Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1438798
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 07/99] Bluetooth: vhci: fix open_timeout vs. hdev race |
| Date | 2016-07-07 20:40 +0200 |
| Message-ID | <rSmnn-2ax-17@gated-at.bofh.it> (permalink) |
| References | <rSmnn-2ax-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jiri Slaby <jslaby@suse.cz>
commit 373a32c848ae3a1c03618517cce85f9211a6facf upstream.
Both vhci_get_user and vhci_release race with open_timeout work. They
both contain cancel_delayed_work_sync, but do not test whether the
work actually created hdev or not. Since the work can be in progress
and _sync will wait for finishing it, we can have data->hdev allocated
when cancel_delayed_work_sync returns. But the call sites do 'if
(data->hdev)' *before* cancel_delayed_work_sync.
As a result:
* vhci_get_user allocates a second hdev and puts it into
data->hdev. The former is leaked.
* vhci_release does not release data->hdev properly as it thinks there
is none.
Fix both cases by moving the actual test *after* the call to
cancel_delayed_work_sync.
This can be hit by this program:
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
int main(int argc, char **argv)
{
int fd;
srand(time(NULL));
while (1) {
const int delta = (rand() % 200 - 100) * 100;
fd = open("/dev/vhci", O_RDWR);
if (fd < 0)
err(1, "open");
usleep(1000000 + delta);
close(fd);
}
return 0;
}
And the result is:
BUG: KASAN: use-after-free in skb_queue_tail+0x13e/0x150 at addr ffff88006b0c1228
Read of size 8 by task kworker/u13:1/32068
=============================================================================
BUG kmalloc-192 (Tainted: G E ): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in vhci_open+0x50/0x330 [hci_vhci] age=260 cpu=3 pid=32040
...
kmem_cache_alloc_trace+0x150/0x190
vhci_open+0x50/0x330 [hci_vhci]
misc_open+0x35b/0x4e0
chrdev_open+0x23b/0x510
...
INFO: Freed in vhci_release+0xa4/0xd0 [hci_vhci] age=9 cpu=2 pid=32040
...
__slab_free+0x204/0x310
vhci_release+0xa4/0xd0 [hci_vhci]
...
INFO: Slab 0xffffea0001ac3000 objects=16 used=13 fp=0xffff88006b0c1e00 flags=0x5fffff80004080
INFO: Object 0xffff88006b0c1200 @offset=4608 fp=0xffff88006b0c0600
Bytes b4 ffff88006b0c11f0: 09 df 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff88006b0c1200: 00 06 0c 6b 00 88 ff ff 00 00 00 00 00 00 00 00 ...k............
Object ffff88006b0c1210: 10 12 0c 6b 00 88 ff ff 10 12 0c 6b 00 88 ff ff ...k.......k....
Object ffff88006b0c1220: c0 46 c2 6b 00 88 ff ff c0 46 c2 6b 00 88 ff ff .F.k.....F.k....
Object ffff88006b0c1230: 01 00 00 00 01 00 00 00 e0 ff ff ff 0f 00 00 00 ................
Object ffff88006b0c1240: 40 12 0c 6b 00 88 ff ff 40 12 0c 6b 00 88 ff ff @..k....@..k....
Object ffff88006b0c1250: 50 0d 6e a0 ff ff ff ff 00 02 00 00 00 00 ad de P.n.............
Object ffff88006b0c1260: 00 00 00 00 00 00 00 00 ab 62 02 00 01 00 00 00 .........b......
Object ffff88006b0c1270: 90 b9 19 81 ff ff ff ff 38 12 0c 6b 00 88 ff ff ........8..k....
Object ffff88006b0c1280: 03 00 20 00 ff ff ff ff ff ff ff ff 00 00 00 00 .. .............
Object ffff88006b0c1290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff88006b0c12a0: 00 00 00 00 00 00 00 00 00 80 cd 3d 00 88 ff ff ...........=....
Object ffff88006b0c12b0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ..............
Redzone ffff88006b0c12c0: bb bb bb bb bb bb bb bb ........
Padding ffff88006b0c13f8: 00 00 00 00 00 00 00 00 ........
CPU: 3 PID: 32068 Comm: kworker/u13:1 Tainted: G B E 4.4.6-0-default #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20151112_172657-sheep25 04/01/2014
Workqueue: hci0 hci_cmd_work [bluetooth]
00000000ffffffff ffffffff81926cfa ffff88006be37c68 ffff88006bc27180
ffff88006b0c1200 ffff88006b0c1234 ffffffff81577993 ffffffff82489320
ffff88006bc24240 0000000000000046 ffff88006a100000 000000026e51eb80
Call Trace:
...
[<ffffffff81ec8ebe>] ? skb_queue_tail+0x13e/0x150
[<ffffffffa06e027c>] ? vhci_send_frame+0xac/0x100 [hci_vhci]
[<ffffffffa0c61268>] ? hci_send_frame+0x188/0x320 [bluetooth]
[<ffffffffa0c61515>] ? hci_cmd_work+0x115/0x310 [bluetooth]
[<ffffffff811a1375>] ? process_one_work+0x815/0x1340
[<ffffffff811a1f85>] ? worker_thread+0xe5/0x11f0
[<ffffffff811a1ea0>] ? process_one_work+0x1340/0x1340
[<ffffffff811b3c68>] ? kthread+0x1c8/0x230
...
Memory state around the buggy address:
ffff88006b0c1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88006b0c1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88006b0c1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88006b0c1280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88006b0c1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/bluetooth/hci_vhci.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 6653473..1d63c5b 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -197,13 +197,13 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
break;
case HCI_VENDOR_PKT:
+ cancel_delayed_work_sync(&data->open_timeout);
+
if (data->hdev) {
kfree_skb(skb);
return -EBADFD;
}
- cancel_delayed_work_sync(&data->open_timeout);
-
opcode = *((__u8 *) skb->data);
skb_pull(skb, 1);
@@ -341,10 +341,12 @@ static int vhci_open(struct inode *inode, struct file *file)
static int vhci_release(struct inode *inode, struct file *file)
{
struct vhci_data *data = file->private_data;
- struct hci_dev *hdev = data->hdev;
+ struct hci_dev *hdev;
cancel_delayed_work_sync(&data->open_timeout);
+ hdev = data->hdev;
+
if (hdev) {
hci_unregister_dev(hdev);
hci_free_dev(hdev);
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt23 stable review Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 06/99] drm/gma500: Fix possible out of bounds read Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 07/99] Bluetooth: vhci: fix open_timeout vs. hdev race Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 03/99] drm/i915: Fix race condition in intel_dp_destroy_mst_connector() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 08/99] Bluetooth: vhci: purge unhandled skbs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 82/99] KVM: MTRR: remove MSR 0x2f8 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 92/99] xen/events: Don't move disabled irqs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 95/99] hpfs: fix remount failure when there are no options changed Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 84/99] Input: uinput - handle compat ioctl for UI_SET_PHYS Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 81/99] xfs: skip stale inodes in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 87/99] mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 73/99] fs/cifs: correctly to anonymous authentication via NTLMSSP Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 74/99] fs/cifs: correctly to anonymous authentication for the LANMAN authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 91/99] xen/x86: actually allocate legacy interrupts on PV guests Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 89/99] sunrpc: fix stripping of padded MIC tokens Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 43/99] MIPS: Fix siginfo.h to use strict posix types Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 05/99] ath5k: Change led pin configuration for compaq c700 laptop Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 88/99] mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 77/99] remove directory incorrectly tries to set delete on close on non-empty directories Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 71/99] drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 90/99] wait/ptrace: assume __WALL if the child is traced Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 76/99] fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 70/99] MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 98/99] powerpc/pseries: Fix PCI config address for DDW Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 64/99] powerpc/eeh: Restore initial state in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 83/99] ASoC: ak4642: Enable cache usage to fix crashes on resume Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 93/99] dma-debug: avoid spinlock recursion when disabling dma-debug Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 65/99] MIPS: math-emu: Fix jalr emulation when rd == $0 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 85/99] PM / sleep: Handle failures in device_suspend_late() consistently Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 97/99] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 78/99] cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 96/99] hpfs: implement the show_options method Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 44/99] MIPS: Don't unwind to user mode with EVA Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 86/99] mmc: longer timeout for long read time quirk Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 01/99] mm: migrate dirty page without clear_page_dirty_for_io etc Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 99/99] can: fix handling of unmodifiable configuration options fix Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 75/99] fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 69/99] PCI: Disable all BAR sizing for devices with non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 36/99] ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA internal strings Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 94/99] Input: xpad - prevent spurious input from wired Xbox 360 controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 80/99] xfs: fix inode validity check in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 79/99] xfs: xfs_iflush_cluster fails to abort on error Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 68/99] mmc: mmc: Fix partition switch timeout for some eMMCs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 72/99] drm/fb_helper: Fix references to dev->mode_config.num_connector Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 53/99] USB: serial: quatech2: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 55/99] MIPS: KVM: Fix timer IRQ race when freezing timer Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 66/99] ring-buffer: Use long for nr_pages to avoid overflow failures Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 46/99] MIPS: Reserve nosave data for hibernation Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 59/99] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 35/99] USB: serial: option: add even more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 58/99] irqchip/gic: Ensure ordering between read of INTACK and shared data Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 33/99] mcb: Fixed bar number assignment for the gdd Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 57/99] gcov: disable tree-loop-im to reduce stack usage Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 42/99] can: fix handling of unmodifiable configuration options Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 34/99] USB: serial: option: add more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 24/99] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 45/99] MIPS: Avoid using unwind_stack() with usermode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 50/99] USB: serial: io_edgeport: fix memory leaks in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 26/99] aacraid: Fix for aac_command_thread hang Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 54/99] crypto: caam - fix caam_jr_alloc() ret code Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 52/99] USB: serial: mxuport: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 62/99] rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 67/99] ring-buffer: Prevent overflow of size in ring_buffer_resize() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 38/99] ext4: fix oops on corrupted filesystem Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 56/99] MIPS: KVM: Fix timer IRQ race when writing CP0_Compare Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 47/99] usb: host: xhci-rcar: Avoid long wait in xhci_reset() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 40/99] ext4: silence UBSAN in ext4_mb_init() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 61/99] rtlwifi: Fix logic error in enter/exit power-save mode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 48/99] mfd: omap-usb-tll: Fix scheduling while atomic BUG Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 29/99] QE-UART: add "fsl,t1040-ucc-uart" to of_device_id Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 49/99] USB: serial: io_edgeport: fix memory leaks in attach error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 41/99] arm64: Ensure pmd_present() returns false after pmd_mknotpresent() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 30/99] thunderbolt: Fix double free of drom buffer Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 51/99] USB: serial: keyspan: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 63/99] powerpc/eeh: Don't report error in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 60/99] kbuild: move -Wunused-const-variable to W=1 warning level Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 39/99] ext4: address UBSAN warning in mb_find_order_for_block() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 09/99] cpuidle: Indicate when a device has been unregistered Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 20/99] pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 21/99] btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 18/99] ath9k: Add a module parameter to invert LED polarity. Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 28/99] MIPS: ath79: make bootconsole wait for both THRE and TEMT Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 16/99] PM / Runtime: Fix error path in pm_runtime_force_resume() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 17/99] crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 32/99] USB: leave LPM alone if possible when binding/unbinding interface drivers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 12/99] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal" Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 10/99] [media] media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 23/99] TTY: n_gsm, fix false positive WARN_ON Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 25/99] aacraid: Relinquish CPU during timeout wait Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 22/99] usb: core: hub: hub_port_init lock controller instead of bus Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 14/99] Bluetooth: vhci: Fix race at creating hci device Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 37/99] USB: serial: cp210x: fix hardware flow-control disable Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 04/99] ath10k: fix debugfs pktlog_filter write Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 02/99] ath10k: fix firmware assert in monitor mode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 19/99] ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards. Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 11/99] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 15/99] powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 31/99] USB: serial: option: add support for Cinterion PH8 and AHxx Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 13/99] usb: f_mass_storage: test whether thread is running before starting another Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 27/99] ext4: fix hang when processing corrupted orphaned inode list Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
csiph-web