Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1449971

[PATCH 4.4 063/146] arm64: Rework valid_user_regs

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 063/146] arm64: Rework valid_user_regs
Date 2016-07-25 23:40 +0200
Message-ID <rYVLu-1mN-73@gated-at.bofh.it> (permalink)
References <rYV8K-Pn-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

commit dbd4d7ca563fd0a8949718d35ce197e5642d5d9d upstream.

We validate pstate using PSR_MODE32_BIT, which is part of the
user-provided pstate (and cannot be trusted). Also, we conflate
validation of AArch32 and AArch64 pstate values, making the code
difficult to reason about.

Instead, validate the pstate value based on the associated task. The
task may or may not be current (e.g. when using ptrace), so this must be
passed explicitly by callers. To avoid circular header dependencies via
sched.h, is_compat_task is pulled out of asm/ptrace.h.

To make the code possible to reason about, the AArch64 and AArch32
validation is split into separate functions. Software must respect the
RES0 policy for SPSR bits, and thus the kernel mirrors the hardware
policy (RAZ/WI) for bits as-yet unallocated. When these acquire an
architected meaning writes may be permitted (potentially with additional
validation).

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Dave Martin <dave.martin@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ rebased for v4.1+
  This avoids a user-triggerable Oops() if a task is switched to a mode
  not supported by the kernel (e.g. switching a 64-bit task to AArch32).
]
Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com> [backport]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 arch/arm64/include/asm/ptrace.h |   33 +---------------
 arch/arm64/kernel/ptrace.c      |   81 +++++++++++++++++++++++++++++++++++++++-
 arch/arm64/kernel/signal.c      |    4 -
 arch/arm64/kernel/signal32.c    |    2 
 4 files changed, 86 insertions(+), 34 deletions(-)

--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -58,6 +58,7 @@
 #define COMPAT_PSR_Z_BIT	0x40000000
 #define COMPAT_PSR_N_BIT	0x80000000
 #define COMPAT_PSR_IT_MASK	0x0600fc00	/* If-Then execution state mask */
+#define COMPAT_PSR_GE_MASK	0x000f0000
 
 #ifdef CONFIG_CPU_BIG_ENDIAN
 #define COMPAT_PSR_ENDSTATE	COMPAT_PSR_E_BIT
@@ -151,35 +152,9 @@ static inline unsigned long regs_return_
 	return regs->regs[0];
 }
 
-/*
- * Are the current registers suitable for user mode? (used to maintain
- * security in signal handlers)
- */
-static inline int valid_user_regs(struct user_pt_regs *regs)
-{
-	if (user_mode(regs) && (regs->pstate & PSR_I_BIT) == 0) {
-		regs->pstate &= ~(PSR_F_BIT | PSR_A_BIT);
-
-		/* The T bit is reserved for AArch64 */
-		if (!(regs->pstate & PSR_MODE32_BIT))
-			regs->pstate &= ~COMPAT_PSR_T_BIT;
-
-		return 1;
-	}
-
-	/*
-	 * Force PSR to something logical...
-	 */
-	regs->pstate &= PSR_f | PSR_s | (PSR_x & ~PSR_A_BIT) | \
-			COMPAT_PSR_T_BIT | PSR_MODE32_BIT;
-
-	if (!(regs->pstate & PSR_MODE32_BIT)) {
-		regs->pstate &= ~COMPAT_PSR_T_BIT;
-		regs->pstate |= PSR_MODE_EL0t;
-	}
-
-	return 0;
-}
+/* We must avoid circular header include via sched.h */
+struct task_struct;
+int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task);
 
 #define instruction_pointer(regs)	((unsigned long)(regs)->pc)
 
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -39,6 +39,7 @@
 #include <linux/elf.h>
 
 #include <asm/compat.h>
+#include <asm/cpufeature.h>
 #include <asm/debug-monitors.h>
 #include <asm/pgtable.h>
 #include <asm/syscall.h>
@@ -500,7 +501,7 @@ static int gpr_set(struct task_struct *t
 	if (ret)
 		return ret;
 
-	if (!valid_user_regs(&newregs))
+	if (!valid_user_regs(&newregs, target))
 		return -EINVAL;
 
 	task_pt_regs(target)->user_regs = newregs;
@@ -770,7 +771,7 @@ static int compat_gpr_set(struct task_st
 
 	}
 
-	if (valid_user_regs(&newregs.user_regs))
+	if (valid_user_regs(&newregs.user_regs, target))
 		*task_pt_regs(target) = newregs;
 	else
 		ret = -EINVAL;
@@ -1272,3 +1273,79 @@ asmlinkage void syscall_trace_exit(struc
 	if (test_thread_flag(TIF_SYSCALL_TRACE))
 		tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT);
 }
+
+/*
+ * Bits which are always architecturally RES0 per ARM DDI 0487A.h
+ * Userspace cannot use these until they have an architectural meaning.
+ * We also reserve IL for the kernel; SS is handled dynamically.
+ */
+#define SPSR_EL1_AARCH64_RES0_BITS \
+	(GENMASK_ULL(63,32) | GENMASK_ULL(27, 22) | GENMASK_ULL(20, 10) | \
+	 GENMASK_ULL(5, 5))
+#define SPSR_EL1_AARCH32_RES0_BITS \
+	(GENMASK_ULL(63,32) | GENMASK_ULL(24, 22) | GENMASK_ULL(20,20))
+
+static int valid_compat_regs(struct user_pt_regs *regs)
+{
+	regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS;
+
+	if (!system_supports_mixed_endian_el0()) {
+		if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+			regs->pstate |= COMPAT_PSR_E_BIT;
+		else
+			regs->pstate &= ~COMPAT_PSR_E_BIT;
+	}
+
+	if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) &&
+	    (regs->pstate & COMPAT_PSR_A_BIT) == 0 &&
+	    (regs->pstate & COMPAT_PSR_I_BIT) == 0 &&
+	    (regs->pstate & COMPAT_PSR_F_BIT) == 0) {
+		return 1;
+	}
+
+	/*
+	 * Force PSR to a valid 32-bit EL0t, preserving the same bits as
+	 * arch/arm.
+	 */
+	regs->pstate &= COMPAT_PSR_N_BIT | COMPAT_PSR_Z_BIT |
+			COMPAT_PSR_C_BIT | COMPAT_PSR_V_BIT |
+			COMPAT_PSR_Q_BIT | COMPAT_PSR_IT_MASK |
+			COMPAT_PSR_GE_MASK | COMPAT_PSR_E_BIT |
+			COMPAT_PSR_T_BIT;
+	regs->pstate |= PSR_MODE32_BIT;
+
+	return 0;
+}
+
+static int valid_native_regs(struct user_pt_regs *regs)
+{
+	regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS;
+
+	if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) &&
+	    (regs->pstate & PSR_D_BIT) == 0 &&
+	    (regs->pstate & PSR_A_BIT) == 0 &&
+	    (regs->pstate & PSR_I_BIT) == 0 &&
+	    (regs->pstate & PSR_F_BIT) == 0) {
+		return 1;
+	}
+
+	/* Force PSR to a valid 64-bit EL0t */
+	regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT;
+
+	return 0;
+}
+
+/*
+ * Are the current registers suitable for user mode? (used to maintain
+ * security in signal handlers)
+ */
+int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task)
+{
+	if (!test_tsk_thread_flag(task, TIF_SINGLESTEP))
+		regs->pstate &= ~DBG_SPSR_SS;
+
+	if (is_compat_thread(task_thread_info(task)))
+		return valid_compat_regs(regs);
+	else
+		return valid_native_regs(regs);
+}
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -115,7 +115,7 @@ static int restore_sigframe(struct pt_re
 	 */
 	regs->syscallno = ~0UL;
 
-	err |= !valid_user_regs(&regs->user_regs);
+	err |= !valid_user_regs(&regs->user_regs, current);
 
 	if (err == 0) {
 		struct fpsimd_context *fpsimd_ctx =
@@ -307,7 +307,7 @@ static void handle_signal(struct ksignal
 	/*
 	 * Check that the resulting registers are actually sane.
 	 */
-	ret |= !valid_user_regs(&regs->user_regs);
+	ret |= !valid_user_regs(&regs->user_regs, current);
 
 	/*
 	 * Fast forward the stepping logic so we step into the signal
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -356,7 +356,7 @@ static int compat_restore_sigframe(struc
 	 */
 	regs->syscallno = ~0UL;
 
-	err |= !valid_user_regs(&regs->user_regs);
+	err |= !valid_user_regs(&regs->user_regs, current);
 
 	aux = (struct compat_aux_sigframe __user *) sf->uc.uc_regspace;
 	if (err == 0)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 000/146] 4.4.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:10 +0200
  [PATCH 4.4 060/146] iommu/amd: Fix unity mapping initialization race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 134/146] ovl: verify upper dentry in ovl_remove_and_whiteout() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 139/146] cifs: dynamic allocation of ntlmssp blob Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 145/146] drm/i915: Revert DisplayPort fast link training feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 097/146] iio: Fix error handling in iio_trigger_attach_poll_func Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 054/146] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 116/146] ALSA: dummy: Fix a use-after-free at closing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 096/146] xen/balloon: Fix declared-but-not-defined warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 146/146] ovl: verify upper dentry before unlink and rename Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 143/146] tmpfs: dont undo fallocate past its last page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 144/146] tmpfs: fix regression hang in fallocate undo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 072/146] drm/amdkfd: unbind only existing processes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 4.4 105/146] iio: hudmidity: hdc100x: fix incorrect shifting and scaling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 119/146] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 141/146] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 102/146] iio: proximity: as3935: fix buffer stack trashing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 110/146] iio:ad7266: Fix probe deferral for vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 132/146] ARM: mvebu: fix HW I/O coherency related deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 099/146] iio: light apds9960: Add the missing dev.parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 137/146] 53c700: fix BUG on untagged commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 138/146] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 142/146] crypto: qat - make qat_asym_algs.o depend on asn1 headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 129/146] ALSA: hda: add AMD Stoney PCI ID with proper driver caps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 123/146] ALSA: hda - Add PCI ID for Kabylake-H Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 117/146] ALSA: hda - Fix the headset mic jack detection on Dell machine Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 135/146] scsi: fix race between simultaneous decrements of ->host_failed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 100/146] iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 121/146] ALSA: timer: Fix negative queue usage by racy accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 062/146] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 120/146] ALSA: echoaudio: Fix memory allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 064/146] vfs: add d_real_inode() helper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 106/146] staging: iio: accel: fix error check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
    Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to  overlay inode Eryu Guan <eguan@redhat.com> - 2016-08-03 09:40 +0200
      Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to  overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-03 10:00 +0200
        Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to  overlay inode Eryu Guan <eguan@redhat.com> - 2016-08-03 10:20 +0200
          Re: [PATCH 4.4 133/146] ovl: Copy up underlying inodes ->i_mode to  overlay inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-03 13:20 +0200
  [PATCH 4.4 090/146] drm/vmwgfx: Work around mode set failure in 2D VMs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 130/146] ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 126/146] ALSA: pcm: Free chmap at PCM free callback, too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 103/146] iio: humidity: hdc100x: correct humidity integration time mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 122/146] ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 124/146] ALSA: hda - fix read before array start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 128/146] ALSA: hda - fix use-after-free after module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 104/146] iio: humidity: hdc100x: fix IIO_TEMP channel reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 140/146] File names with trailing period or space need special case conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 111/146] tty: vt: Fix soft lockup in fbcon cursor blink timer. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 118/146] ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 127/146] ALSA: ctl: Stop notification after disconnection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 131/146] ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 101/146] iio: proximity: as3935: remove triggered buffer processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 125/146] ALSA: hda/realtek - add new pin definition in alc225 pin quirk table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 136/146] s390: fix test_fp_ctl inline assembly contraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:30 +0200
  [PATCH 4.4 112/146] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
  [PATCH 4.4 063/146] arm64: Rework valid_user_regs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
  [PATCH 4.4 109/146] iio:ad7266: Fix support for optional regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:40 +0200
  [PATCH 4.4 108/146] iio:ad7266: Fix broken regulator error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:30 +0200
  [PATCH 4.4 079/146] drm/nouveau: fix for disabled fbdev emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 078/146] drm/nouveau/fbcon: fix out-of-bounds memory accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 022/146] locking/static_key: Fix concurrent static_key_slow_inc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 083/146] drm/i915: Update ifdeffery for mutex->owner Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 059/146] iommu/vt-d: Enable QI on all IOMMUs before setting root entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 093/146] drm/vmwgfx: Fix error paths when mapping framebuffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 107/146] iio: accel: kxsd9: fix the usage of spi_w8r8() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 098/146] iio:st_pressure: fix sampling gains (bring inline with ABI) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 089/146] drm/vmwgfx: Add an option to change assumed FB bpp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 058/146] iommu/arm-smmu: Wire up map_sg for arm-smmu-v3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 088/146] drm/ttm: Make ttm_bo_mem_compat available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 086/146] drm: make drm_atomic_set_mode_prop_for_crtc() more reliable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 061/146] drm/mgag200: Black screen fix for G200e rev 4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 087/146] drm: atmel-hlcdc: actually disable scaling when no scaling is required Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 092/146] drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 091/146] drm/vmwgfx: Check pin count before attempting to move a buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 085/146] drm: add missing drm_mode_set_crtcinfo call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 095/146] perf/x86: Fix undefined shift on 32-bit kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 077/146] drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 055/146] HID: multitouch: enable palm rejection for Windows Precision Touchpad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 080/146] drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:40 +0200
  [PATCH 4.4 066/146] percpu: fix synchronization between chunk->map_extend_work and chunk destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 068/146] btrfs: account for non-CoWd blocks in btrfs_abort_transaction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 023/146] x86, build: copy ldlinux.c32 to image.iso Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 065/146] af_unix: fix hard linked sockets on overlay Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 019/146] of: irq: fix of_irq_get[_byname]() kernel-doc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 073/146] drm/amdkfd: destroy dbgmgr in notifier release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 075/146] virtio_balloon: fix PFN format for virtio-1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 018/146] of: fix autoloading due to broken modalias with no compatible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 074/146] drm/dp/mst: Always clear proposed vcpi table for port. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 056/146] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 014/146] usb: common: otg-fsm: add license to usb-otg-fsm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 020/146] locking/ww_mutex: Report recursive ww_mutex locking early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 070/146] drm/amdgpu/gfx7: fix broken condition check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 021/146] locking/qspinlock: Fix spin_unlock_wait() some more Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 057/146] base: make module_create_drivers_dir race-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 076/146] drm/nouveau/disp/sor/gf119: both links use the same training register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 067/146] percpu: fix synchronization between synchronous map extension and chunk destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 4.4 069/146] drm/radeon: fix asic initialization for virtualized environments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  Re: [PATCH 4.4 000/146] 4.4.16-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-07-26 04:10 +0200
  Re: [PATCH 4.4 000/146] 4.4.16-stable review Guenter Roeck <linux@roeck-us.net> - 2016-07-26 16:00 +0200
  Re: [PATCH 4.4 000/146] 4.4.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-27 06:50 +0200

csiph-web