alloc_queue_node+0xe9/0x540
[ 2918.418075] dm_create+0x2c0/0x800
[ 2918.418080] dev_create+0xd2/0x530
[ 2918.418083] ctl_ioctl+0x2a3/0x5b0
[ 2918.418087] dm_ctl_ioctl+0xa/0x10
[ 2918.418092] do_vfs_ioctl+0x13e/0x8c0
[ 2918.418095] ksys_ioctl+0x66/0x70
[ 2918.418098] __x64_sys_ioctl+0x3d/0x50
[ 2918.418102] do_syscall_64+0x73/0x160
[ 2918.418106] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 2918.418204] Freed by task 0:
[ 2918.418301] (stack is not available)
[ 2918.418521] The buggy address belongs to the object at ffff88018efc0000
which belongs to the cache biovec-max of size 8192
[ 2918.418894] The buggy address is located 104 bytes to the right of
8192-byte region [ffff88018efc0000, ffff88018efc2000)
[ 2918.419257] The buggy address belongs to the page:
[ 2918.419431] page:ffffea00063bf000 count:1 mapcount:0 mapping:ffff8801f2242540 index:0x0 compound_mapcount: 0
[ 2918.419702] flags: 0x17fff8000008100(slab|head)
[ 2918.419879] raw: 017fff8000008100 dead000000000100 dead000000000200 ffff8801f2242540
[ 2918.420101] raw: 0000000000000000 0000000000030003 00000001ffffffff 0000000000000000
[ 2918.420322] page dumped because: kasan: bad access detected
[ 2918.420599] Memory state around the buggy address:
[ 2918.420764] ffff88018efc1f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2918.420975] ffff88018efc1f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2918.421194] >ffff88018efc2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2918.421406] ^
[ 2918.421627] ffff88018efc2080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2918.421838] ffff88018efc2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2918.422046] ==================================================================
[ 2918.422264] Disabling lock debugging due to kernel taint
[ 2923.901641] BUG: unable to handle kernel paging request at ffff88018f0db000
[ 2923.901884] PGD 22226a067 P4D 22226a067 PUD 222273067 PMD 18e642063 PTE 800000018f0db061
[ 2923.902120] Oops: 0003 [#1] SMP KASAN PTI
[ 2923.902274] CPU: 1 PID: 1231 Comm: umount Tainted: G B 4.17.0+ #1
[ 2923.902490] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 2923.902761] RIP: 0010:__memset+0x24/0x30
[ 2923.902906] Code: 90 90 90 90 90 90 66 66 90 66 90 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3
[ 2923.903446] RSP: 0018:ffff88018ddf7ae0 EFLAGS: 00010206
[ 2923.903622] RAX: 0000000000000000 RBX: ffff8801d549d888 RCX: 1ffffffffffdaffb
[ 2923.903833] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88018f0daffc
[ 2923.904062] RBP: ffff88018efc206c R08: 1ffff10031df840d R09: ffff88018efc206c
[ 2923.904273] R10: ffffffffffffe1ee R11: ffffed0031df65fa R12: 0000000000000000
[ 2923.904485] R13: ffff8801d549dc98 R14: 00000000ffffc3db R15: ffffea00063bec80
[ 2923.904693] FS: 00007fa8b2f8a840(0000) GS:ffff8801f3b00000(0000) knlGS:0000000000000000
[ 2923.904937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2923.910080] CR2: ffff88018f0db000 CR3: 000000018f892000 CR4: 00000000000006e0
[ 2923.914930] Call Trace:
[ 2923.919724] f2fs_truncate_inline_inode+0x114/0x170
[ 2923.924487] f2fs_truncate_blocks+0x11b/0x7c0
[ 2923.929178] ? f2fs_truncate_data_blocks+0x10/0x10
[ 2923.933834] ? dqget+0x670/0x670
[ 2923.938437] ? f2fs_destroy_extent_tree+0xd6/0x270
[ 2923.943107] ? __radix_tree_lookup+0x2f/0x150
[ 2923.947772] f2fs_truncate+0xd4/0x1a0
[ 2923.952491] f2fs_evict_inode+0x5ab/0x610
[ 2923.957204] evict+0x15f/0x280
[ 2923.961898] __dentry_kill+0x161/0x250
[ 2923.966634] shrink_dentry_list+0xf3/0x250
[ 2923.971897] shrink_dcache_parent+0xa9/0x100
[ 2923.976561] ? shrink_dcache_sb+0x1f0/0x1f0
[ 2923.981177] ? wait_for_completion+0x8a/0x210
[ 2923.985781] ? migrate_swap_stop+0x2d0/0x2d0
[ 2923.990332] do_one_tree+0xe/0x40
[ 2923.994735] shrink_dcache_for_umount+0x3a/0xa0
[ 2923.999077] generic_shutdown_super+0x3e/0x1c0
[ 2924.003350] kill_block_super+0x4b/0x70
[ 2924.007619] deactivate_locked_super+0x65/0x90
[ 2924.011812] cleanup_mnt+0x5c/0xa0
[ 2924.015995] task_work_run+0xce/0xf0
[ 2924.020174] exit_to_usermode_loop+0x115/0x120
[ 2924.024293] do_syscall_64+0x12f/0x160
[ 2924.028479] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 2924.032709] RIP: 0033:0x7fa8b2868487
[ 2924.036888] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 c9 2b 00 f7 d8 64 89 01 48
[ 2924.045750] RSP: 002b:00007ffc39824d58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 2924.050190] RAX: 0000000000000000 RBX: 00000000008ea030 RCX: 00007fa8b2868487
[ 2924.054604] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00000000008f4360
[ 2924.058940] RBP: 00000000008f4360 R08: 0000000000000000 R09: 0000000000000014
[ 2924.063186] R10: 00000000000006b2 R11: 0000000000000246 R12: 00007fa8b2d7183c
[ 2924.067418] R13: 0000000000000000 R14: 00000000008ea210 R15: 00007ffc39824fe0
[ 2924.071534] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer joydev input_leds serio_raw snd soundcore mac_hid i2c_piix4 ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi btrfs zstd_decompress zstd_compress xxhash raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear 8139too qxl ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel psmouse aes_x86_64 8139cp crypto_simd cryptd mii glue_helper pata_acpi floppy
[ 2924.098044] CR2: ffff88018f0db000
[ 2924.102520] ---[ end trace a8e0d899985faf31 ]---
[ 2924.107012] RIP: 0010:__memset+0x24/0x30
[ 2924.111448] Code: 90 90 90 90 90 90 66 66 90 66 90 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3
[ 2924.120724] RSP: 0018:ffff88018ddf7ae0 EFLAGS: 00010206
[ 2924.125312] RAX: 0000000000000000 RBX: ffff8801d549d888 RCX: 1ffffffffffdaffb
[ 2924.129931] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88018f0daffc
[ 2924.134537] RBP: ffff88018efc206c R08: 1ffff10031df840d R09: ffff88018efc206c
[ 2924.139175] R10: ffffffffffffe1ee R11: ffffed0031df65fa R12: 0000000000000000
[ 2924.143825] R13: ffff8801d549dc98 R14: 00000000ffffc3db R15: ffffea00063bec80
[ 2924.148500] FS: 00007fa8b2f8a840(0000) GS:ffff8801f3b00000(0000) knlGS:0000000000000000
[ 2924.153247] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2924.158003] CR2: ffff88018f0db000 CR3: 000000018f892000 CR4: 00000000000006e0
[ 2924.164641] BUG: Bad rss-counter state mm:00000000fa04621e idx:0 val:4
[ 2924.170007] BUG: Bad rss-counter
tate mm:00000000fa04621e idx:1 val:2
- Location
https://elixir.bootlin.com/linux/v4.18-rc3/source/fs/f2fs/inline.c#L78
memset(addr + from, 0, MAX_INLINE_DATA(inode) - from);
Here the length can be negative.
Reported-by Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[bwh: Backported to 4.14: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/inode.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index aeed9943836a..9a40724dbaa6 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -183,6 +183,7 @@ void f2fs_inode_chksum_set(struct f2fs_sb_info *sbi, struct page *page)
static bool sanity_check_inode(struct inode *inode, struct page *node_page)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct f2fs_inode_info *fi = F2FS_I(inode);
unsigned long long iblocks;
iblocks = le64_to_cpu(F2FS_INODE(node_page)->i_blocks);
@@ -215,6 +216,17 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page)
return false;
}
+ if (fi->i_extra_isize > F2FS_TOTAL_EXTRA_ATTR_SIZE ||
+ fi->i_extra_isize % sizeof(__le32)) {
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "%s: inode (ino=%lx) has corrupted i_extra_isize: %d, "
+ "max: %zu",
+ __func__, inode->i_ino, fi->i_extra_isize,
+ F2FS_TOTAL_EXTRA_ATTR_SIZE);
+ return false;
+ }
+
if (F2FS_I(inode)->extent_tree) {
struct extent_info *ei = &F2FS_I(inode)->extent_tree->largest;
@@ -280,14 +292,14 @@ static int do_read_inode(struct inode *inode)
get_inline_info(inode, ri);
+ fi->i_extra_isize = f2fs_has_extra_attr(inode) ?
+ le16_to_cpu(ri->i_extra_isize) : 0;
+
if (!sanity_check_inode(inode, node_page)) {
f2fs_put_page(node_page, 1);
return -EINVAL;
}
- fi->i_extra_isize = f2fs_has_extra_attr(inode) ?
- le16_to_cpu(ri->i_extra_isize) : 0;
-
/* check data exist */
if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
__recover_inline_status(inode, node_page);
--
2.17.1
next prev parent reply other threads:[~2018-12-04 10:49 UTC|newest]
Thread overview: 166+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-04 10:48 [PATCH 4.14 000/146] 4.14.86-stable review Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 001/146] mm/huge_memory: rename freeze_page() to unmap_page() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 002/146] mm/huge_memory.c: reorder operations in __split_huge_page_tail() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 003/146] mm/huge_memory: splitting set mapping+index before unfreeze Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 004/146] mm/huge_memory: fix lockdep complaint on 32-bit i_size_read() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 005/146] mm/khugepaged: collapse_shmem() stop if punched or truncated Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 006/146] mm/khugepaged: fix crashes due to misaccounted holes Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 007/146] mm/khugepaged: collapse_shmem() remember to clear holes Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 008/146] mm/khugepaged: minor reorderings in collapse_shmem() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 009/146] mm/khugepaged: collapse_shmem() without freezing new_page Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 010/146] mm/khugepaged: collapse_shmem() do not crash on Compound Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 011/146] media: em28xx: Fix use-after-free when disconnecting Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 012/146] ubi: Initialize Fastmap checkmapping correctly Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 013/146] libceph: store ceph_auth_handshake pointer in ceph_connection Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 014/146] libceph: factor out __prepare_write_connect() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 015/146] libceph: factor out __ceph_x_decrypt() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 016/146] libceph: factor out encrypt_authorizer() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 017/146] libceph: add authorizer challenge Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 018/146] libceph: implement CEPHX_V2 calculation mode Greg Kroah-Hartman
2018-12-04 12:06 ` Ilya Dryomov
2018-12-04 13:41 ` Greg KH
2018-12-04 10:48 ` [PATCH 4.14 019/146] bpf: Prevent memory disambiguation attack Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 020/146] tls: Add function to update the TLS socket configuration Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 021/146] tls: Fix TLS ulp context leak, when TLS_TX setsockopt is not used Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 022/146] tls: Avoid copying crypto_info again after cipher_type check Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 023/146] tls: dont override sk_write_space if tls_set_sw_offload fails Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 024/146] tls: Use correct sk->sk_prot for IPV6 Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 025/146] net/tls: Fixed return value when tls_complete_pending_work() fails Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 026/146] wil6210: missing length check in wmi_set_ie Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 027/146] btrfs: validate type when reading a chunk Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 028/146] btrfs: Verify that every chunk has corresponding block group at mount time Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 029/146] btrfs: Refactor check_leaf function for later expansion Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 030/146] btrfs: Check if item pointer overlaps with the item itself Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 031/146] btrfs: Add sanity check for EXTENT_DATA when reading out leaf Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 032/146] btrfs: Add checker for EXTENT_CSUM Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 033/146] btrfs: Move leaf and node validation checker to tree-checker.c Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 034/146] btrfs: tree-checker: Enhance btrfs_check_node output Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 035/146] btrfs: tree-checker: Fix false panic for sanity test Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 036/146] btrfs: tree-checker: Add checker for dir item Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 037/146] btrfs: tree-checker: use %zu format string for size_t Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 038/146] btrfs: tree-check: reduce stack consumption in check_dir_item Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 039/146] btrfs: tree-checker: Verify block_group_item Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 040/146] btrfs: tree-checker: Detect invalid and empty essential trees Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 041/146] btrfs: Check that each block group has corresponding chunk at mount time Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 042/146] btrfs: tree-checker: Check level for leaves and nodes Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 043/146] btrfs: tree-checker: Fix misleading group system information Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 044/146] f2fs: check blkaddr more accuratly before issue a bio Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 045/146] f2fs: sanity check on sit entry Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 046/146] f2fs: enhance sanity_check_raw_super() to avoid potential overflow Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 047/146] f2fs: clean up with is_valid_blkaddr() Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 048/146] f2fs: introduce and spread verify_blkaddr Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 049/146] f2fs: fix to do sanity check with secs_per_zone Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 050/146] f2fs: Add sanity_check_inode() function Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 051/146] f2fs: fix to do sanity check with extra_attr feature Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 052/146] f2fs: fix to do sanity check with user_block_count Greg Kroah-Hartman
2018-12-04 10:48 ` [PATCH 4.14 053/146] f2fs: fix to do sanity check with node footer and iblocks Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 054/146] f2fs: fix to do sanity check with block address in main area Greg Kroah-Hartman
2018-12-04 20:27 ` Sudip Mukherjee
2018-12-05 6:59 ` Greg Kroah-Hartman
2018-12-04 10:49 ` Greg Kroah-Hartman [this message]
2018-12-04 10:49 ` [PATCH 4.14 056/146] f2fs: fix to do sanity check with cp_pack_start_sum Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 057/146] xfs: dont fail when converting shortform attr to long form during ATTR_REPLACE Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 058/146] Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()" Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 059/146] net: skb_scrub_packet(): Scrub offload_fwd_mark Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 060/146] net: thunderx: set xdp_prog to NULL if bpf_prog_add fails Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 061/146] virtio-net: disable guest csum during XDP set Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 062/146] virtio-net: fail XDP set if guest csum is negotiated Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 063/146] net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 064/146] packet: copy user buffers before orphan or clone Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 065/146] rapidio/rionet: do not free skb before reading its length Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 066/146] s390/qeth: fix length check in SNMP processing Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 067/146] usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 068/146] sched/core: Fix cpu.max vs. cpuhotplug deadlock Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 069/146] x86/bugs: Add AMDs variant of SSB_NO Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 070/146] x86/bugs: Add AMDs SPEC_CTRL MSR usage Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 071/146] x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 072/146] x86/bugs: Update when to check for the LS_CFG SSBD mitigation Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 073/146] x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 074/146] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 075/146] x86/speculation: Apply IBPB more strictly to avoid cross-process data leak Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 076/146] x86/speculation: Propagate information about RSB filling mitigation to sysfs Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 077/146] x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 078/146] x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 079/146] x86/retpoline: Remove minimal retpoline support Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 080/146] x86/speculation: Update the TIF_SSBD comment Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 081/146] x86/speculation: Clean up spectre_v2_parse_cmdline() Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 082/146] x86/speculation: Remove unnecessary ret variable in cpu_show_common() Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 083/146] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 084/146] x86/speculation: Disable STIBP when enhanced IBRS is in use Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 085/146] x86/speculation: Rename SSBD update functions Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 086/146] x86/speculation: Reorganize speculation control MSRs update Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 087/146] sched/smt: Make sched_smt_present track topology Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 088/146] x86/Kconfig: Select SCHED_SMT if SMP enabled Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 089/146] sched/smt: Expose sched_smt_present static key Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 090/146] x86/speculation: Rework SMT state change Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 091/146] x86/l1tf: Show actual SMT state Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 092/146] x86/speculation: Reorder the spec_v2 code Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 093/146] x86/speculation: Mark string arrays const correctly Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 094/146] x86/speculataion: Mark command line parser data __initdata Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 095/146] x86/speculation: Unify conditional spectre v2 print functions Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 096/146] x86/speculation: Add command line control for indirect branch speculation Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 097/146] x86/speculation: Prepare for per task indirect branch speculation control Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 098/146] x86/process: Consolidate and simplify switch_to_xtra() code Greg Kroah-Hartman
2018-12-04 11:14 ` Thomas Gleixner
2018-12-04 13:39 ` Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 099/146] x86/speculation: Avoid __switch_to_xtra() calls Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 100/146] x86/speculation: Prepare for conditional IBPB in switch_mm() Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 101/146] ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 102/146] x86/speculation: Split out TIF update Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 103/146] x86/speculation: Prevent stale SPEC_CTRL msr content Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 104/146] x86/speculation: Prepare arch_smt_update() for PRCTL mode Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 105/146] x86/speculation: Add prctl() control for indirect branch speculation Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 106/146] x86/speculation: Enable prctl mode for spectre_v2_user Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 107/146] x86/speculation: Add seccomp Spectre v2 user space protection mode Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 108/146] x86/speculation: Provide IBPB always command line options Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 109/146] kvm: mmu: Fix race in emulated page table writes Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 110/146] kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 111/146] KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 112/146] KVM: X86: Fix scan ioapic use-before-initialization Greg Kroah-Hartman
2018-12-04 10:49 ` [PATCH 4.14 113/146] xtensa: enable coprocessors that are being flushed Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 114/146] xtensa: fix coprocessor context offset definitions Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 115/146] xtensa: fix coprocessor part of ptrace_{get,set}xregs Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 116/146] Btrfs: ensure path name is null terminated at btrfs_control_ioctl Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 117/146] btrfs: relocation: set trans to be NULL after ending transaction Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 118/146] PCI: layerscape: Fix wrong invocation of outbound window disable accessor Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 119/146] arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 120/146] x86/MCE/AMD: Fix the thresholding machinery initialization order Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 121/146] x86/fpu: Disable bottom halves while loading FPU registers Greg Kroah-Hartman
2018-12-05 16:26 ` Jari Ruusu
2018-12-05 19:00 ` Borislav Petkov
2018-12-06 10:54 ` Greg Kroah-Hartman
2018-12-21 16:23 ` [PATCH v4.9 STABLE] " Sebastian Andrzej Siewior
2018-12-21 16:29 ` Greg Kroah-Hartman
2018-12-21 16:38 ` Sebastian Andrzej Siewior
2018-12-04 10:50 ` [PATCH 4.14 122/146] perf/x86/intel: Move branch tracing setup to the Intel-specific source file Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 123/146] perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts() Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 124/146] fs: fix lost error code in dio_complete Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 125/146] ALSA: wss: Fix invalid snd_free_pages() at error path Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 126/146] ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 127/146] ALSA: control: Fix race between adding and removing a user element Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 128/146] ALSA: sparc: Fix invalid snd_free_pages() at error path Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 129/146] ALSA: hda/realtek - Support ALC300 Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 130/146] ALSA: hda/realtek - fix headset mic detection for MSI MS-B171 Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 131/146] ext2: fix potential use after free Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 132/146] ARM: dts: rockchip: Remove @0 from the veyron memory node Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 133/146] dmaengine: at_hdmac: fix memory leak in at_dma_xlate() Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 134/146] dmaengine: at_hdmac: fix module unloading Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 135/146] btrfs: release metadata before running delayed refs Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 136/146] staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 137/146] staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 138/146] USB: usb-storage: Add new IDs to ums-realtek Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 139/146] usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 140/146] Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid" Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 141/146] iio:st_magn: Fix enable device after trigger Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 142/146] lib/test_kmod.c: fix rmmod double free Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 143/146] mm: use swp_offset as key in shmem_replace_page() Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 144/146] Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 145/146] misc: mic/scif: fix copy-paste error in scif_create_remote_lookup Greg Kroah-Hartman
2018-12-04 10:50 ` [PATCH 4.14 146/146] binder: fix race that allows malicious free of live buffer Greg Kroah-Hartman
2018-12-04 17:32 ` [PATCH 4.14 000/146] 4.14.86-stable review kernelci.org bot
2018-12-04 21:42 ` Guenter Roeck
2018-12-05 5:18 ` Naresh Kamboju
2018-12-05 7:41 ` Greg Kroah-Hartman
2018-12-05 9:31 ` Jon Hunter
2018-12-05 9:45 ` Greg Kroah-Hartman
2018-12-05 23:53 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181204103729.056519209@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ben.hutchings@codethink.co.uk \
--cc=jaegeuk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).