LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "James Chapman" <jchapman@katalix.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.2 109/153] l2tp: fix race in pppol2tp_release with session object destroy
Date: Wed, 30 May 2018 11:52:41 +0100	[thread overview]
Message-ID: <lsq.1527677561.357102580@decadent.org.uk> (raw)
In-Reply-To: <lsq.1527677560.486731940@decadent.org.uk>

3.2.102-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: James Chapman <jchapman@katalix.com>

commit d02ba2a6110c530a32926af8ad441111774d2893 upstream.

pppol2tp_release uses call_rcu to put the final ref on its socket. But
the session object doesn't hold a ref on the session socket so may be
freed while the pppol2tp_put_sk RCU callback is scheduled. Fix this by
having the session hold a ref on its socket until the session is
destroyed. It is this ref that is dropped via call_rcu.

Sessions are also deleted via l2tp_tunnel_closeall. This must now also put
the final ref via call_rcu. So move the call_rcu call site into
pppol2tp_session_close so that this happens in both destroy paths. A
common destroy path should really be implemented, perhaps with
l2tp_tunnel_closeall calling l2tp_session_delete like pppol2tp_release
does, but this will be looked at later.

ODEBUG: activate active (active state 1) object type: rcu_head hint:           (null)
WARNING: CPU: 3 PID: 13407 at lib/debugobjects.c:291 debug_print_object+0x166/0x220
Modules linked in:
CPU: 3 PID: 13407 Comm: syzbot_19c09769 Not tainted 4.16.0-rc2+ #38
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
RIP: 0010:debug_print_object+0x166/0x220
RSP: 0018:ffff880013647a00 EFLAGS: 00010082
RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff814d3333
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88001a59f6d0
RBP: ffff880013647a40 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8800136479a8 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff86161420 R14: ffffffff85648b60 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88001a580000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020e77000 CR3: 0000000006022000 CR4: 00000000000006e0
Call Trace:
 debug_object_activate+0x38b/0x530
 ? debug_object_assert_init+0x3b0/0x3b0
 ? __mutex_unlock_slowpath+0x85/0x8b0
 ? pppol2tp_session_destruct+0x110/0x110
 __call_rcu.constprop.66+0x39/0x890
 ? __call_rcu.constprop.66+0x39/0x890
 call_rcu_sched+0x17/0x20
 pppol2tp_release+0x2c7/0x440
 ? fcntl_setlk+0xca0/0xca0
 ? sock_alloc_file+0x340/0x340
 sock_release+0x92/0x1e0
 sock_close+0x1b/0x20
 __fput+0x296/0x6e0
 ____fput+0x1a/0x20
 task_work_run+0x127/0x1a0
 do_exit+0x7f9/0x2ce0
 ? SYSC_connect+0x212/0x310
 ? mm_update_next_owner+0x690/0x690
 ? up_read+0x1f/0x40
 ? __do_page_fault+0x3c8/0xca0
 do_group_exit+0x10d/0x330
 ? do_group_exit+0x330/0x330
 SyS_exit_group+0x22/0x30
 do_syscall_64+0x1e0/0x730
 ? trace_hardirqs_off_thunk+0x1a/0x1c
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f362e471259
RSP: 002b:00007ffe389abe08 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f362e471259
RDX: 00007f362e471259 RSI: 000000000000002e RDI: 0000000000000000
RBP: 00007ffe389abe30 R08: 0000000000000000 R09: 00007f362e944270
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400b60
R13: 00007ffe389abf50 R14: 0000000000000000 R15: 0000000000000000
Code: 8d 3c dd a0 8f 64 85 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7b 48 8b 14 dd a0 8f 64 85 4c 89 f6 48 c7 c7 20 85 64 85 e
8 2a 55 14 ff <0f> 0b 83 05 ad 2a 68 04 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41

Fixes: ee40fb2e1eb5b ("l2tp: protect sock pointer of struct pppol2tp_session with RCU")
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/l2tp/l2tp_ppp.c | 52 +++++++++++++++++++++++----------------------
 1 file changed, 27 insertions(+), 25 deletions(-)

--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -463,10 +463,28 @@ abort:
  * Session (and tunnel control) socket create/destroy.
  *****************************************************************************/
 
+static void pppol2tp_put_sk(struct rcu_head *head)
+{
+	struct pppol2tp_session *ps;
+
+	ps = container_of(head, typeof(*ps), rcu);
+	sock_put(ps->__sk);
+}
+
 /* Called by l2tp_core when a session socket is being closed.
  */
 static void pppol2tp_session_close(struct l2tp_session *session)
 {
+	struct pppol2tp_session *ps;
+
+	ps = l2tp_session_priv(session);
+	mutex_lock(&ps->sk_lock);
+	ps->__sk = rcu_dereference_protected(ps->sk,
+					     lockdep_is_held(&ps->sk_lock));
+	RCU_INIT_POINTER(ps->sk, NULL);
+	if (ps->__sk)
+		call_rcu(&ps->rcu, pppol2tp_put_sk);
+	mutex_unlock(&ps->sk_lock);
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -490,14 +508,6 @@ out:
 	return;
 }
 
-static void pppol2tp_put_sk(struct rcu_head *head)
-{
-	struct pppol2tp_session *ps;
-
-	ps = container_of(head, typeof(*ps), rcu);
-	sock_put(ps->__sk);
-}
-
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
@@ -521,26 +531,17 @@ static int pppol2tp_release(struct socke
 	sock_orphan(sk);
 	sock->sk = NULL;
 
+	/* If the socket is associated with a session,
+	 * l2tp_session_delete will call pppol2tp_session_close which
+	 * will drop the session's ref on the socket.
+	 */
 	session = pppol2tp_sock_to_session(sk);
-
-	if (session != NULL) {
-		struct pppol2tp_session *ps;
-
+	if (session) {
 		l2tp_session_delete(session);
-
-		ps = l2tp_session_priv(session);
-		mutex_lock(&ps->sk_lock);
-		ps->__sk = rcu_dereference_protected(ps->sk,
-						     lockdep_is_held(&ps->sk_lock));
-		RCU_INIT_POINTER(ps->sk, NULL);
-		mutex_unlock(&ps->sk_lock);
-		call_rcu(&ps->rcu, pppol2tp_put_sk);
-
-		/* Rely on the sock_put() call at the end of the function for
-		 * dropping the reference held by pppol2tp_sock_to_session().
-		 * The last reference will be dropped by pppol2tp_put_sk().
-		 */
+		/* drop the ref obtained by pppol2tp_sock_to_session */
+		sock_put(sk);
 	}
+
 	skb_queue_purge(&sk->sk_receive_queue);
 	skb_queue_purge(&sk->sk_write_queue);
 
@@ -828,6 +829,7 @@ static int pppol2tp_connect(struct socke
 
 out_no_ppp:
 	/* This is how we get the session context from the socket. */
+	sock_hold(sk);
 	sk->sk_user_data = session;
 	rcu_assign_pointer(ps->sk, sk);
 	mutex_unlock(&ps->sk_lock);

  parent reply	other threads:[~2018-05-30 11:33 UTC|newest]

Thread overview: 155+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-30 10:52 [PATCH 3.2 000/153] 3.2.102-rc1 review Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 087/153] xfrm_user: uncoditionally validate esn replay attribute struct Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 124/153] ALSA: seq: Clear client entry before deleting else at closing Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 117/153] RDMA/ucma: Limit possible option size Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 026/153] perf/hwbp: Simplify the perf-hwbp code, fix documentation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 069/153] mm: pin address_space before dereferencing it while isolating an LRU page Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 104/153] regulatory: add NUL to request alpha2 Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 041/153] crypto: af_alg - whitelist mask and type Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 119/153] x86/MCE: Save microcode revision in machine check records Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 059/153] scsi: fas216: fix sense buffer initialization Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 052/153] dm thin: fix documentation relative to low water mark threshold Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 036/153] signal/sh: Ensure si_signo is initialized in do_divide_error Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 075/153] MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 020/153] x86/MCE: Serialize sysfs changes Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 083/153] usb: dwc3: gadget: Set maxpacket size for ep0 IN Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 053/153] ubi: Fix race condition between ubi volume creation and udev Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 088/153] net: fix race on decreasing number of TX queues Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 022/153] x86/traps: Enable DEBUG_STACK after cpu_init() for TRAP_DB/BP Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 120/153] USB: usbmon: remove assignment from IS_ERR argument Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 037/153] scsi: libsas: fix error when getting phy events Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 040/153] ext4: correct documentation for grpid mount option Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 066/153] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 006/153] ext4: fail ext4_iget for root directory if unallocated Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 089/153] netfilter: drop outermost socket lock in getsockopt() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 093/153] powerpc/pseries: Add empty update_numa_cpu_lookup_table() for NUMA=n Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 024/153] cdrom: information leak in cdrom_ioctl_media_changed() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 002/153] mm/madvise.c: fix madvise() infinite loop under special circumstances Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 054/153] drm/ttm: Don't add swapped BOs to swap-LRU list Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 094/153] USB: OHCI: Fix race between ED unlink and URB submission Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 028/153] slip: sl_alloc(): remove unused parameter "dev_t line" Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 071/153] Btrfs: fix extent state leak from tree log Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 047/153] mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 081/153] s390/qeth: fix SETIP command handling Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 110/153] tpm_tis: fix potential buffer overruns caused by bit glitches on the bus Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 099/153] libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 043/153] crypto: cryptd - pass through absence of ->setkey() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 035/153] pktcdvd: Fix pkt_setup_dev() error path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 013/153] ALSA: seq: Fix racy pool initializations Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 098/153] nospec: Allow index argument to have const-qualified type Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 065/153] media: cxusb, dib0700: ignore XC2028_I2C_FLUSH Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 045/153] crypto: hash - prevent using keyed hashes without setting key Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 004/153] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 057/153] alpha: fix crash if pthread_create races with signal delivery Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 038/153] scsi: aacraid: remove redundant setting of variable c Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 015/153] ALSA: seq: correctly detect input buffer overflow Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 084/153] bridge: check brport attr show in brport_show Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 046/153] signal/openrisc: Fix do_unaligned_access to send the proper signal Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 008/153] ext4: add validity checks for bitmap block numbers Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 125/153] netfilter: bridge: ebt_among: add missing match size checks Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 011/153] sctp: verify size of a new chunk in _sctp_make_chunk() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 073/153] firmware: dmi_scan: Fix handling of empty DMI strings Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 108/153] l2tp: don't use inet_shutdown on ppp session destroy Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 025/153] perf/hwpb: Invoke __perf_event_disable() if interrupts are already disabled Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 001/153] sctp: Fix mangled IPv4 addresses on a IPv6 listening socket Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 079/153] netlink: avoid a double skb free in genlmsg_mcast() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 051/153] USB: cdc-acm: Do not log urb submission errors on disconnect Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 049/153] ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 086/153] libata: remove WARN() for DMA or PIO command without data Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 101/153] x86/mm: Fix {pmd,pud}_{set,clear}_flags() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 121/153] usb: usbmon: Read text within supplied buffer size Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 050/153] hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 017/153] hugetlbfs: fix offset overflow in hugetlbfs mmap Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 074/153] MIPS: TXX9: use IS_ENABLED() macro Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 078/153] netlink: ensure to loop over all netns in genlmsg_multicast_allns() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 122/153] xhci: Fix front USB ports on ASUS PRIME B350M-A Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 014/153] ALSA: seq: Don't allow resizing pool in use Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 055/153] MIPS: Fix clean of vmlinuz.{32,ecoff,bin,srec} Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 018/153] hugetlbfs: check for pgoff value overflow Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 076/153] netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 030/153] USB: serial: io_edgeport: fix possible sleep-in-atomic Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 100/153] netfilter: IDLETIMER: be syzkaller friendly Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 005/153] netfilter: ebtables: fix erroneous reject of last rule Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 096/153] Add delay-init quirk for Corsair K70 RGB keyboards Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 042/153] crypto: hash - introduce crypto_hash_alg_has_setkey() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 056/153] alpha: fix reboot on Avanti platform Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 112/153] serial: sh-sci: prevent lockup on full TTY buffers Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 102/153] libata: disable LPM for Crucial BX100 SSD 500GB drive Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 033/153] l2tp: fix missing print session offset info Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 123/153] ALSA: seq: Fix possible UAF in snd_seq_check_queue() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 114/153] e1000e: Fix check_for_link return value with autoneg off Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 058/153] CDC-ACM: apply quirk for card reader Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 095/153] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 010/153] dccp: check sk for closed state in dccp_sendmsg() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 070/153] net: igmp: add a missing rcu locking section Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 067/153] netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 085/153] libata: fix length validation of ATAPI-relayed SCSI commands Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 077/153] powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 106/153] ALSA: usb-audio: Add a quirck for B&W PX headphones Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 097/153] dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 092/153] netfilter: nat: cope with negative port range Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 031/153] media: bt8xx: Fix err 'bt878_probe()' Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 116/153] l2tp: do not accept arbitrary sockets Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 032/153] ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 082/153] Input: matrix_keypad - fix race when disabling interrupts Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 064/153] jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 007/153] ext4: fix block bitmap validation when bigalloc, ^flex_bg Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 019/153] scsi: libsas: fix memory leak in sas_smp_get_phy_events() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 027/153] media: cpia2: Fix a couple off by one bugs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 062/153] cifs: Fix missing put_xid in cifs_file_strict_mmap Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 126/153] netfilter: bridge: ebt_among: add more missing match size checks Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 039/153] ext4: save error to disk in __ext4_grp_locked_error() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 080/153] 9p/trans_virtio: discard zero-length reply Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 103/153] kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 090/153] netfilter: ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 063/153] USB: serial: pl2303: new device id for Chilitag Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 060/153] s390: fix handling of -1 in set{,fs}[gu]id16 syscalls Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 034/153] scsi: aacraid: Fix udev inquiry race condition Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 003/153] ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 091/153] netfilter: x_tables: fix missing timer initialization in xt_LED Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 061/153] HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 107/153] batman-adv: fix packet checksum in receive path Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 016/153] ALSA: seq: More protection for concurrent write and ioctl races Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 048/153] console/dummy: leave .con_font_get set to NULL Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 009/153] ext4: fix bitmap position validation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 105/153] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 044/153] crypto: hash - annotate algorithms taking optional key Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 072/153] firmware/dmi_scan: constify strings Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 068/153] netfilter: on sockopt() acquire sock lock only in the required scope Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 023/153] x86/entry/64: Don't use IST entry for #BP stack Ben Hutchings
2018-05-30 10:52 ` Ben Hutchings [this message]
2018-05-30 10:52 ` [PATCH 3.2 113/153] ahci: Add PCI-id for the Highpoint Rocketraid 644L card Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 118/153] RDMA/ucma: Check that user doesn't overflow QP state Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 115/153] usb: quirks: add control message delay for 1b1c:1b20 Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 111/153] tty: make n_tty_read() always abort if hangup is in progress Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 029/153] ASoC: nuc900: Fix a loop timeout test Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 012/153] fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 129/153] drm/radeon: Don't turn off DP sink when disconnected Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 150/153] net/mlx4_en: Fix mixed PFC and Global pause user control requests Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 130/153] fs: Teach path_connected to handle nfs filesystems with multiple roots Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 145/153] netlink: make sure nladdr has correct size in netlink_connect() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 151/153] RDMA/ucma: Check that device is connected prior to access it Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 138/153] ALSA: aloop: Sync stale timer before release Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 140/153] posix-timers: Protect posix clock array access against speculation Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 133/153] libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 141/153] s390/qeth: free netdevice when removing a card Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 153/153] mtd: jedec_probe: Fix crash in jedec_read_mfr() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 148/153] ALSA: pcm: potential uninitialized return values Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 144/153] tty: vt: fix up tabstops properly Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 143/153] tracing: probeevent: Fix to support minus offset from symbol Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 142/153] mm/mempolicy.c: avoid use uninitialized preferred_node Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 132/153] libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 137/153] RDMA/ucma: Correct option size check using optlen Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 147/153] bonding: process the err returned by dev_set_allmulti properly in bond_enslave Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 139/153] ALSA: aloop: Fix access to not-yet-ready substream via cable Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 146/153] ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 149/153] net/mlx4_en: do not ignore autoneg in mlx4_en_set_pauseparam() Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 136/153] RDMA/ucma: Ensure that CM_ID exists prior to access it Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 127/153] RDMA/ucma: Fix access to non-initialized CM_ID object Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 135/153] RDMA/ucma: Fix use-after-free access in ucma_close Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 131/153] skbuff: Fix not waking applications when errors are enqueued Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 128/153] mmc: block: fix updating ext_csd caches on ioctl call Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 134/153] ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit Ben Hutchings
2018-05-30 10:52 ` [PATCH 3.2 152/153] RDMA/ucma: Check that device exists prior to accessing it Ben Hutchings
2018-05-30 16:31 ` [PATCH 3.2 000/153] 3.2.102-rc1 review Guenter Roeck
2018-05-30 22:14   ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1527677561.357102580@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=davem@davemloft.net \
    --cc=jchapman@katalix.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 3.2 109/153] l2tp: fix race in pppol2tp_release with session object destroy' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).