From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"David S. Miller" <davem@davemloft.net>,
"Alexander Potapenko" <glider@google.com>
Subject: [PATCH 3.2 021/147] sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
Date: Mon, 06 Nov 2017 23:03:07 +0000 [thread overview]
Message-ID: <lsq.1510009387.769658455@decadent.org.uk> (raw)
In-Reply-To: <lsq.1510009386.175361203@decadent.org.uk>
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
commit b1f5bfc27a19f214006b9b4db7b9126df2dfdf5a upstream.
If the length field of the iterator (|pos.p| or |err|) is past the end
of the chunk, we shouldn't access it.
This bug has been detected by KMSAN. For the following pair of system
calls:
socket(PF_INET6, SOCK_STREAM, 0x84 /* IPPROTO_??? */) = 3
sendto(3, "A", 1, MSG_OOB, {sa_family=AF_INET6, sin6_port=htons(0),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, 28) = 1
the tool has reported a use of uninitialized memory:
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_rcv+0x17b8/0x43b0
CPU: 1 PID: 2940 Comm: probe Not tainted 4.11.0-rc5+ #2926
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
__sctp_rcv_init_lookup net/sctp/input.c:1074
__sctp_rcv_lookup_harder net/sctp/input.c:1233
__sctp_rcv_lookup net/sctp/input.c:1255
sctp_rcv+0x17b8/0x43b0 net/sctp/input.c:170
sctp6_rcv+0x32/0x70 net/sctp/ipv6.c:984
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902
</IRQ>
do_softirq kernel/softirq.c:328
__local_bh_enable_ip+0x25b/0x290 kernel/softirq.c:181
local_bh_enable+0x37/0x40 ./include/linux/bottom_half.h:31
rcu_read_unlock_bh ./include/linux/rcupdate.h:931
ip6_finish_output2+0x19b2/0x1cf0 net/ipv6/ip6_output.c:124
ip6_finish_output+0x764/0x970 net/ipv6/ip6_output.c:149
NF_HOOK_COND ./include/linux/netfilter.h:246
ip6_output+0x456/0x520 net/ipv6/ip6_output.c:163
dst_output ./include/net/dst.h:486
NF_HOOK ./include/linux/netfilter.h:257
ip6_xmit+0x1841/0x1c00 net/ipv6/ip6_output.c:261
sctp_v6_xmit+0x3b7/0x470 net/sctp/ipv6.c:225
sctp_packet_transmit+0x38cb/0x3a20 net/sctp/output.c:632
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246
RIP: 0033:0x401133
RSP: 002b:00007fff6d99cd38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401133
RDX: 0000000000000001 RSI: 0000000000494088 RDI: 0000000000000003
RBP: 00007fff6d99cd90 R08: 00007fff6d99cd50 R09: 000000000000001c
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000004063d0 R14: 0000000000406460 R15: 0000000000000000
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:211
slab_alloc_node mm/slub.c:2743
__kmalloc_node_track_caller+0x200/0x360 mm/slub.c:4351
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x26b/0x840 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:933
sctp_packet_transmit+0x31e/0x3a20 net/sctp/output.c:570
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246
==================================================================
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/sctp/sctp.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -538,6 +538,8 @@ _sctp_walk_params((pos), (chunk), ntohs(
#define _sctp_walk_params(pos, chunk, end, member)\
for (pos.v = chunk->member;\
+ (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\
+ (void *)chunk + end) &&\
pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -548,6 +550,8 @@ _sctp_walk_errors((err), (chunk_hdr), nt
#define _sctp_walk_errors(err, chunk_hdr, end)\
for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
sizeof(sctp_chunkhdr_t));\
+ ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\
+ (void *)chunk_hdr + end) &&\
(void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
ntohs(err->length) >= sizeof(sctp_errhdr_t); \
err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
next prev parent reply other threads:[~2017-11-06 23:43 UTC|newest]
Thread overview: 149+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 134/147] staging: reduce stack usage in prism2fw.c Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 121/147] vmw_balloon: fix for a -Wuninitialized warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 068/147] CIFS: remove endian related sparse warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 036/147] audit: Fix use after free in audit_remove_watch_rule() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 120/147] mtd: map: Fix compilation warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 139/147] [media] rc: Fix input deadlock and transmit error in redrat3 driver Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 041/147] ALSA: core: Fix unexpected error at replacing user TLV Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 011/147] x86/acpi: Prevent out of bound access caused by broken ACPI tables Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 060/147] l2tp: hold tunnel while processing genl delete command Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 097/147] cuse: fix uninitialized variable warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 128/147] Staging: iio/accel: Changed return type of lis3l02dq_read_event_config() to int Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 096/147] ACPICA: Fix 'may be used uninitialized' warning in acpi_ns_repair_object() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 015/147] RDMA/core: Initialize port_num in qp_attr Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 137/147] [media] mxl111sf: remove an unused variable Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 130/147] [SCSI] mpt2sas: fix for unused variable 'event_data' warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 019/147] IB/ipoib: Prevent setting negative values to max_nonsrq_conn_qp Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 014/147] RDMA/uverbs: Fix the check for port number Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 020/147] IB/ipoib: Remove double pointer assigning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 116/147] [media] xc4000: Fix a few warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 044/147] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 045/147] qlge: avoid memcpy buffer overflow Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 108/147] nilfs2: fix gcc uninitialized-variable warnings in powerpc build Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 133/147] staging/slicoss: Fix operation may be undefined warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 067/147] alpha: uapi: Add support for __SANE_USERSPACE_TYPES__ Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 099/147] drivers/block/DAC960: fix -Wuninitialized warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 101/147] ASoC: adau1373: adau1373_hw_params: Silence overflow warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 093/147] mm/huge_memory: Fix unused label warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 008/147] usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 110/147] hwmon: (w83781d) Fix compile warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 085/147] packet: in packet_do_bind, test fanout with bind_lock held Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 065/147] ipv6: fix sparse warning on rt6i_node Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 049/147] ipv6: Add rt6_get_cookie() function Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 126/147] staging: comedi: vmk80xx: fix compiler warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 050/147] ipv6: add rcu grace period before freeing fib6_node Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 071/147] sch_multiq: fix double free on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 076/147] wl1251: add a missing spin_lock_init() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 074/147] sch_netem: avoid null pointer deref on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 023/147] ARM: pxa: select both FB and FB_W100 for eseries Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 025/147] USB: hcd: Mark secondary HCD as dead if the primary one died Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 033/147] IB/uverbs: Fix device cleanup Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 006/147] usb: storage: return on error to avoid a null pointer dereference Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 106/147] edac: i7300_edac: Fix 'may be used uninitialized' warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 132/147] sfc: Merge efx_mcdi_mac_check_fault() and efx_mcdi_get_mac_faults() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 079/147] fix unbalanced page refcounting in bio_map_user_iov Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 100/147] drbd: check MODULE for THIS_MODULE Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 117/147] isdn: hfcpci_softirq: get func return to suppress compiler warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 087/147] ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 026/147] xtensa: add missing symbol exports Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 052/147] r8169: Do not increment tx_dropped in TX ring cleaning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 038/147] ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 145/147] staging: vt6655: fix overly large stack usage Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 028/147] xtensa: mm/cache: add missing EXPORT_SYMBOLs Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 124/147] drivers/rtc/rtc-m41t80.c: remove disabled alarm functionality Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 140/147] [SCSI] libsas: prevent double completion of scmds from eh Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 012/147] cxgb4: Fix error codes in c4iw_create_cq() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 042/147] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 118/147] [media] tda18218: silence compiler warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 043/147] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 037/147] parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 018/147] perf/core: Fix locking for children siblings group read Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 142/147] net: am2150: fix nmclan_cs.c shared interrupt handling Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 111/147] pkt_sched: Fix warning false positives Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 022/147] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 098/147] drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 086/147] ALSA: usb-audio: Kill stray URB at exiting Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 055/147] dm: convert DM printk macros to pr_<level> macros Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 122/147] mtd: sst25l: kill unused variable Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 009/147] libata: array underflow in ata_find_dev() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 136/147] ray_cs: Fix array bounds warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 029/147] gpio: tegra: fix unbalanced chained_irq_enter/exit Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 053/147] xfrm_user: fix info leak in xfrm_notify_sa() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 105/147] ASoC: wm8985: Refactor set_pll code to avoid gcc warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 084/147] packet: hold bind lock when rebinding to fanout hook Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 031/147] ocfs2: don't clear SGID when inheriting ACLs Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 088/147] USB: fix out-of-bounds in usb_set_configuration Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 001/147] fuse: initialize the flock flag in fuse_file on allocation Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 143/147] am2150: Update nmclan_cs.c to use update PCMCIA API Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 119/147] [media] tda18212: silence compiler warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0 before using it Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 077/147] epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 061/147] l2tp: hold tunnel while handling genl tunnel updates Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 125/147] aic94xx: Skip reading user settings if flash is not found Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 017/147] perf/core: Invert perf_read_group() loops Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 114/147] gigaset: silence GCC warning for unused 'format_ie' Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 004/147] USB: serial: cp210x: add support for Qivicon USB ZigBee dongle Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 075/147] sch_tbf: fix two null pointer dereferences on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 027/147] xtensa: don't limit csum_partial export by CONFIG_NET Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 092/147] ALSA: seq: Enable 'use' locking in all configurations Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 024/147] xtensa: fix cache aliasing handling code for WT cache Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 141/147] scsi: advansys: remove #warning message Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 144/147] staging: bcm: add 32-bit host dependency Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 095/147] eCryptfs: initialize payload_len in keystore.c Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 057/147] l2tp: initialise session's refcount before making it reachable Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 115/147] eicon: fix -Warray-bounds warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 104/147] ASoC: wm8993: Refactor set_pll code to avoid GCC warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 109/147] netfilter: xt_socket: fix compilation warnings with gcc 4.7 Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 005/147] USB: cdc-acm: add device-id for quirky printer Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 113/147] IB/mlx4: Fix compiler warning about uninitialized 'vlan' variable Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 072/147] sch_hfsc: fix null pointer deref and double free on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 013/147] IB/cxgb3: Fix error codes in iwch_alloc_mr() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 069/147] net_sched: fix error recovery at qdisc creation Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 040/147] Input: trackpoint - add new trackpoint firmware ID Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 102/147] ASoC: wm_hubs: Silence reg_r and reg_l 'may be used uninitialized' warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 063/147] l2tp: remove useless duplicate session detection in l2tp_netlink Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 081/147] ALSA: seq: Fix use-after-free at creating a port Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 002/147] iio: light: tsl2563: use correct event code Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 032/147] RDMA/uverbs: Prevent leak of reserved field Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 054/147] xfrm_user: fix info leak in build_aevent() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 051/147] ipv6: Fix may be used uninitialized warning in rt6_check Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 131/147] staging:iio:gyro:adis16080: remove sparse warnings Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 073/147] sch_cbq: fix null pointer dereferences on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 107/147] ALSA: snd-usb-caiaq: initialize card pointer Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 062/147] l2tp: hold tunnel while handling genl TUNNEL_GET commands Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 112/147] intel_idle: Fix a cast to pointer from integer of different size warning in intel_idle Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 083/147] packet: race condition in packet_bind Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 091/147] USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 058/147] l2tp: define parameters of l2tp_session_get*() as "const" Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 129/147] iio: staging: ad7298_ring: Fix maybe-uninitialized warning Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 007/147] usb: renesas_usbhs: fixup resume method for autonomy mode Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 010/147] mount: copy the port field into the cloned nfs_server structure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 146/147] Staging: wlan-ng: fix sparse warning in prism2fw.c Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 039/147] mm/mempolicy: fix use after free when calling get_mempolicy Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 127/147] staging: cxt1e1: remove unnecessary function, VMETRO_TRACE Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 046/147] perf: Tighten (and fix) the grouping condition Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 089/147] usb: usbtest: fix NULL pointer dereference Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 056/147] dm: fix printk() rate limiting code Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 016/147] ipv4: initialize fib_trie prior to register_netdev_notifier call Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 059/147] l2tp: hold tunnel while looking up sessions in l2tp_netlink Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 138/147] drm/i915: Clean up multi-threaded forcewake patch Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 066/147] cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 035/147] af_key: do not use GFP_KERNEL in atomic contexts Ben Hutchings
2017-11-06 23:03 ` Ben Hutchings [this message]
2017-11-06 23:03 ` [PATCH 3.2 030/147] net/mlx4_en: Fix wrong indication of Wake-on-LAN (WoL) support Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 070/147] sch_htb: fix crash on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 048/147] PM/hibernate: touch NMI watchdog when creating snapshot Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 047/147] perf/core: Fix group {cpu,task} validation Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 064/147] l2tp: hold tunnel used while creating sessions with netlink Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 080/147] mac80211: accept key reinstall without changing anything Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 123/147] platform/x86: samsung-laptop: Initialize loca variable Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 147/147] ARM: 8160/1: drop warning about return_address not using unwind tables Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 034/147] xfs: fix inobt inode allocation search optimization Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 103/147] dccp: Fix compile warning in probe code Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 090/147] HID: usbhid: fix out-of-bounds bug Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 094/147] cifs: silence compiler warnings showing up with gcc-4.7.0 Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 082/147] KEYS: don't let add_key() update an uninstantiated key Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 003/147] staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 135/147] mct_u232: Fix use of uninitialized pointer in mct_u323_startup() Ben Hutchings
2017-11-07 14:18 ` [PATCH 3.2 000/147] 3.2.95-rc1 review Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1510009387.769658455@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®