Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1252084
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 155/156] netlink, mmap: fix edge-case leakages in nf queue zero-copy |
| Date | 2015-10-20 23:50 +0200 |
| Message-ID | <qlMX8-7PN-11@gated-at.bofh.it> (permalink) |
| References | <qlMNr-7E9-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 6bb0fef489f667cf701853054f44579754f00a06 upstream.
When netlink mmap on receive side is the consumer of nf queue data,
it can happen that in some edge cases, we write skb shared info into
the user space mmap buffer:
Assume a possible rx ring frame size of only 4096, and the network skb,
which is being zero-copied into the netlink skb, contains page frags
with an overall skb->len larger than the linear part of the netlink
skb.
skb_zerocopy(), which is generic and thus not aware of the fact that
shared info cannot be accessed for such skbs then tries to write and
fill frags, thus leaking kernel data/pointers and in some corner cases
possibly writing out of bounds of the mmap area (when filling the
last slot in the ring buffer this way).
I.e. the ring buffer slot is then of status NL_MMAP_STATUS_VALID, has
an advertised length larger than 4096, where the linear part is visible
at the slot beginning, and the leaked sizeof(struct skb_shared_info)
has been written to the beginning of the next slot (also corrupting
the struct nl_mmap_hdr slot header incl. status etc), since skb->end
points to skb->data + ring->frame_size - NL_MMAP_HDRLEN.
The fix adds and lets __netlink_alloc_skb() take the actual needed
linear room for the network skb + meta data into account. It's completely
irrelevant for non-mmaped netlink sockets, but in case mmap sockets
are used, it can be decided whether the available skb_tailroom() is
really large enough for the buffer, or whether it needs to internally
fallback to a normal alloc_skb().
>From nf queue side, the information whether the destination port is
an mmap RX ring is not really available without extra port-to-socket
lookup, thus it can only be determined in lower layers i.e. when
__netlink_alloc_skb() is called that checks internally for this. I
chose to add the extra ldiff parameter as mmap will then still work:
We have data_len and hlen in nfqnl_build_packet_message(), data_len
is the full length (capped at queue->copy_range) for skb_zerocopy()
and hlen some possible part of data_len that needs to be copied; the
rem_len variable indicates the needed remaining linear mmap space.
The only other workaround in nf queue internally would be after
allocation time by f.e. cap'ing the data_len to the skb_tailroom()
iff we deal with an mmap skb, but that would 1) expose the fact that
we use a mmap skb to upper layers, and 2) trim the skb where we
otherwise could just have moved the full skb into the normal receive
queue.
After the patch, in my test case the ring slot doesn't fit and therefore
shows NL_MMAP_STATUS_COPY, where a full skb carries all the data and
thus needs to be picked up via recv().
Fixes: 3ab1f683bf8b ("nfnetlink: add support for memory mapped netlink")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/netlink.h | 13 +++++++++++--
net/netfilter/nfnetlink_queue_core.c | 5 +++--
net/netlink/af_netlink.c | 18 ++++++++++++------
3 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 02fc86d..68841a1 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -66,8 +66,17 @@ extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group);
extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
extern int netlink_has_listeners(struct sock *sk, unsigned int group);
-extern struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
- u32 dst_portid, gfp_t gfp_mask);
+
+extern struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ unsigned int ldiff, u32 dst_portid,
+ gfp_t gfp_mask);
+static inline struct sk_buff *
+netlink_alloc_skb(struct sock *ssk, unsigned int size, u32 dst_portid,
+ gfp_t gfp_mask)
+{
+ return __netlink_alloc_skb(ssk, size, 0, dst_portid, gfp_mask);
+}
+
extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
__u32 group, gfp_t allocation);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 900cedc..42d402c 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -284,7 +284,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
__be32 **packet_id_ptr)
{
size_t size;
- size_t data_len = 0, cap_len = 0;
+ size_t data_len = 0, cap_len = 0, rem_len = 0;
unsigned int hlen = 0;
struct sk_buff *skb;
struct nlattr *nla;
@@ -341,6 +341,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
hlen = min_t(unsigned int, hlen, data_len);
size += sizeof(struct nlattr) + hlen;
cap_len = entskb->len;
+ rem_len = data_len - hlen;
break;
}
@@ -352,7 +353,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ nla_total_size(sizeof(u_int32_t))); /* gid */
}
- skb = nfnetlink_alloc_skb(net, size, queue->peer_portid,
+ skb = __netlink_alloc_skb(net->nfnl, size, rem_len, queue->peer_portid,
GFP_ATOMIC);
if (!skb) {
skb_tx_error(entskb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c47affe..8b57d6a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1806,15 +1806,16 @@ retry:
}
EXPORT_SYMBOL(netlink_unicast);
-struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
- u32 dst_portid, gfp_t gfp_mask)
+struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ unsigned int ldiff, u32 dst_portid,
+ gfp_t gfp_mask)
{
#ifdef CONFIG_NETLINK_MMAP
+ unsigned int maxlen, linear_size;
struct sock *sk = NULL;
struct sk_buff *skb;
struct netlink_ring *ring;
struct nl_mmap_hdr *hdr;
- unsigned int maxlen;
sk = netlink_getsockbyportid(ssk, dst_portid);
if (IS_ERR(sk))
@@ -1825,7 +1826,11 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
if (ring->pg_vec == NULL)
goto out_put;
- if (ring->frame_size - NL_MMAP_HDRLEN < size)
+ /* We need to account the full linear size needed as a ring
+ * slot cannot have non-linear parts.
+ */
+ linear_size = size + ldiff;
+ if (ring->frame_size - NL_MMAP_HDRLEN < linear_size)
goto out_put;
skb = alloc_skb_head(gfp_mask);
@@ -1839,13 +1844,14 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
/* check again under lock */
maxlen = ring->frame_size - NL_MMAP_HDRLEN;
- if (maxlen < size)
+ if (maxlen < linear_size)
goto out_free;
netlink_forward_ring(ring);
hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
if (hdr == NULL)
goto err2;
+
netlink_ring_setup_skb(skb, sk, ring, hdr);
netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
atomic_inc(&ring->pending);
@@ -1871,7 +1877,7 @@ out:
#endif
return alloc_skb(size, gfp_mask);
}
-EXPORT_SYMBOL_GPL(netlink_alloc_skb);
+EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt8 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.19.y-ckt 001/156] USB: whiteheat: fix potential null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.19.y-ckt 139/156] IB/iser: Fix missing return status check in iser_send_data_out Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 133/156] mmc: sdhci: also get preset value and driver type for MMC_DDR52 Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 126/156] perf hists: Update the column width for the "srcline" sort key Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 148/156] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
RE: [PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow Eli Cohen <eli@mellanox.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 155/156] netlink, mmap: fix edge-case leakages in nf queue zero-copy Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 123/156] clk: versatile: off by one in clk_sp810_timerclken_of_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 110/156] lib/decompressors: use real out buf size for gunzip with kernel Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 145/156] ipv6: fix exthdrs offload registration in out_rt path Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 070/156] sched: Fix cpu_active_mask/cpu_online_mask race Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 144/156] sock, diag: fix panic in sock_diag_put_filterinfo Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 153/156] batman-adv: Make DAT capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 127/156] batman-adv: Fix potentially broken skb network header access Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 141/156] IB/uverbs: Fix race between ib_uverbs_open and remove_one Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 136/156] IB/mlx4: Fix potential deadlock when sending mad to wire Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 142/156] mmc: core: fix race condition in mmc_wait_data_done Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 132/156] ath10k: fix dma_mapping_error() handling Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 156/156] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 154/156] batman-adv: Make NC capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 150/156] net: dsa: bcm_sf2: Fix 64-bits register writes Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 134/156] perf stat: Get correct cpu id for print_aggr Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 151/156] thermal: exynos: Disable the regulator on probe failure Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 135/156] ASoC: spear_pcm: Use devm_snd_dmaengine_pcm_register to fix resource leak Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 140/156] IB/iser: Fix possible bogus DMA unmapping Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 143/156] drm/i915: Preserve SSC earlier Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 108/156] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 131/156] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 146/156] cpufreq: dt: Tolerance applies on both sides of target voltage Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 109/156] hfs: fix B-tree corruption after insertion at position 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 125/156] windfarm: decrement client count when unregistering Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 116/156] x86/mm: Initialize pmd_idx in page_table_range_init_count() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 137/156] IB/mlx4: Forbid using sysfs to change RoCE pkeys Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 138/156] IB/mlx4: Use correct SL on AH query under RoCE Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 149/156] ebpf: fix fd refcount leaks related to maps in bpf syscall Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 124/156] usb: gadget: m66592-udc: forever loop in set_feature() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 120/156] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 152/156] svcrdma: Fix send_reply() scatter/gather set-up Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 118/156] net: bcmgenet: Delay PHY initialization to bcmgenet_open() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 103/156] PCI,parisc: Enable 64-bit bus addresses on PA-RISC Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 113/156] PCI: Fix TI816X class code quirk Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 097/156] mm: check if section present during memory block registering Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 112/156] pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 101/156] rtc: s5m: fix to update ctrl register Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 117/156] net: bcmgenet: Use correct dev_id for free_irq Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 121/156] clk: qcom: Set CLK_SET_RATE_PARENT on ce1 clocks Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 106/156] drm/i915: Limit the number of loops for reading a split 64bit register Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 122/156] jbd2: avoid infinite loop when destroying aborted journal Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 105/156] vmscan: fix increasing nr_isolated incurred by putback unevictable pages Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 115/156] PM / clk: don't return int on __pm_clk_enable() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 114/156] pinctrl: single: dra7: remove PCS_QUIRK_SHARED_IRQ Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 130/156] bridge: fix netlink max attr size Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 129/156] mtd: pxa3xx_nand: add a default chunk size Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 100/156] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 119/156] net: dsa: bcm_sf2: Do not override speed settings Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 111/156] drm/qxl: validate monitors config modes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 128/156] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 102/156] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 096/156] crypto: ghash-clmulni: specify context size for ghash async algorithm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 107/156] watchdog: sunxi: fix activation of system reset Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 086/156] drm/radeon/atom: Send out the full AUX address Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 092/156] Add radeon suspend/resume quirk for HP Compaq dc5750. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 093/156] IB/uverbs: reject invalid or unknown opcodes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 087/156] net: sunrpc: fix tracepoint Warning: unknown op '->' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 091/156] drm/i915: Always mark the object as dirty when used by the GPU Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 095/156] Input: evdev - do not report errors form flush() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 078/156] ALSA: usb-audio: correct the value cache check. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 083/156] spi: sh-msiof: Fix FIFO size to 64 word from 256 word Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 073/156] drivercore: Fix unregistration path of platform devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 077/156] xfs: return errors from partial I/O failures to files Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 069/156] xfs: Fix file type directory corruption for btree directories Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 076/156] clk: s5pv210: add missing call to samsung_clk_of_add_provider() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 074/156] arm64: flush FP/SIMD state correctly after execve() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 067/156] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 104/156] parisc: Use double word condition in 64bit CAS operation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 068/156] PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 081/156] IB/srp: Handle partial connection success correctly Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 080/156] pinctrl: at91: fix null pointer dereference Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 094/156] hpfs: update ctime and mtime on directory modification Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 084/156] drm/i915: Check DP link status on long hpd too Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 071/156] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 075/156] mmc: sdhci-pci: set the clear transfer mode register quirk for O2Micro Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 082/156] IB/srp: Stop the scsi_eh_<n> and scsi_tmf_<n> threads if login fails Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 085/156] drm/i915: apply the PCI_D0/D3 hibernation workaround everywhere on pre GEN6 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 072/156] of/address: Don't loop forever in of_find_matching_node_by_address(). Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 090/156] tg3: Fix temperature reporting Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 066/156] ARM: orion5x: fix legacy orion5x IRQ numbers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 088/156] nfsd: ensure that the ol stateid hash reference is only put once Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 055/156] USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 038/156] x86/mce: Reenable CMCI banks when swiching back to interrupt mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 089/156] nfsd: ensure that delegation stateid hash references are only put once Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 057/156] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 042/156] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 033/156] iio: industrialio-buffer: Fix iio_buffer_poll return value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 048/156] blk-mq: fix race between timeout and freeing request Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 036/156] unshare: Unsharing a thread does not require unsharing a vm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 040/156] regulator: pbias: Fix broken pbias disable functionality Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 032/156] iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 016/156] staging: comedi: usbduxsigma: don't clobber ao_timer in command test Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 061/156] s390/setup: fix novx parameter Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 044/156] serial: 8250: bind to ALi Fast Infrared Controller (ALI5123) Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 037/156] fs: Set the size of empty dirs to 0. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 050/156] NFS: nfs_set_pgio_error sometimes misses errors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 046/156] ext4: don't manipulate recovery flag when freezing no-journal fs Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 015/156] staging: comedi: usbduxsigma: don't clobber ai_timer in command test Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 051/156] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 035/156] NFSv4: don't set SETATTR for O_RDONLY|O_EXCL Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 002/156] dcache: Handle escaped paths in prepend_path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 031/156] ASoC: rt5640: fix line out no sound issue Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 065/156] ASoC: samsung: Remove redundant arndale_audio_remove Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 049/156] xtensa: fix kernel register spilling Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 056/156] igb: Fix oops caused by missing queue pairing Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 030/156] ideapad-laptop: Add Lenovo Yoga 3 14 to no_hw_rfkill dmi list Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 047/156] blk-mq: fix buffer overflow when reading sysfs file of 'pending' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 041/156] drivers: usb :fsl: Implement Workaround for USB Erratum A007792 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 043/156] serial: 8250: don't bind to SMSC IrCC IR port Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 064/156] Btrfs: check if previous transaction aborted to avoid fs corruption Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 053/156] USB: symbolserial: Use usb_get_serial_port_data Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 034/156] iio: event: Remove negative error code from iio_event_poll Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 063/156] ASoC: arizona: Fix gain settings of FLL in free-run mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 062/156] arm64: kconfig: Move LIST_POISON to a safe value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 039/156] ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 014/156] PCI: Add VPD function 0 quirk for Intel Ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 045/156] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 060/156] xfs: Fix xfs_attr_leafblock definition Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 052/156] usb: host: ehci-sys: delete useless bus_to_hcd conversion Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 059/156] libxfs: readahead of dir3 data blocks should use the read verifier Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 028/156] iio: Add inverse unit conversion macros Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 017/156] clk: exynos4: Fix wrong clock for Exynos4x12 ADC Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 011/156] mac80211: enable assoc check for mesh interfaces Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 013/156] PCI: Add dev_flags bit to access VPD through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 022/156] Doc: ABI: testing: configfs-usb-gadget-sourcesink Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 009/156] xtensa: fix threadptr reload on return to userspace Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 018/156] USB: pl2303: fix baud-rate divisor calculations Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 027/156] iio: adis16400: Fix adis16448 gyroscope scale Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 010/156] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 020/156] usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 019/156] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 003/156] vfs: Test for and handle paths that are unreachable from their mnt_root Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 021/156] Doc: ABI: testing: configfs-usb-gadget-loopback Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 029/156] iio: adis16480: Fix scale factors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 025/156] auxdisplay: ks0108: fix refcount Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 023/156] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 012/156] rtlwifi: rtl8821ae: Fix an expression that is always false Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 024/156] KVM: MMU: fix validation of mmio page fault Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 006/156] [media] rc-core: fix remove uevent generation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 008/156] HID: cp2112: fix byte order in SMBUS operations Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
csiph-web