LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
	"Pablo Neira Ayuso" <pablo@netfilter.org>,
	"syzkaller" <syzkaller@googlegroups.com>,
	"Eric Dumazet" <edumazet@google.com>
Subject: [PATCH 3.2 100/153] netfilter: IDLETIMER: be syzkaller friendly
Date: Wed, 30 May 2018 11:52:41 +0100	[thread overview]
Message-ID: <lsq.1527677561.298515018@decadent.org.uk> (raw)
In-Reply-To: <lsq.1527677560.486731940@decadent.org.uk>

3.2.102-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

commit cfc2c740533368b96e2be5e0a4e8c3cace7d9814 upstream.

We had one report from syzkaller [1]

First issue is that INIT_WORK() should be done before mod_timer()
or we risk timer being fired too soon, even with a 1 second timer.

Second issue is that we need to reject too big info->timeout
to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or
risk looping, if result after overflow is 0.

[1]
WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
RSP: 0018:ffff8801db507538 EFLAGS: 00010006
RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404
RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082
RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c
R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6
R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000
 queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488
 queue_work include/linux/workqueue.h:488 [inline]
 schedule_work include/linux/workqueue.h:546 [inline]
 idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116
 call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x1cc/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:541 [inline]
 smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184
RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006
RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282
RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8
R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278
 __debug_object_init+0x235/0x1040 lib/debugobjects.c:378
 debug_object_init+0x17/0x20 lib/debugobjects.c:391
 __init_work+0x2b/0x60 kernel/workqueue.c:506
 idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]
 idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213
 xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850
 check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]
 find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575
 translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744
 do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]
 do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686
 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
 nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
 ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927
 udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422
 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976
 SYSC_setsockopt net/socket.c:1850 [inline]
 SyS_setsockopt+0x189/0x360 net/socket.c:1829
 do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287

Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/netfilter/xt_IDLETIMER.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -146,11 +146,11 @@ static int idletimer_tg_create(struct id
 		    (unsigned long) info->timer);
 	info->timer->refcnt = 1;
 
+	INIT_WORK(&info->timer->work, idletimer_tg_work);
+
 	mod_timer(&info->timer->timer,
 		  msecs_to_jiffies(info->timeout * 1000) + jiffies);
 
-	INIT_WORK(&info->timer->work, idletimer_tg_work);
-
 	return 0;
 
 out_free_attr:
@@ -191,7 +191,10 @@ static int idletimer_tg_checkentry(const
 		pr_debug("timeout value is zero\n");
 		return -EINVAL;
 	}
-
+	if (info->timeout >= INT_MAX / 1000) {
+		pr_debug("timeout value is too big\n");
+		return -EINVAL;
+	}
 	if (info->label[0] == '\0' ||
 	    strnlen(info->label,
 		    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {

  parent reply	other threads:[~2018-05-30 11:29 UTC|newest]

Thread overview: 155+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-30 10:52 [PATCH 3.2 000/153] 3.2.102-rc1 review Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 087/153] xfrm_user: uncoditionally validate esn replay attribute struct Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 124/153] ALSA: seq: Clear client entry before deleting else at closing Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 117/153] RDMA/ucma: Limit possible option size Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 026/153] perf/hwbp: Simplify the perf-hwbp code, fix documentation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 069/153] mm: pin address_space before dereferencing it while isolating an LRU page Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 104/153] regulatory: add NUL to request alpha2 Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 041/153] crypto: af_alg - whitelist mask and type Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 119/153] x86/MCE: Save microcode revision in machine check records Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 059/153] scsi: fas216: fix sense buffer initialization Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 052/153] dm thin: fix documentation relative to low water mark threshold Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 036/153] signal/sh: Ensure si_signo is initialized in do_divide_error Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 075/153] MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 020/153] x86/MCE: Serialize sysfs changes Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 083/153] usb: dwc3: gadget: Set maxpacket size for ep0 IN Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 053/153] ubi: Fix race condition between ubi volume creation and udev Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 088/153] net: fix race on decreasing number of TX queues Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 022/153] x86/traps: Enable DEBUG_STACK after cpu_init() for TRAP_DB/BP Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 120/153] USB: usbmon: remove assignment from IS_ERR argument Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 037/153] scsi: libsas: fix error when getting phy events Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 040/153] ext4: correct documentation for grpid mount option Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 066/153] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 006/153] ext4: fail ext4_iget for root directory if unallocated Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 089/153] netfilter: drop outermost socket lock in getsockopt() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 093/153] powerpc/pseries: Add empty update_numa_cpu_lookup_table() for NUMA=n Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 024/153] cdrom: information leak in cdrom_ioctl_media_changed() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 002/153] mm/madvise.c: fix madvise() infinite loop under special circumstances Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 054/153] drm/ttm: Don't add swapped BOs to swap-LRU list Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 094/153] USB: OHCI: Fix race between ED unlink and URB submission Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 028/153] slip: sl_alloc(): remove unused parameter "dev_t line" Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 071/153] Btrfs: fix extent state leak from tree log Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 047/153] mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 081/153] s390/qeth: fix SETIP command handling Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 110/153] tpm_tis: fix potential buffer overruns caused by bit glitches on the bus Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 099/153] libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 043/153] crypto: cryptd - pass through absence of ->setkey() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 035/153] pktcdvd: Fix pkt_setup_dev() error path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 013/153] ALSA: seq: Fix racy pool initializations Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 098/153] nospec: Allow index argument to have const-qualified type Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 065/153] media: cxusb, dib0700: ignore XC2028_I2C_FLUSH Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 045/153] crypto: hash - prevent using keyed hashes without setting key Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 004/153] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 057/153] alpha: fix crash if pthread_create races with signal delivery Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 038/153] scsi: aacraid: remove redundant setting of variable c Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 015/153] ALSA: seq: correctly detect input buffer overflow Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 084/153] bridge: check brport attr show in brport_show Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 046/153] signal/openrisc: Fix do_unaligned_access to send the proper signal Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 008/153] ext4: add validity checks for bitmap block numbers Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 125/153] netfilter: bridge: ebt_among: add missing match size checks Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 011/153] sctp: verify size of a new chunk in _sctp_make_chunk() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 073/153] firmware: dmi_scan: Fix handling of empty DMI strings Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 108/153] l2tp: don't use inet_shutdown on ppp session destroy Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 025/153] perf/hwpb: Invoke __perf_event_disable() if interrupts are already disabled Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 001/153] sctp: Fix mangled IPv4 addresses on a IPv6 listening socket Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 079/153] netlink: avoid a double skb free in genlmsg_mcast() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 051/153] USB: cdc-acm: Do not log urb submission errors on disconnect Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 049/153] ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 086/153] libata: remove WARN() for DMA or PIO command without data Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 101/153] x86/mm: Fix {pmd,pud}_{set,clear}_flags() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 121/153] usb: usbmon: Read text within supplied buffer size Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 050/153] hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 017/153] hugetlbfs: fix offset overflow in hugetlbfs mmap Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 074/153] MIPS: TXX9: use IS_ENABLED() macro Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 078/153] netlink: ensure to loop over all netns in genlmsg_multicast_allns() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 122/153] xhci: Fix front USB ports on ASUS PRIME B350M-A Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 014/153] ALSA: seq: Don't allow resizing pool in use Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 055/153] MIPS: Fix clean of vmlinuz.{32,ecoff,bin,srec} Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 018/153] hugetlbfs: check for pgoff value overflow Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 076/153] netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 030/153] USB: serial: io_edgeport: fix possible sleep-in-atomic Ben Hutchings
2018-05-30 10:52 ` Ben Hutchings [this message]
2018-05-30 10:52 ` [PATCH 3.2 005/153] netfilter: ebtables: fix erroneous reject of last rule Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 096/153] Add delay-init quirk for Corsair K70 RGB keyboards Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 042/153] crypto: hash - introduce crypto_hash_alg_has_setkey() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 056/153] alpha: fix reboot on Avanti platform Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 112/153] serial: sh-sci: prevent lockup on full TTY buffers Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 102/153] libata: disable LPM for Crucial BX100 SSD 500GB drive Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 033/153] l2tp: fix missing print session offset info Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 123/153] ALSA: seq: Fix possible UAF in snd_seq_check_queue() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 114/153] e1000e: Fix check_for_link return value with autoneg off Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 058/153] CDC-ACM: apply quirk for card reader Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 095/153] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 010/153] dccp: check sk for closed state in dccp_sendmsg() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 070/153] net: igmp: add a missing rcu locking section Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 067/153] netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 085/153] libata: fix length validation of ATAPI-relayed SCSI commands Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 077/153] powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 106/153] ALSA: usb-audio: Add a quirck for B&W PX headphones Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 097/153] dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 092/153] netfilter: nat: cope with negative port range Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 031/153] media: bt8xx: Fix err 'bt878_probe()' Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 116/153] l2tp: do not accept arbitrary sockets Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 032/153] ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 082/153] Input: matrix_keypad - fix race when disabling interrupts Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 064/153] jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 007/153] ext4: fix block bitmap validation when bigalloc, ^flex_bg Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 019/153] scsi: libsas: fix memory leak in sas_smp_get_phy_events() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 027/153] media: cpia2: Fix a couple off by one bugs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 062/153] cifs: Fix missing put_xid in cifs_file_strict_mmap Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 126/153] netfilter: bridge: ebt_among: add more missing match size checks Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 039/153] ext4: save error to disk in __ext4_grp_locked_error() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 080/153] 9p/trans_virtio: discard zero-length reply Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 103/153] kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 090/153] netfilter: ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 063/153] USB: serial: pl2303: new device id for Chilitag Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 060/153] s390: fix handling of -1 in set{,fs}[gu]id16 syscalls Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 034/153] scsi: aacraid: Fix udev inquiry race condition Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 003/153] ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 091/153] netfilter: x_tables: fix missing timer initialization in xt_LED Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 061/153] HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 107/153] batman-adv: fix packet checksum in receive path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 016/153] ALSA: seq: More protection for concurrent write and ioctl races Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 048/153] console/dummy: leave .con_font_get set to NULL Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 009/153] ext4: fix bitmap position validation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 105/153] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 044/153] crypto: hash - annotate algorithms taking optional key Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 072/153] firmware/dmi_scan: constify strings Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 068/153] netfilter: on sockopt() acquire sock lock only in the required scope Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 023/153] x86/entry/64: Don't use IST entry for #BP stack Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 109/153] l2tp: fix race in pppol2tp_release with session object destroy Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 113/153] ahci: Add PCI-id for the Highpoint Rocketraid 644L card Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 118/153] RDMA/ucma: Check that user doesn't overflow QP state Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 115/153] usb: quirks: add control message delay for 1b1c:1b20 Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 111/153] tty: make n_tty_read() always abort if hangup is in progress Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 029/153] ASoC: nuc900: Fix a loop timeout test Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 012/153] fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 129/153] drm/radeon: Don't turn off DP sink when disconnected Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 150/153] net/mlx4_en: Fix mixed PFC and Global pause user control requests Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 130/153] fs: Teach path_connected to handle nfs filesystems with multiple roots Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 145/153] netlink: make sure nladdr has correct size in netlink_connect() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 151/153] RDMA/ucma: Check that device is connected prior to access it Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 138/153] ALSA: aloop: Sync stale timer before release Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 140/153] posix-timers: Protect posix clock array access against speculation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 133/153] libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 141/153] s390/qeth: free netdevice when removing a card Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 153/153] mtd: jedec_probe: Fix crash in jedec_read_mfr() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 148/153] ALSA: pcm: potential uninitialized return values Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 144/153] tty: vt: fix up tabstops properly Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 143/153] tracing: probeevent: Fix to support minus offset from symbol Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 142/153] mm/mempolicy.c: avoid use uninitialized preferred_node Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 132/153] libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 137/153] RDMA/ucma: Correct option size check using optlen Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 147/153] bonding: process the err returned by dev_set_allmulti properly in bond_enslave Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 139/153] ALSA: aloop: Fix access to not-yet-ready substream via cable Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 146/153] ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 149/153] net/mlx4_en: do not ignore autoneg in mlx4_en_set_pauseparam() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 136/153] RDMA/ucma: Ensure that CM_ID exists prior to access it Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 127/153] RDMA/ucma: Fix access to non-initialized CM_ID object Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 135/153] RDMA/ucma: Fix use-after-free access in ucma_close Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 131/153] skbuff: Fix not waking applications when errors are enqueued Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 128/153] mmc: block: fix updating ext_csd caches on ioctl call Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 134/153] ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 152/153] RDMA/ucma: Check that device exists prior to accessing it Ben Hutchings
2018-05-30 16:31 ` [PATCH 3.2 000/153] 3.2.102-rc1 review Guenter Roeck
2018-05-30 22:14   ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1527677561.298515018@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=edumazet@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    --cc=syzkaller@googlegroups.com \
    --subject='Re: [PATCH 3.2 100/153] netfilter: IDLETIMER: be syzkaller friendly' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).