[PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address

From	Jiri Slaby <jslaby@suse.cz>
Newsgroups	linux.kernel
Subject	[PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address
Date	2016-02-24 11:50 +0100
Message-ID	<r5Fb3-3dH-17@gated-at.bofh.it> (permalink)
References	<r5Eym-2WS-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Matt Fleming <matt@codeblueprint.co.uk>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 742563777e8da62197d6cb4b99f4027f59454735 upstream.

There are a couple of nasty truncation bugs lurking in the pageattr
code that can be triggered when mapping EFI regions, e.g. when we pass
a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting
left by PAGE_SHIFT will truncate the resultant address to 32-bits.

Viorel-Cătălin managed to trigger this bug on his Dell machine that
provides a ~5GB EFI region which requires 1236992 pages to be mapped.
When calling populate_pud() the end of the region gets calculated
incorrectly in the following buggy expression,

  end = start + (cpa->numpages << PAGE_SHIFT);

And only 188416 pages are mapped. Next, populate_pud() gets invoked
for a second time because of the loop in __change_page_attr_set_clr(),
only this time no pages get mapped because shifting the remaining
number of pages (1048576) by PAGE_SHIFT is zero. At which point the
loop in __change_page_attr_set_clr() spins forever because we fail to
map progress.

Hitting this bug depends very much on the virtual address we pick to
map the large region at and how many pages we map on the initial run
through the loop. This explains why this issue was only recently hit
with the introduction of commit

  a5caa209ba9c ("x86/efi: Fix boot crash by mapping EFI memmap
   entries bottom-up at runtime, instead of top-down")

It's interesting to note that safe uses of cpa->numpages do exist in
the pageattr code. If instead of shifting ->numpages we multiply by
PAGE_SIZE, no truncation occurs because PAGE_SIZE is a UL value, and
so the result is unsigned long.

To avoid surprises when users try to convert very large cpa->numpages
values to addresses, change the data type from 'int' to 'unsigned
long', thereby making it suitable for shifting by PAGE_SHIFT without
any type casting.

The alternative would be to make liberal use of casting, but that is
far more likely to cause problems in the future when someone adds more
code and fails to cast properly; this bug was difficult enough to
track down in the first place.

Reported-and-tested-by: Viorel-Cătălin Răpițeanu <rapiteanu.catalin@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=110131
Link: http://lkml.kernel.org/r/1454067370-10374-1-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/mm/pageattr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index aabdf762f592..0fcd960b382a 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -32,7 +32,7 @@ struct cpa_data {
 	unsigned long	*vaddr;
 	pgprot_t	mask_set;
 	pgprot_t	mask_clr;
-	int		numpages;
+	unsigned long	numpages;
 	int		flags;
 	unsigned long	pfn;
 	unsigned	force_split : 1;
@@ -884,7 +884,7 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
 		 * CPA operation. Either a large page has been
 		 * preserved or a single page update happened.
 		 */
-		BUG_ON(cpa->numpages > numpages);
+		BUG_ON(cpa->numpages > numpages || !cpa->numpages);
 		numpages -= cpa->numpages;
 		if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY))
 			cpa->curpage++;
-- 
2.7.1

Thread

[PATCH 3.12 001/142] dcache: use IS_ROOT to decide where dentry is hashed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
  [PATCH 3.12 140/142] module: wrapper for symbol name. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
  [PATCH 3.12 103/142] SCSI: Add Marvell Console to VPD blacklist Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
  [PATCH 3.12 141/142] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
  [PATCH 3.12 130/142] xhci: Fix list corruption in urb dequeue at host removal Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 137/142] dump_stack: avoid potential deadlocks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 133/142] scripts/bloat-o-meter: fix python3 syntax error Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 106/142] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 138/142] intel_scu_ipcutil: underflow in scu_reg_access() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 125/142] Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 135/142] radix-tree: fix race in gang lookup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 129/142] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 127/142] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 126/142] Input: elantech - mark protocols v2 and v3 as semi-mt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 120/142] ARM: 8519/1: ICST: try other dividends than 1 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 132/142] dma-debug: switch check from _text to _stext Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 128/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 134/142] memcg: only free spare array when readers are done Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 119/142] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 105/142] iio:ad7793: Fix ad7785 product ID Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 131/142] m32r: fix m32104ut_defconfig build fail Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 136/142] radix-tree: fix oops after radix_tree_iter_retry Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
  [PATCH 3.12 117/142] udf: Check output buffer length when converting name to CS0 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 116/142] udf: Prevent buffer overrun with multi-byte characters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 121/142] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 124/142] mm: fix mlock accouting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 122/142] fuse: break infinite loop in fuse_fill_write_pages() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 108/142] iio: ad5064: Fix ad5629/ad5669 shift Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 114/142] nfs: Fix race in __update_open_stateid() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 112/142] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 109/142] iio: fix some warning messages Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 102/142] scsi_dh_rdac: always retry MODE SELECT on command lock violation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 118/142] ARM: dts: Kirkwood: Fix QNAP TS219 power-off Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 099/142] iscsi-target: Fix potential dead-lock during node acl delete Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 101/142] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 123/142] mm: soft-offline: check return value in second __get_any_page() call Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 113/142] cifs: fix erroneous return value Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 111/142] iio: dac: mcp4725: set iio name property in sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 110/142] iio: adis_buffer: Fix out-of-bounds memory access Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 115/142] udf: limit the maximum number of indirect extents in a row Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 068/142] ahci: Intel DNV device IDs SATA Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
  [PATCH 3.12 090/142] ptrace: use fsuid, fsgid, effective creds for fs access checks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 088/142] perf: Fix inherited events vs. tracepoint filters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 094/142] scsi: restart list search after unlock in scsi_remove_target Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 089/142] perf trace: Fix documentation for -i Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 085/142] ext4: fix potential integer overflow Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 065/142] crypto: algif_hash - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 083/142] serial: 8250_pci: Correct uartclk for xr17v35x expansion chips Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 093/142] klist: fix starting point removed bug in klist iterators Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 095/142] scsi_sysfs: Fix queue_ramp_up_period return code Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 086/142] btrfs: properly set the termination value of ctx->pos in readdir Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 091/142] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 087/142] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 098/142] SCSI: Fix NULL pointer dereference in runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 096/142] iscsi-target: Fix rx_login_comp hang after login failure Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 082/142] pty: make sure super_block is still valid in final /dev/tty close Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 100/142] SCSI: fix crashes in sd and sr runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 092/142] tracing: Fix freak link error caused by branch tracer Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 066/142] AHCI: Fix softreset failed issue of Port Multiplier Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 097/142] Fix a memory leak in scsi_host_dev_release() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
  [PATCH 3.12 074/142] tty: remove platform_sysrq_reset_seq Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 077/142] ALSA: seq: Fix double port list deletion Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 062/142] crypto: af_alg - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 081/142] pty: fix possible use after free of tty->driver_data Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 073/142] binfmt_elf: Don't clobber passed executable's file header Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 060/142] crypto: af_alg - Disallow bind/setkey/... after accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 002/142] pipe: Fix buffer offset after partially failed read Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 064/142] crypto: hash - Add crypto_ahash_has_setkey Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 063/142] crypto: algif_skcipher - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 072/142] FS-Cache: Don't override netfs's primary_index if registering failed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 078/142] phy: twl4030-usb: Relase usb phy on unload Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 070/142] crypto: user - lock crypto_alg_list on alg dump Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 080/142] staging/speakup: Use tty_ldisc_ref() for paste kworker Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 061/142] crypto: af_alg - Fix socket double-free when accept fails Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 071/142] FS-Cache: Increase reference of parent after registering, netfs success Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 079/142] wan/x25: Fix use-after-free in x25_asy_open_tty() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 059/142] crypto: algif_skcipher - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 075/142] s390: fix normalization bug in exception table sorting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 084/142] AIO: properly check iovec sizes Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
  [PATCH 3.12 054/142] USB: option: fix Cinterion AHxx enumeration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 058/142] ext4: Fix handling of extended tv_sec Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 057/142] xhci: fix usb2 resume timing and races. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 003/142] Revert "ocfs2: fix umask ignored issue" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 052/142] USB: cp210x: add ID for IAI USB to RS485 adaptor Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 051/142] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 055/142] tty: Fix GPF in flush_to_ldisc() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 056/142] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
  [PATCH 3.12 039/142] ALSA: seq: Fix lockdep warnings due to double mutex locks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 053/142] USB: serial: option: Adding support for Telit LE922 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 042/142] ALSA: timer: Fix link corruption due to double start or stop Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 010/142] sh64: fix __NR_fgetxattr Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 050/142] USB: serial: visor: fix crash on detecting device without write_urbs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 004/142] proc: actually make proc_fd_permission() thread-friendly Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 047/142] ALSA: hda - Fix speaker output from VAIO AiO machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 040/142] ALSA: timer: Code cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 045/142] ALSA: hda - Add fixup for Mac Mini 7,1 model Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 048/142] ALSA: dummy: Implement timer backend switching more safely Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 044/142] ALSA: timer: Fix race between stop and interrupt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 043/142] ALSA: timer: Fix wrong instance passed to slave callbacks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 046/142] ALSA: hda - Fix static checker warning in patch_hdmi.c Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 041/142] ALSA: timer: Fix leftover link at closing Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 038/142] ALSA: seq: Fix race at closing in virmidi driver Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 049/142] saa7134-alsa: Only frees registered sound cards Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
  [PATCH 3.12 032/142] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 031/142] ALSA: dummy: Disable switching timer backend via sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 022/142] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 024/142] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 029/142] ALSA: usb-audio: avoid freeing umidi object twice Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 019/142] tracing: Fix setting of start_index in find_next() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 025/142] v4l2-compat-ioctl32: fix alignment for ARM64 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 030/142] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 005/142] remoteproc: avoid stack overflow in debugfs file Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 028/142] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 026/142] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 021/142] fix calculation of meta_bg descriptor backups Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 007/142] kernel/signal.c: unexport sigsuspend() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 035/142] ALSA: pcm: Fix potential deadlock in OSS emulation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 034/142] ALSA: rawmidi: Fix race at copying & updating the position Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 037/142] ALSA: seq: Fix yet another races among ALSA timer accesses Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 023/142] parisc: Fix syscall restarts Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 027/142] fix sysvfs symlinks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 020/142] jbd2: Fix unreclaimed pages after truncate in data=journal mode Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 009/142] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 006/142] fat: fix fake_offset handling on error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 033/142] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 036/142] ASoC: dpcm: fix the BE state on hw_free Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
  [PATCH 3.12 017/142] vTPM: fix memory allocation flag for rtce buffer at kernel boot Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 014/142] spi: fix parent-device reference leak Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 011/142] Revert "dm mpath: fix stalls when handling invalid ioctls" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 018/142] mtd: mtdpart: fix add_mtd_partitions error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 016/142] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 012/142] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 013/142] spi: ti-qspi: Fix data corruption seen on r/w stress test Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 008/142] ocfs2/dlm: ignore cleaning the migration mle that is inuse Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
  [PATCH 3.12 015/142] wlcore/wl12xx: spi: fix oops on firmware load Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100

csiph-web