[PATCH 3.13.y-ckt 066/122] usb: gadget: configfs: Fix interfaces array NULL-termination

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 066/122] usb: gadget: configfs: Fix interfaces array NULL-termination
Date	2015-06-18 00:50 +0200
Message-ID	<pCujE-6JA-13@gated-at.bofh.it> (permalink)
References	<pCu0j-6mo-39@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt22 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Krzysztof Opasiak <k.opasiak@samsung.com>

commit 903124fe1aa284f61745a9dd4fbfa0184e569fff upstream.

memset() to 0 interfaces array before reusing
usb_configuration structure.

This commit fix bug:

ln -s functions/acm.1 configs/c.1
ln -s functions/acm.2 configs/c.1
ln -s functions/acm.3 configs/c.1
echo "UDC name" > UDC
echo "" > UDC
rm configs/c.1/acm.*
rmdir functions/*
mkdir functions/ecm.usb0
ln -s functions/ecm.usb0 configs/c.1
echo "UDC name" > UDC

[   82.220969] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   82.229009] pgd = c0004000
[   82.231698] [00000000] *pgd=00000000
[   82.235260] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[   82.240638] Modules linked in:
[   82.243681] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.0-rc2 #39
[   82.249926] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   82.256003] task: c07cd2f0 ti: c07c8000 task.ti: c07c8000
[   82.261393] PC is at composite_setup+0xe3c/0x1674
[   82.266073] LR is at composite_setup+0xf20/0x1674
[   82.270760] pc : [<c03510d4>]    lr : [<c03511b8>]    psr: 600001d3
[   82.270760] sp : c07c9df0  ip : c0806448  fp : ed8c9c9c
[   82.282216] r10: 00000001  r9 : 00000000  r8 : edaae918
[   82.287425] r7 : ed551cc0  r6 : 00007fff  r5 : 00000000  r4 : ed799634
[   82.293934] r3 : 00000003  r2 : 00010002  r1 : edaae918  r0 : 0000002e
[   82.300446] Flags: nZCv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
[   82.307910] Control: 10c5387d  Table: 6bc1804a  DAC: 00000015
[   82.313638] Process swapper/0 (pid: 0, stack limit = 0xc07c8210)
[   82.319627] Stack: (0xc07c9df0 to 0xc07ca000)
[   82.323969] 9de0:                                     00000000 c06e65f4 00000000 c07c9f68
[   82.332130] 9e00: 00000067 c07c59ac 000003f7 edaae918 ed8c9c98 ed799690 eca2f140 200001d3
[   82.340289] 9e20: ee79a2d8 c07c9e88 c07c5304 ffff55db 00010002 edaae810 edaae860 eda96d50
[   82.348448] 9e40: 00000009 ee264510 00000007 c07ca444 edaae860 c0340890 c0827a40 ffff55e0
[   82.356607] 9e60: c0827a40 eda96e40 ee264510 edaae810 00000000 edaae860 00000007 c07ca444
[   82.364766] 9e80: edaae860 c0354170 c03407dc c033db4c edaae810 00000000 00000000 00000010
[   82.372925] 9ea0: 00000032 c0341670 00000000 00000000 00000001 eda96e00 00000000 00000000
[   82.381084] 9ec0: 00000000 00000032 c0803a23 ee1aa840 00000001 c005d54c 249e2450 00000000
[   82.389244] 9ee0: 200001d3 ee1aa840 ee1aa8a0 ed84f4c0 00000000 c07c9f68 00000067 c07c59ac
[   82.397403] 9f00: 00000000 c005d688 ee1aa840 ee1aa8a0 c07db4b4 c006009c 00000032 00000000
[   82.405562] 9f20: 00000001 c005ce20 c07c59ac c005cf34 f002000c c07ca780 c07c9f68 00000057
[   82.413722] 9f40: f0020000 413fc090 00000001 c00086b4 c000f804 60000053 ffffffff c07c9f9c
[   82.421880] 9f60: c0803a20 c0011fc0 00000000 00000000 c07c9fb8 c001bee0 c07ca4f0 c057004c
[   82.430040] 9f80: c07ca4fc c0803a20 c0803a20 413fc090 00000001 00000000 01000000 c07c9fb0
[   82.438199] 9fa0: c000f800 c000f804 60000053 ffffffff 00000000 c0050e70 c0803bc0 c0783bd8
[   82.446358] 9fc0: ffffffff ffffffff c0783664 00000000 00000000 c07b13e8 00000000 c0803e54
[   82.454517] 9fe0: c07ca480 c07b13e4 c07ce40c 4000406a 00000000 40008074 00000000 00000000
[   82.462689] [<c03510d4>] (composite_setup) from [<c0340890>] (s3c_hsotg_complete_setup+0xb4/0x418)
[   82.471626] [<c0340890>] (s3c_hsotg_complete_setup) from [<c0354170>] (usb_gadget_giveback_request+0xc/0x10)
[   82.481429] [<c0354170>] (usb_gadget_giveback_request) from [<c033db4c>] (s3c_hsotg_complete_request+0xcc/0x12c)
[   82.491583] [<c033db4c>] (s3c_hsotg_complete_request) from [<c0341670>] (s3c_hsotg_irq+0x4fc/0x558)
[   82.500614] [<c0341670>] (s3c_hsotg_irq) from [<c005d54c>] (handle_irq_event_percpu+0x50/0x150)
[   82.509291] [<c005d54c>] (handle_irq_event_percpu) from [<c005d688>] (handle_irq_event+0x3c/0x5c)
[   82.518145] [<c005d688>] (handle_irq_event) from [<c006009c>] (handle_fasteoi_irq+0xd4/0x18c)
[   82.526650] [<c006009c>] (handle_fasteoi_irq) from [<c005ce20>] (generic_handle_irq+0x20/0x30)
[   82.535242] [<c005ce20>] (generic_handle_irq) from [<c005cf34>] (__handle_domain_irq+0x6c/0xdc)
[   82.543923] [<c005cf34>] (__handle_domain_irq) from [<c00086b4>] (gic_handle_irq+0x2c/0x6c)
[   82.552256] [<c00086b4>] (gic_handle_irq) from [<c0011fc0>] (__irq_svc+0x40/0x74)
[   82.559716] Exception stack(0xc07c9f68 to 0xc07c9fb0)
[   82.564753] 9f60:                   00000000 00000000 c07c9fb8 c001bee0 c07ca4f0 c057004c
[   82.572913] 9f80: c07ca4fc c0803a20 c0803a20 413fc090 00000001 00000000 01000000 c07c9fb0
[   82.581069] 9fa0: c000f800 c000f804 60000053 ffffffff
[   82.586113] [<c0011fc0>] (__irq_svc) from [<c000f804>] (arch_cpu_idle+0x30/0x3c)
[   82.593491] [<c000f804>] (arch_cpu_idle) from [<c0050e70>] (cpu_startup_entry+0x128/0x1a4)
[   82.601740] [<c0050e70>] (cpu_startup_entry) from [<c0783bd8>] (start_kernel+0x350/0x3bc)
[   82.609890] Code: 0a000002 e3530005 05975010 15975008 (e5953000)
[   82.615965] ---[ end trace f57d5f599a5f1bfa ]---

Most of kernel code assume that interface array in
struct usb_configuration is NULL terminated.

When gadget is composed with configfs configuration
structure may be reused for different functions set.

This bug happens because purge_configs_funcs() sets
only next_interface_id to 0. Interface array still
contains pointers to already freed interfaces. If in
second try we add less interfaces than earlier we
may access unallocated memory when trying to get
interface descriptors.

Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/gadget/configfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 2588511..a856959 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -757,6 +757,7 @@ static void purge_configs_funcs(struct gadget_info *gi)
 			}
 		}
 		c->next_interface_id = 0;
+		memset(c->interface, 0, sizeof(c->interface));
 		c->superspeed = 0;
 		c->highspeed = 0;
 		c->fullspeed = 0;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt22 stable review Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.13.y-ckt 088/122] igb: Fix NULL assignment to incorrect variable in igb_reset_q_vector Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 113/122] ipv6: do not delete previously existing ECMP routes if add fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 082/122] firmware: dmi_scan: Fix ordering of product_uuid Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 089/122] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 122/122] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 029/122] serial: of-serial: Remove device_type = "serial" registration Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 092/122] ALSA: hda - Add headphone quirk for Lifebook E752 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 104/122] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 118/122] unix/caif: sk_socket can disappear when state is unlocked Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 106/122] sd: Disable support for 256 byte/sector disks Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 115/122] net: core: Correct an over-stringent device loop detection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 101/122] ASoC: wm8994: correct BCLK DIV 348 to 384 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 107/122] libceph: request a new osdmap if lingering request maps to no osd Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 051/122] mm/memory-failure: call shake_page() when error hits thp tail page Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 108/122] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 114/122] ipv6: fix ECMP route replacement Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 110/122] net: phy: Allow EEE for all RGMII variants Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 109/122] ipvs: fix memory leak in ip_vs_ctl.c Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 100/122] ASoC: wm8960: fix "RINPUT3" audio route error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 087/122] spi: bitbang: Make setup_transfer() callback optional Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 083/122] ext4: fix NULL pointer dereference when journal restart fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 105/122] mmc: atmel-mci: fix bad variable type for clkdiv Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 116/122] x86: bpf_jit: fix compilation of large bpf programs Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 117/122] net: dp83640: fix broken calibration routine. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 120/122] udp: fix behavior of wrong checksums Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 086/122] mm, numa: really disable NUMA balancing by default on single node machines Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 102/122] Input: elantech - fix semi-mt protocol for v3 HW Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 103/122] powerpc: Align TOC to 256 bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 119/122] net_sched: invoke ->attach() after setting dev->qdisc Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 085/122] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 031/122] ALSA: emux: Fix mutex deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 077/122] xhci: gracefully handle xhci_irq dead device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 121/122] xen: netback: read hotplug script once at start of day. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 098/122] KVM: MMU: fix SMAP virtualization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 112/122] ipv4: Avoid crashing in ip_error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 025/122] 3w-xxxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 054/122] drm/radeon: make UVD handle checking more strict Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 111/122] bridge: fix parsing of MLDv2 reports Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 099/122] storvsc: Set the SRB flags correctly when no data transfer is needed Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200
  [PATCH 3.13.y-ckt 060/122] xen-pciback: Add name prefix to global 'permissive' variable Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 063/122] thermal: step_wise: Revert optimization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 097/122] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 061/122] mmc: card: Don't access RPMB partitions for normal read/write Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 068/122] USB: cp210x: add ID for KCF Technologies PRN device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 059/122] mmc: sh_mmcif: Fix timeout value for command request Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 066/122] usb: gadget: configfs: Fix interfaces array NULL-termination Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 071/122] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 055/122] drm/radeon: more strictly validate the UVD codec Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 058/122] pinctrl: Don't just pretend to protect pinctrl_maps, do it for real Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 080/122] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 093/122] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 053/122] ocfs2: dlm: fix race between purge and get lock resource Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 078/122] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 070/122] USB: visor: Match I330 phone more precisely Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 095/122] mac80211: move WEP tailroom size check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 081/122] drm/radeon: add new bonaire pci id Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 079/122] ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 096/122] KVM: MMU: fix smap permission check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 074/122] md/raid5: don't record new size if resize_stripes fails. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 075/122] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 064/122] libata: Add helper to determine when PHY events should be ignored Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 062/122] mmc: core: add missing pm event in mmc_pm_notify to fix hib restore Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 084/122] ext4: check for zero length extent explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 056/122] path_openat(): fix double fput() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 065/122] libata: Ignore spurious PHY event on LPM policy change Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 067/122] rtlwifi: rtl8192cu: Fix kernel deadlock Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 090/122] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 073/122] ACPI / init: Fix the ordering of acpi_reserve_resources() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 091/122] Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 094/122] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 052/122] nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 072/122] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 076/122] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 069/122] USB: pl2303: Remove support for Samsung I330 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 057/122] mnt: Fix fs_fully_visible to verify the root directory is visible Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200
  [PATCH 3.13.y-ckt 026/122] 3w-9xxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 034/122] powerpc/pseries: Correct cpu affinity for dlpar added cpus Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 018/122] ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 011/122] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 043/122] ARM: dts: imx28: Fix AUART4 TX-DMA interrupt name Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 023/122] SCSI: add 1024 max sectors black list flag Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 024/122] 3w-sas: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 017/122] ozwpan: unchecked signed subtraction leads to DoS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 040/122] ARM: dts: imx23-olinuxino: Fix polarity of LED GPIO Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 020/122] ALSA: emu10k1: Fix card shortname string buffer overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 044/122] gpio: sysfs: fix memory leaks and device hotplug Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 039/122] ARM: mvebu: armada-xp-openblocks-ax3-4: Disable internal RTC Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 019/122] ALSA: hda - Fix mute-LED fixed mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 042/122] ARM: dts: imx25: Add #pwm-cells to pwm4 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 036/122] efivarfs: Ensure VariableName is NUL-terminated Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 041/122] ARM: dts: imx23-olinuxino: Fix dr_mode of usb0 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 030/122] tty/serial: at91: maxburst was missing for dma transfers Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 050/122] xen/events: Set irq_info->evtchn before binding the channel to CPU in __startup_pirq() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 035/122] bridge/mdb: remove wrong use of NLM_F_MULTI Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 038/122] writeback: use |1 instead of +1 to protect against div by zero Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 016/122] ozwpan: Use proper check to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 046/122] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 045/122] drm/radeon: disable semaphores for UVD V1 (v2) Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 027/122] cdc-acm: prevent infinite loop when parsing CDC headers. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 028/122] serial: xilinx: Use platform_get_irq to get irq description structure Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 048/122] drm/i915: Add missing MacBook Pro models with dual channel LVDS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 049/122] xen/console: Update console event channel on resume Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 033/122] rbd: end I/O the entire obj_request on error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 032/122] ALSA: emu10k1: Emu10k2 32 bit DMA mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 015/122] ozwpan: divide-by-zero leading to panic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 037/122] x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 014/122] ozwpan: Use unsigned ints to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 047/122] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 022/122] drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200
  [PATCH 3.13.y-ckt 007/122] qla2xxx: remove redundant declaration in 'qla_gbl.h' Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 002/122] vhost/scsi: potential memory corruption Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 008/122] staging: wlags49_h2: fix extern inline functions Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 012/122] udf: Remove repeated loads blocksize Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 021/122] ALSA: emux: Fix mutex deadlock at unloading Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 006/122] staging: rtl8712, rtl8712: avoid lots of build warnings Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 010/122] kconfig: Fix warning "‘jump’ may be used uninitialized" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 001/122] Btrfs: make xattr replace operations atomic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 005/122] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 013/122] udf: Check length of extended attributes and allocation descriptors Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 009/122] ARM: 8307/1: psci: move psci firmware calls out of line Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.13.y-ckt 004/122] kernel: use the gnu89 standard explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200

csiph-web