From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, syzbot <syzkaller@googlegroups.com>,
Wei Chen <harperchen1110@gmail.com>,
Kuniyuki Iwashima <kuniyu@amazon.com>,
Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 074/123] af_unix: Get user_ns from in_skb in unix_diag_get_exact().
Date: Mon, 12 Dec 2022 14:17:20 +0100 [thread overview]
Message-ID: <20221212130930.073431824@linuxfoundation.org> (raw)
In-Reply-To: <20221212130926.811961601@linuxfoundation.org>
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit b3abe42e94900bdd045c472f9c9be620ba5ce553 ]
Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed
the root cause: in unix_diag_get_exact(), the newly allocated skb does not
have sk. [2]
We must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to
sk_diag_fill().
[0]:
BUG: kernel NULL pointer dereference, address: 0000000000000270
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014
RIP: 0010:sk_user_ns include/net/sock.h:920 [inline]
RIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]
RIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170
Code: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8
54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b
9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d
RSP: 0018:ffffc90000d67968 EFLAGS: 00010246
RAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d
RDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270
RBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000
R10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800
R13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940
FS: 00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
unix_diag_get_exact net/unix/diag.c:285 [inline]
unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317
__sock_diag_cmd net/core/sock_diag.c:235 [inline]
sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266
netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564
sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0x38f/0x500 net/socket.c:2476
___sys_sendmsg net/socket.c:2530 [inline]
__sys_sendmsg+0x197/0x230 net/socket.c:2559
__do_sys_sendmsg net/socket.c:2568 [inline]
__se_sys_sendmsg net/socket.c:2566 [inline]
__x64_sys_sendmsg+0x42/0x50 net/socket.c:2566
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x4697f9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9
RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80
R13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0
</TASK>
Modules linked in:
CR2: 0000000000000270
[1]: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/
[2]: https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/
Fixes: cae9910e7344 ("net: Add UNIX_DIAG_UID to Netlink UNIX socket diagnostics.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Wei Chen <harperchen1110@gmail.com>
Diagnosed-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/unix/diag.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 7e7d7f45685a..e534e327a6a5 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -113,14 +113,16 @@ static int sk_diag_show_rqlen(struct sock *sk, struct sk_buff *nlskb)
return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql);
}
-static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb)
+static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb,
+ struct user_namespace *user_ns)
{
- uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk));
+ uid_t uid = from_kuid_munged(user_ns, sock_i_uid(sk));
return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid);
}
static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
- u32 portid, u32 seq, u32 flags, int sk_ino)
+ struct user_namespace *user_ns,
+ u32 portid, u32 seq, u32 flags, int sk_ino)
{
struct nlmsghdr *nlh;
struct unix_diag_msg *rep;
@@ -166,7 +168,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
goto out_nlmsg_trim;
if ((req->udiag_show & UDIAG_SHOW_UID) &&
- sk_diag_dump_uid(sk, skb))
+ sk_diag_dump_uid(sk, skb, user_ns))
goto out_nlmsg_trim;
nlmsg_end(skb, nlh);
@@ -178,7 +180,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
}
static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
- u32 portid, u32 seq, u32 flags)
+ struct user_namespace *user_ns,
+ u32 portid, u32 seq, u32 flags)
{
int sk_ino;
@@ -189,7 +192,7 @@ static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
if (!sk_ino)
return 0;
- return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino);
+ return sk_diag_fill(sk, skb, req, user_ns, portid, seq, flags, sk_ino);
}
static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
@@ -217,7 +220,7 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
goto next;
if (!(req->udiag_states & (1 << sk->sk_state)))
goto next;
- if (sk_diag_dump(sk, skb, req,
+ if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk),
NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq,
NLM_F_MULTI) < 0)
@@ -285,7 +288,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb,
if (!rep)
goto out;
- err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid,
+ err = sk_diag_fill(sk, rep, req, sk_user_ns(NETLINK_CB(in_skb).sk),
+ NETLINK_CB(in_skb).portid,
nlh->nlmsg_seq, 0, req->udiag_ino);
if (err < 0) {
nlmsg_free(rep);
--
2.35.1
next prev parent reply other threads:[~2022-12-12 13:30 UTC|newest]
Thread overview: 138+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-12 13:16 [PATCH 5.15 000/123] 5.15.83-rc1 review Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 001/123] clk: generalize devm_clk_get() a bit Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 002/123] clk: Provide new devm_clk helpers for prepared and enabled clocks Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 003/123] mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 004/123] arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 005/123] arm: dts: rockchip: fix node name for hym8563 rtc Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 006/123] arm: dts: rockchip: remove clock-frequency from rtc Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 007/123] ARM: dts: rockchip: fix ir-receiver node names Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 008/123] arm64: " Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 009/123] ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 010/123] fs: use acquire ordering in __fget_light() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 011/123] ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 012/123] ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 013/123] ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 014/123] spi: mediatek: Fix DEVAPC Violation at KO Remove Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 015/123] ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 016/123] ASoC: rt711-sdca: fix the latency time of clock stop prepare state machine transitions Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 017/123] 9p/fd: Use P9_HDRSZ for header size Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 018/123] regulator: slg51000: Wait after asserting CS pin Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 019/123] ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 020/123] selftests/net: Find nettest in current directory Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 021/123] btrfs: send: avoid unaligned encoded writes when attempting to clone range Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 022/123] ASoC: soc-pcm: Add NULL check in BE reparenting Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 023/123] regulator: twl6030: fix get status of twl6032 regulators Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 024/123] fbcon: Use kzalloc() in fbcon_prepare_logo() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 025/123] usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 026/123] 9p/xen: check logical size for buffer size Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 027/123] net: usb: qmi_wwan: add u-blox 0x1342 composition Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 028/123] mm/khugepaged: take the right locks for page table retraction Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 029/123] mm/khugepaged: fix GUP-fast interaction by sending IPI Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 030/123] mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 031/123] rtc: mc146818-lib: extract mc146818_avoid_UIP Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 032/123] rtc: cmos: avoid UIP when writing alarm time Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 033/123] rtc: cmos: avoid UIP when reading " Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 034/123] cifs: fix use-after-free caused by invalid pointer `hostname` Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 035/123] drm/bridge: anx7625: Fix edid_read break case in sp_tx_edid_read() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 036/123] xen/netback: Ensure protocol headers dont fall in the non-linear area Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 037/123] xen/netback: do some code cleanup Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 038/123] xen/netback: dont call kfree_skb() with interrupts disabled Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 039/123] media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 040/123] soundwire: intel: Initialize clock stop timeout Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 041/123] Revert "ARM: dts: imx7: Fix NAND controller size-cells" Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 042/123] media: v4l2-dv-timings.c: fix too strict blanking sanity checks Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 043/123] memcg: fix possible use-after-free in memcg_write_event_control() Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 044/123] mm/gup: fix gup_pud_range() for dax Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 045/123] Bluetooth: btusb: Add debug message for CSR controllers Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 046/123] Bluetooth: Fix crash when replugging CSR fake controllers Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 047/123] net: mana: Fix race on per-CQ variable napi work_done Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 048/123] KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 049/123] drm/vmwgfx: Dont use screen objects when SEV is active Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 050/123] drm/amdgpu/sdma_v4_0: turn off SDMA ring buffer in the s2idle suspend Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 051/123] drm/shmem-helper: Remove errant put in error path Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 052/123] drm/shmem-helper: Avoid vm_open error paths Greg Kroah-Hartman
2022-12-12 13:16 ` [PATCH 5.15 053/123] net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 054/123] HID: usbhid: Add ALWAYS_POLL quirk for some mice Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 055/123] HID: hid-lg4ff: Add check for empty lbuf Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 056/123] HID: core: fix shift-out-of-bounds in hid_report_raw_event Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 057/123] HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 058/123] can: af_can: fix NULL pointer dereference in can_rcv_filter Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 059/123] clk: Fix pointer casting to prevent oops in devm_clk_release() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 060/123] gpiolib: improve coding style for local variables Greg Kroah-Hartman
2022-12-12 14:30 ` Bartosz Golaszewski
2022-12-12 17:15 ` Greg Kroah-Hartman
2022-12-12 18:08 ` Bartosz Golaszewski
2022-12-12 13:17 ` [PATCH 5.15 061/123] gpiolib: check the ngpios property in core gpiolib code Greg Kroah-Hartman
2022-12-12 14:30 ` Bartosz Golaszewski
2022-12-12 13:17 ` [PATCH 5.15 062/123] gpiolib: fix memory leak in gpiochip_setup_dev() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 063/123] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 064/123] drm/vmwgfx: Fix race issue calling pin_user_pages Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 065/123] ieee802154: cc2520: Fix error return code in cc2520_hw_init() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 066/123] ca8210: Fix crash by zero initializing data Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 067/123] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 068/123] drm/bridge: ti-sn65dsi86: Fix output polarity setting bug Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 069/123] gpio: amd8111: Fix PCI device reference count leak Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 070/123] e1000e: Fix TX dispatch condition Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 071/123] igb: Allocate MSI-X vector when testing Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 072/123] net: broadcom: Add PTP_1588_CLOCK_OPTIONAL dependency for BCMGENET under ARCH_BCM2835 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 073/123] drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 Greg Kroah-Hartman
2022-12-12 13:17 ` Greg Kroah-Hartman [this message]
2022-12-12 13:17 ` [PATCH 5.15 075/123] vmxnet3: correctly report encapsulated LRO packet Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 076/123] vmxnet3: use correct intrConf reference when using extended queues Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 077/123] Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 078/123] Bluetooth: Fix not cleanup led when bt_init fails Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 079/123] net: dsa: ksz: Check return value Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 080/123] net: dsa: hellcreek: " Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 081/123] net: dsa: sja1105: " Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 082/123] selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 083/123] mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 084/123] net: encx24j600: Add parentheses to fix precedence Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 085/123] net: encx24j600: Fix invalid logic in reading of MISTAT register Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 086/123] net: mdiobus: fwnode_mdiobus_register_phy() rework error handling Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 087/123] net: mdiobus: fix double put fwnode in the error path Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 088/123] octeontx2-pf: Fix potential memory leak in otx2_init_tc() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 089/123] xen-netfront: Fix NULL sring after live migration Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 090/123] net: mvneta: Prevent out of bounds read in mvneta_config_rss() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 091/123] i40e: Fix not setting default xps_cpus after reset Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 092/123] i40e: Fix for VF MAC address 0 Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 093/123] i40e: Disallow ip4 and ip6 l4_4_bytes Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 094/123] NFC: nci: Bounds check struct nfc_target arrays Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 095/123] nvme initialize core quirks before calling nvme_init_subsystem Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 096/123] gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 097/123] net: stmmac: fix "snps,axi-config" node property parsing Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 098/123] ip_gre: do not report erspan version on GRE interface Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 099/123] net: microchip: sparx5: Fix missing destroy_workqueue of mact_queue Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 100/123] net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 101/123] net: hisilicon: Fix potential use-after-free in hisi_femac_rx() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 102/123] net: mdio: fix unbalanced fwnode reference count in mdio_device_release() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 103/123] net: hisilicon: Fix potential use-after-free in hix5hd2_rx() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 104/123] tipc: Fix potential OOB in tipc_link_proto_rcv() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 105/123] ipv4: Fix incorrect route flushing when source address is deleted Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 106/123] ipv4: Fix incorrect route flushing when table ID 0 is used Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 107/123] net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 108/123] tipc: call tipc_lxc_xmit without holding node_read_lock Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 109/123] ethernet: aeroflex: fix potential skb leak in greth_init_rings() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 110/123] dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 111/123] xen/netback: fix build warning Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 112/123] net: phy: mxl-gpy: fix version reporting Greg Kroah-Hartman
2022-12-12 13:17 ` [PATCH 5.15 113/123] net: plip: dont call kfree_skb/dev_kfree_skb() under spin_lock_irq() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 114/123] ipv6: avoid use-after-free in ip6_fragment() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 115/123] net: thunderbolt: fix memory leak in tbnet_open() Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 116/123] net: mvneta: Fix an out of bounds check Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 117/123] macsec: add missing attribute validation for offload Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 118/123] s390/qeth: fix various format strings Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 119/123] s390/qeth: fix use-after-free in hsci Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 120/123] can: esd_usb: Allow REC and TEC to return to zero Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 121/123] block: move CONFIG_BLOCK guard to top Makefile Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 122/123] io_uring: move to separate directory Greg Kroah-Hartman
2022-12-12 13:46 ` Harshit Mogalapalli
2022-12-12 13:57 ` Greg Kroah-Hartman
2022-12-12 13:18 ` [PATCH 5.15 123/123] io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Greg Kroah-Hartman
2022-12-12 23:00 ` [PATCH 5.15 000/123] 5.15.83-rc1 review Florian Fainelli
2022-12-12 23:58 ` Shuah Khan
2022-12-13 0:25 ` Guenter Roeck
2022-12-13 3:19 ` Bagas Sanjaya
2022-12-13 7:00 ` Naresh Kamboju
2022-12-13 12:07 ` Sudip Mukherjee (Codethink)
2022-12-13 12:55 ` Ron Economos
2022-12-14 1:02 ` Kelsey Steele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221212130930.073431824@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=harperchen1110@gmail.com \
--cc=kuniyu@amazon.com \
--cc=pabeni@redhat.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox