From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Zeng Heng <zengheng4@huawei.com>,
"Paulo Alcantara (SUSE)" <pc@cjr.nz>,
Steve French <stfrench@microsoft.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 034/123] cifs: fix use-after-free caused by invalid pointer `hostname`
Date: Mon, 12 Dec 2022 14:16:40 +0100 [thread overview]
Message-ID: <20221212130928.344469149@linuxfoundation.org> (raw)
In-Reply-To: <20221212130926.811961601@linuxfoundation.org>
From: Zeng Heng <zengheng4@huawei.com>
[ Upstream commit 153695d36ead0ccc4d0256953c751cabf673e621 ]
`hostname` needs to be set as null-pointer after free in
`cifs_put_tcp_session` function, or when `cifsd` thread attempts
to resolve hostname and reconnect the host, the thread would deref
the invalid pointer.
Here is one of practical backtrace examples as reference:
Task 477
---------------------------
do_mount
path_mount
do_new_mount
vfs_get_tree
smb3_get_tree
smb3_get_tree_common
cifs_smb3_do_mount
cifs_mount
mount_put_conns
cifs_put_tcp_session
--> kfree(server->hostname)
cifsd
---------------------------
kthread
cifs_demultiplex_thread
cifs_reconnect
reconn_set_ipaddr_from_hostname
--> if (!server->hostname)
--> if (server->hostname[0] == '\0') // !! UAF fault here
CIFS: VFS: cifs_mount failed w/return code = -112
mount error(112): Host is down
BUG: KASAN: use-after-free in reconn_set_ipaddr_from_hostname+0x2ba/0x310
Read of size 1 at addr ffff888108f35380 by task cifsd/480
CPU: 2 PID: 480 Comm: cifsd Not tainted 6.1.0-rc2-00106-gf705792f89dd-dirty #25
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0x85
print_report+0x16c/0x4a3
kasan_report+0x95/0x190
reconn_set_ipaddr_from_hostname+0x2ba/0x310
__cifs_reconnect.part.0+0x241/0x800
cifs_reconnect+0x65f/0xb60
cifs_demultiplex_thread+0x1570/0x2570
kthread+0x2c5/0x380
ret_from_fork+0x22/0x30
</TASK>
Allocated by task 477:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x7e/0x90
__kmalloc_node_track_caller+0x52/0x1b0
kstrdup+0x3b/0x70
cifs_get_tcp_session+0xbc/0x19b0
mount_get_conns+0xa9/0x10c0
cifs_mount+0xdf/0x1970
cifs_smb3_do_mount+0x295/0x1660
smb3_get_tree+0x352/0x5e0
vfs_get_tree+0x8e/0x2e0
path_mount+0xf8c/0x1990
do_mount+0xee/0x110
__x64_sys_mount+0x14b/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 477:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x50
__kasan_slab_free+0x10a/0x190
__kmem_cache_free+0xca/0x3f0
cifs_put_tcp_session+0x30c/0x450
cifs_mount+0xf95/0x1970
cifs_smb3_do_mount+0x295/0x1660
smb3_get_tree+0x352/0x5e0
vfs_get_tree+0x8e/0x2e0
path_mount+0xf8c/0x1990
do_mount+0xee/0x110
__x64_sys_mount+0x14b/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888108f35380
which belongs to the cache kmalloc-16 of size 16
The buggy address is located 0 bytes inside of
16-byte region [ffff888108f35380, ffff888108f35390)
The buggy address belongs to the physical page:
page:00000000333f8e58 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888108f350e0 pfn:0x108f35
flags: 0x200000000000200(slab|node=0|zone=2)
raw: 0200000000000200 0000000000000000 dead000000000122 ffff8881000423c0
raw: ffff888108f350e0 000000008080007a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888108f35280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
ffff888108f35300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
>ffff888108f35380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
^
ffff888108f35400: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888108f35480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches")
Signed-off-by: Zeng Heng <zengheng4@huawei.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/connect.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c6e2a0ff8f0c..a4284c4d7e03 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1392,6 +1392,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
server->session_key.response = NULL;
server->session_key.len = 0;
kfree(server->hostname);
+ server->hostname = NULL;
task = xchg(&server->tsk, NULL);
if (task)
--
2.35.1
next prev parent reply other threads:[~2022-12-12 13:29 UTC|newest]
Thread overview: 138+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-12 13:16 [PATCH 5.15 000/123] 5.15.83-rc1 review Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 001/123] clk: generalize devm_clk_get() a bit Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 002/123] clk: Provide new devm_clk helpers for prepared and enabled clocks Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 003/123] mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 004/123] arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 005/123] arm: dts: rockchip: fix node name for hym8563 rtc Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 006/123] arm: dts: rockchip: remove clock-frequency from rtc Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 007/123] ARM: dts: rockchip: fix ir-receiver node names Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 008/123] arm64: " Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 009/123] ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 010/123] fs: use acquire ordering in __fget_light() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 011/123] ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 012/123] ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 013/123] ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 014/123] spi: mediatek: Fix DEVAPC Violation at KO Remove Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 015/123] ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 016/123] ASoC: rt711-sdca: fix the latency time of clock stop prepare state machine transitions Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 017/123] 9p/fd: Use P9_HDRSZ for header size Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 018/123] regulator: slg51000: Wait after asserting CS pin Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 019/123] ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 020/123] selftests/net: Find nettest in current directory Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 021/123] btrfs: send: avoid unaligned encoded writes when attempting to clone range Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 022/123] ASoC: soc-pcm: Add NULL check in BE reparenting Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 023/123] regulator: twl6030: fix get status of twl6032 regulators Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 024/123] fbcon: Use kzalloc() in fbcon_prepare_logo() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 025/123] usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 026/123] 9p/xen: check logical size for buffer size Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 027/123] net: usb: qmi_wwan: add u-blox 0x1342 composition Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 028/123] mm/khugepaged: take the right locks for page table retraction Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 029/123] mm/khugepaged: fix GUP-fast interaction by sending IPI Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 030/123] mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 031/123] rtc: mc146818-lib: extract mc146818_avoid_UIP Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 032/123] rtc: cmos: avoid UIP when writing alarm time Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 033/123] rtc: cmos: avoid UIP when reading " Greg Kroah-Hartman
2022-12-12 13:16 ` Greg Kroah-Hartman [this message]
2022-12-12 13:16 ` [PATCH 5.15 035/123] drm/bridge: anx7625: Fix edid_read break case in sp_tx_edid_read() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 036/123] xen/netback: Ensure protocol headers dont fall in the non-linear area Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 037/123] xen/netback: do some code cleanup Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 038/123] xen/netback: dont call kfree_skb() with interrupts disabled Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 039/123] media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 040/123] soundwire: intel: Initialize clock stop timeout Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 041/123] Revert "ARM: dts: imx7: Fix NAND controller size-cells" Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 042/123] media: v4l2-dv-timings.c: fix too strict blanking sanity checks Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 043/123] memcg: fix possible use-after-free in memcg_write_event_control() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 044/123] mm/gup: fix gup_pud_range() for dax Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 045/123] Bluetooth: btusb: Add debug message for CSR controllers Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 046/123] Bluetooth: Fix crash when replugging CSR fake controllers Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 047/123] net: mana: Fix race on per-CQ variable napi work_done Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 048/123] KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 049/123] drm/vmwgfx: Dont use screen objects when SEV is active Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 050/123] drm/amdgpu/sdma_v4_0: turn off SDMA ring buffer in the s2idle suspend Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 051/123] drm/shmem-helper: Remove errant put in error path Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 052/123] drm/shmem-helper: Avoid vm_open error paths Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 053/123] net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 054/123] HID: usbhid: Add ALWAYS_POLL quirk for some mice Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 055/123] HID: hid-lg4ff: Add check for empty lbuf Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 056/123] HID: core: fix shift-out-of-bounds in hid_report_raw_event Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 057/123] HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 058/123] can: af_can: fix NULL pointer dereference in can_rcv_filter Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 059/123] clk: Fix pointer casting to prevent oops in devm_clk_release() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 060/123] gpiolib: improve coding style for local variables Greg Kroah-Hartman
2022-12-12 14:30 ` Bartosz Golaszewski
2022-12-12 17:15 ` Greg Kroah-Hartman
2022-12-12 18:08 ` Bartosz Golaszewski
2022-12-12 13:17 ` [PATCH 5.15 061/123] gpiolib: check the ngpios property in core gpiolib code Greg Kroah-Hartman
2022-12-12 14:30 ` Bartosz Golaszewski
2022-12-12 13:17 ` [PATCH 5.15 062/123] gpiolib: fix memory leak in gpiochip_setup_dev() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 063/123] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 064/123] drm/vmwgfx: Fix race issue calling pin_user_pages Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 065/123] ieee802154: cc2520: Fix error return code in cc2520_hw_init() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 066/123] ca8210: Fix crash by zero initializing data Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 067/123] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 068/123] drm/bridge: ti-sn65dsi86: Fix output polarity setting bug Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 069/123] gpio: amd8111: Fix PCI device reference count leak Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 070/123] e1000e: Fix TX dispatch condition Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 071/123] igb: Allocate MSI-X vector when testing Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 072/123] net: broadcom: Add PTP_1588_CLOCK_OPTIONAL dependency for BCMGENET under ARCH_BCM2835 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 073/123] drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 074/123] af_unix: Get user_ns from in_skb in unix_diag_get_exact() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 075/123] vmxnet3: correctly report encapsulated LRO packet Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 076/123] vmxnet3: use correct intrConf reference when using extended queues Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 077/123] Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 078/123] Bluetooth: Fix not cleanup led when bt_init fails Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 079/123] net: dsa: ksz: Check return value Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 080/123] net: dsa: hellcreek: " Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 081/123] net: dsa: sja1105: " Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 082/123] selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 083/123] mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 084/123] net: encx24j600: Add parentheses to fix precedence Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 085/123] net: encx24j600: Fix invalid logic in reading of MISTAT register Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 086/123] net: mdiobus: fwnode_mdiobus_register_phy() rework error handling Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 087/123] net: mdiobus: fix double put fwnode in the error path Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 088/123] octeontx2-pf: Fix potential memory leak in otx2_init_tc() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 089/123] xen-netfront: Fix NULL sring after live migration Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 090/123] net: mvneta: Prevent out of bounds read in mvneta_config_rss() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 091/123] i40e: Fix not setting default xps_cpus after reset Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 092/123] i40e: Fix for VF MAC address 0 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 093/123] i40e: Disallow ip4 and ip6 l4_4_bytes Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 094/123] NFC: nci: Bounds check struct nfc_target arrays Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 095/123] nvme initialize core quirks before calling nvme_init_subsystem Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 096/123] gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 097/123] net: stmmac: fix "snps,axi-config" node property parsing Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 098/123] ip_gre: do not report erspan version on GRE interface Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 099/123] net: microchip: sparx5: Fix missing destroy_workqueue of mact_queue Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 100/123] net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 101/123] net: hisilicon: Fix potential use-after-free in hisi_femac_rx() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 102/123] net: mdio: fix unbalanced fwnode reference count in mdio_device_release() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 103/123] net: hisilicon: Fix potential use-after-free in hix5hd2_rx() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 104/123] tipc: Fix potential OOB in tipc_link_proto_rcv() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 105/123] ipv4: Fix incorrect route flushing when source address is deleted Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 106/123] ipv4: Fix incorrect route flushing when table ID 0 is used Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 107/123] net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 108/123] tipc: call tipc_lxc_xmit without holding node_read_lock Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 109/123] ethernet: aeroflex: fix potential skb leak in greth_init_rings() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 110/123] dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 111/123] xen/netback: fix build warning Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 112/123] net: phy: mxl-gpy: fix version reporting Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 113/123] net: plip: dont call kfree_skb/dev_kfree_skb() under spin_lock_irq() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 114/123] ipv6: avoid use-after-free in ip6_fragment() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 115/123] net: thunderbolt: fix memory leak in tbnet_open() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 116/123] net: mvneta: Fix an out of bounds check Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 117/123] macsec: add missing attribute validation for offload Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 118/123] s390/qeth: fix various format strings Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 119/123] s390/qeth: fix use-after-free in hsci Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 120/123] can: esd_usb: Allow REC and TEC to return to zero Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 121/123] block: move CONFIG_BLOCK guard to top Makefile Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 122/123] io_uring: move to separate directory Greg Kroah-Hartman
2022-12-12 13:46 ` Harshit Mogalapalli
2022-12-12 13:57 ` Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 123/123] io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Greg Kroah-Hartman
2022-12-12 23:00 ` [PATCH 5.15 000/123] 5.15.83-rc1 review Florian Fainelli
2022-12-12 23:58 ` Shuah Khan
2022-12-13 0:25 ` Guenter Roeck
2022-12-13 3:19 ` Bagas Sanjaya
2022-12-13 7:00 ` Naresh Kamboju
2022-12-13 12:07 ` Sudip Mukherjee (Codethink)
2022-12-13 12:55 ` Ron Economos
2022-12-14 1:02 ` Kelsey Steele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221212130928.344469149@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=patches@lists.linux.dev \
--cc=pc@cjr.nz \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
--cc=zengheng4@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox