Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1167246
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.13.y-ckt 098/122] KVM: MMU: fix SMAP virtualization |
| Date | 2015-06-18 00:40 +0200 |
| Message-ID | <pCua1-6xN-75@gated-at.bofh.it> (permalink) |
| References | <pCu0j-6mo-39@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.13.11-ckt22 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Guangrong <guangrong.xiao@linux.intel.com>
commit 0be0226f07d14b153a5eedf2bb86e1eb7dcefab5 upstream.
KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page
Fix it by setting SMAP && !CR0.WP into shadow page's role and reset mmu
once CR4.SMAP is updated
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ kamal: backport to 3.13-stable: context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
Documentation/virtual/kvm/mmu.txt | 18 ++++++++++++++----
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/mmu.c | 14 +++++++++++---
arch/x86/kvm/x86.c | 5 +++--
4 files changed, 29 insertions(+), 9 deletions(-)
diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
index 53838d9..c59bd9b 100644
--- a/Documentation/virtual/kvm/mmu.txt
+++ b/Documentation/virtual/kvm/mmu.txt
@@ -169,6 +169,10 @@ Shadow pages contain the following information:
Contains the value of cr4.smep && !cr0.wp for which the page is valid
(pages for which this is true are different from other pages; see the
treatment of cr0.wp=0 below).
+ role.smap_andnot_wp:
+ Contains the value of cr4.smap && !cr0.wp for which the page is valid
+ (pages for which this is true are different from other pages; see the
+ treatment of cr0.wp=0 below).
gfn:
Either the guest page table containing the translations shadowed by this
page, or the base page frame for linear translations. See role.direct.
@@ -344,10 +348,16 @@ on fault type:
(user write faults generate a #PF)
-In the first case there is an additional complication if CR4.SMEP is
-enabled: since we've turned the page into a kernel page, the kernel may now
-execute it. We handle this by also setting spte.nx. If we get a user
-fetch or read fault, we'll change spte.u=1 and spte.nx=gpte.nx back.
+In the first case there are two additional complications:
+- if CR4.SMEP is enabled: since we've turned the page into a kernel page,
+ the kernel may now execute it. We handle this by also setting spte.nx.
+ If we get a user fetch or read fault, we'll change spte.u=1 and
+ spte.nx=gpte.nx back.
+- if CR4.SMAP is disabled: since the page has been changed to a kernel
+ page, it can not be reused when CR4.SMAP is enabled. We set
+ CR4.SMAP && !CR0.WP into shadow page's role to avoid this case. Note,
+ here we do not care the case that CR4.SMAP is enabled since KVM will
+ directly inject #PF to guest due to failed permission check.
To prevent an spte that was converted into a kernel page with cr0.wp=0
from being written by the kernel after cr0.wp has changed to 1, we make
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index dba6f79..331b63c 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -208,6 +208,7 @@ union kvm_mmu_page_role {
unsigned nxe:1;
unsigned cr0_wp:1;
unsigned smep_andnot_wp:1;
+ unsigned smap_andnot_wp:1;
};
};
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f13dbfd..c8fb357 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3600,7 +3600,7 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
}
static void update_permission_bitmask(struct kvm_vcpu *vcpu,
- struct kvm_mmu *mmu, bool ept)
+ struct kvm_mmu *mmu, bool ept)
{
unsigned bit, byte, pfec;
u8 map;
@@ -3753,6 +3753,7 @@ static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
{
bool smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
+ bool smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
ASSERT(vcpu);
ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
@@ -3770,6 +3771,8 @@ void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu);
vcpu->arch.mmu.base_role.smep_andnot_wp
= smep && !is_write_protection(vcpu);
+ context->base_role.smap_andnot_wp
+ = smap && !is_write_protection(vcpu);
}
EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);
@@ -4041,12 +4044,18 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
const u8 *new, int bytes)
{
gfn_t gfn = gpa >> PAGE_SHIFT;
- union kvm_mmu_page_role mask = { .word = 0 };
struct kvm_mmu_page *sp;
LIST_HEAD(invalid_list);
u64 entry, gentry, *spte;
int npte;
bool remote_flush, local_flush, zap_page;
+ union kvm_mmu_page_role mask = (union kvm_mmu_page_role) {
+ .cr0_wp = 1,
+ .cr4_pae = 1,
+ .nxe = 1,
+ .smep_andnot_wp = 1,
+ .smap_andnot_wp = 1,
+ };
/*
* If we don't have indirect shadow pages, it means no page is
@@ -4072,7 +4081,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
++vcpu->kvm->stat.mmu_pte_write;
kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
- mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
if (detect_write_misaligned(sp, gpa, bytes) ||
detect_write_flooding(sp)) {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1d6e92c..da8d395 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -624,8 +624,9 @@ EXPORT_SYMBOL_GPL(kvm_set_xcr);
int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
{
unsigned long old_cr4 = kvm_read_cr4(vcpu);
- unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE |
- X86_CR4_PAE | X86_CR4_SMEP;
+ unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
+ X86_CR4_SMEP | X86_CR4_SMAP;
+
if (cr4 & CR4_RESERVED_BITS)
return 1;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.13.y-ckt stable] Linux 3.13.11-ckt22 stable review Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200 [PATCH 3.13.y-ckt 088/122] igb: Fix NULL assignment to incorrect variable in igb_reset_q_vector Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 113/122] ipv6: do not delete previously existing ECMP routes if add fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 082/122] firmware: dmi_scan: Fix ordering of product_uuid Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 089/122] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 122/122] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 029/122] serial: of-serial: Remove device_type = "serial" registration Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 092/122] ALSA: hda - Add headphone quirk for Lifebook E752 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 104/122] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 118/122] unix/caif: sk_socket can disappear when state is unlocked Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 106/122] sd: Disable support for 256 byte/sector disks Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 115/122] net: core: Correct an over-stringent device loop detection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 101/122] ASoC: wm8994: correct BCLK DIV 348 to 384 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 107/122] libceph: request a new osdmap if lingering request maps to no osd Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 051/122] mm/memory-failure: call shake_page() when error hits thp tail page Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 108/122] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 114/122] ipv6: fix ECMP route replacement Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 110/122] net: phy: Allow EEE for all RGMII variants Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 109/122] ipvs: fix memory leak in ip_vs_ctl.c Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 100/122] ASoC: wm8960: fix "RINPUT3" audio route error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 087/122] spi: bitbang: Make setup_transfer() callback optional Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 083/122] ext4: fix NULL pointer dereference when journal restart fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 105/122] mmc: atmel-mci: fix bad variable type for clkdiv Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 116/122] x86: bpf_jit: fix compilation of large bpf programs Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 117/122] net: dp83640: fix broken calibration routine. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 120/122] udp: fix behavior of wrong checksums Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 086/122] mm, numa: really disable NUMA balancing by default on single node machines Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 102/122] Input: elantech - fix semi-mt protocol for v3 HW Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 103/122] powerpc: Align TOC to 256 bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 119/122] net_sched: invoke ->attach() after setting dev->qdisc Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 085/122] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 031/122] ALSA: emux: Fix mutex deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 077/122] xhci: gracefully handle xhci_irq dead device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 121/122] xen: netback: read hotplug script once at start of day. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 098/122] KVM: MMU: fix SMAP virtualization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 112/122] ipv4: Avoid crashing in ip_error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 025/122] 3w-xxxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 054/122] drm/radeon: make UVD handle checking more strict Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 111/122] bridge: fix parsing of MLDv2 reports Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 099/122] storvsc: Set the SRB flags correctly when no data transfer is needed Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 060/122] xen-pciback: Add name prefix to global 'permissive' variable Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 063/122] thermal: step_wise: Revert optimization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 097/122] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 061/122] mmc: card: Don't access RPMB partitions for normal read/write Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 068/122] USB: cp210x: add ID for KCF Technologies PRN device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 059/122] mmc: sh_mmcif: Fix timeout value for command request Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 066/122] usb: gadget: configfs: Fix interfaces array NULL-termination Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 071/122] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 055/122] drm/radeon: more strictly validate the UVD codec Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 058/122] pinctrl: Don't just pretend to protect pinctrl_maps, do it for real Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 080/122] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 093/122] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 053/122] ocfs2: dlm: fix race between purge and get lock resource Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 078/122] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 070/122] USB: visor: Match I330 phone more precisely Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 095/122] mac80211: move WEP tailroom size check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 081/122] drm/radeon: add new bonaire pci id Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 079/122] ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 096/122] KVM: MMU: fix smap permission check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 074/122] md/raid5: don't record new size if resize_stripes fails. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 075/122] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 064/122] libata: Add helper to determine when PHY events should be ignored Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 062/122] mmc: core: add missing pm event in mmc_pm_notify to fix hib restore Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 084/122] ext4: check for zero length extent explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 056/122] path_openat(): fix double fput() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 065/122] libata: Ignore spurious PHY event on LPM policy change Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 067/122] rtlwifi: rtl8192cu: Fix kernel deadlock Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 090/122] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 073/122] ACPI / init: Fix the ordering of acpi_reserve_resources() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 091/122] Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 094/122] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 052/122] nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 072/122] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 076/122] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 069/122] USB: pl2303: Remove support for Samsung I330 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 057/122] mnt: Fix fs_fully_visible to verify the root directory is visible Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 026/122] 3w-9xxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 034/122] powerpc/pseries: Correct cpu affinity for dlpar added cpus Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 018/122] ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 011/122] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 043/122] ARM: dts: imx28: Fix AUART4 TX-DMA interrupt name Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 023/122] SCSI: add 1024 max sectors black list flag Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 024/122] 3w-sas: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 017/122] ozwpan: unchecked signed subtraction leads to DoS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 040/122] ARM: dts: imx23-olinuxino: Fix polarity of LED GPIO Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 020/122] ALSA: emu10k1: Fix card shortname string buffer overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 044/122] gpio: sysfs: fix memory leaks and device hotplug Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 039/122] ARM: mvebu: armada-xp-openblocks-ax3-4: Disable internal RTC Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 019/122] ALSA: hda - Fix mute-LED fixed mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 042/122] ARM: dts: imx25: Add #pwm-cells to pwm4 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 036/122] efivarfs: Ensure VariableName is NUL-terminated Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 041/122] ARM: dts: imx23-olinuxino: Fix dr_mode of usb0 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 030/122] tty/serial: at91: maxburst was missing for dma transfers Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 050/122] xen/events: Set irq_info->evtchn before binding the channel to CPU in __startup_pirq() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 035/122] bridge/mdb: remove wrong use of NLM_F_MULTI Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 038/122] writeback: use |1 instead of +1 to protect against div by zero Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 016/122] ozwpan: Use proper check to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 046/122] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 045/122] drm/radeon: disable semaphores for UVD V1 (v2) Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 027/122] cdc-acm: prevent infinite loop when parsing CDC headers. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 028/122] serial: xilinx: Use platform_get_irq to get irq description structure Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 048/122] drm/i915: Add missing MacBook Pro models with dual channel LVDS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 049/122] xen/console: Update console event channel on resume Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 033/122] rbd: end I/O the entire obj_request on error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 032/122] ALSA: emu10k1: Emu10k2 32 bit DMA mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 015/122] ozwpan: divide-by-zero leading to panic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 037/122] x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 014/122] ozwpan: Use unsigned ints to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 047/122] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 022/122] drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 007/122] qla2xxx: remove redundant declaration in 'qla_gbl.h' Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 002/122] vhost/scsi: potential memory corruption Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 008/122] staging: wlags49_h2: fix extern inline functions Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 012/122] udf: Remove repeated loads blocksize Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 021/122] ALSA: emux: Fix mutex deadlock at unloading Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 006/122] staging: rtl8712, rtl8712: avoid lots of build warnings Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 010/122] kconfig: Fix warning "‘jump’ may be used uninitialized" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 001/122] Btrfs: make xattr replace operations atomic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 005/122] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 013/122] udf: Check length of extended attributes and allocation descriptors Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 009/122] ARM: 8307/1: psci: move psci firmware calls out of line Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 004/122] kernel: use the gnu89 standard explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
csiph-web