Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1354591

[PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes
Date 2016-03-10 00:30 +0100
Message-ID <raVIf-6Sb-39@gated-at.bofh.it> (permalink)
References <raVyx-6Nd-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Willy Tarreau <w@1wt.eu>

commit 759c01142a5d0f364a462346168a56de28a80f52 upstream.

On no-so-small systems, it is possible for a single process to cause an
OOM condition by filling large pipes with data that are never read. A
typical process filling 4000 pipes with 1 MB of data will use 4 GB of
memory. On small systems it may be tricky to set the pipe max size to
prevent this from happening.

This patch makes it possible to enforce a per-user soft limit above
which new pipes will be limited to a single page, effectively limiting
them to 4 kB each, as well as a hard limit above which no new pipes may
be created for this user. This has the effect of protecting the system
against memory abuse without hurting other users, and still allowing
pipes to work correctly though with less data at once.

The limit are controlled by two new sysctls : pipe-user-pages-soft, and
pipe-user-pages-hard. Both may be disabled by setting them to zero. The
default soft limit allows the default number of FDs per process (1024)
to create pipes of the default size (64kB), thus reaching a limit of 64MB
before starting to create only smaller pipes. With 256 processes limited
to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB =
1084 MB of memory allocated for a user. The hard limit is disabled by
default to avoid breaking existing applications that make intensive use
of pipes (eg: for splicing).

Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 Documentation/sysctl/fs.txt | 23 ++++++++++++++++++++++
 fs/pipe.c                   | 47 +++++++++++++++++++++++++++++++++++++++++++--
 include/linux/pipe_fs_i.h   |  4 ++++
 include/linux/sched.h       |  1 +
 kernel/sysctl.c             | 14 ++++++++++++++
 5 files changed, 87 insertions(+), 2 deletions(-)

diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 88152f2..302b5ed 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs:
 - nr_open
 - overflowuid
 - overflowgid
+- pipe-user-pages-hard
+- pipe-user-pages-soft
 - protected_hardlinks
 - protected_symlinks
 - suid_dumpable
@@ -159,6 +161,27 @@ The default is 65534.
 
 ==============================================================
 
+pipe-user-pages-hard:
+
+Maximum total number of pages a non-privileged user may allocate for pipes.
+Once this limit is reached, no new pipes may be allocated until usage goes
+below the limit again. When set to 0, no limit is applied, which is the default
+setting.
+
+==============================================================
+
+pipe-user-pages-soft:
+
+Maximum total number of pages a non-privileged user may allocate for pipes
+before the pipe size gets limited to a single page. Once this limit is reached,
+new pipes will be limited to a single page in size for this user in order to
+limit total memory usage, and trying to increase them using fcntl() will be
+denied until usage goes below the limit again. The default value allows to
+allocate up to 1024 pipes at their default size. When set to 0, no limit is
+applied.
+
+==============================================================
+
 protected_hardlinks:
 
 A long-standing class of security issues is the hardlink-based
diff --git a/fs/pipe.c b/fs/pipe.c
index 3e7ab27..47f79ac 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -39,6 +39,12 @@ unsigned int pipe_max_size = 1048576;
  */
 unsigned int pipe_min_size = PAGE_SIZE;
 
+/* Maximum allocatable pages per user. Hard limit is unset by default, soft
+ * matches default values.
+ */
+unsigned long pipe_user_pages_hard;
+unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR;
+
 /*
  * We use a start+len construction, which provides full use of the 
  * allocated memory.
@@ -791,20 +797,49 @@ pipe_fasync(int fd, struct file *filp, int on)
 	return retval;
 }
 
+static void account_pipe_buffers(struct pipe_inode_info *pipe,
+                                 unsigned long old, unsigned long new)
+{
+	atomic_long_add(new - old, &pipe->user->pipe_bufs);
+}
+
+static bool too_many_pipe_buffers_soft(struct user_struct *user)
+{
+	return pipe_user_pages_soft &&
+	       atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft;
+}
+
+static bool too_many_pipe_buffers_hard(struct user_struct *user)
+{
+	return pipe_user_pages_hard &&
+	       atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard;
+}
+
 struct pipe_inode_info *alloc_pipe_info(void)
 {
 	struct pipe_inode_info *pipe;
 
 	pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
 	if (pipe) {
-		pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL);
+		unsigned long pipe_bufs = PIPE_DEF_BUFFERS;
+		struct user_struct *user = get_current_user();
+
+		if (!too_many_pipe_buffers_hard(user)) {
+			if (too_many_pipe_buffers_soft(user))
+				pipe_bufs = 1;
+			pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
+		}
+
 		if (pipe->bufs) {
 			init_waitqueue_head(&pipe->wait);
 			pipe->r_counter = pipe->w_counter = 1;
-			pipe->buffers = PIPE_DEF_BUFFERS;
+			pipe->buffers = pipe_bufs;
+			pipe->user = user;
+			account_pipe_buffers(pipe, 0, pipe_bufs);
 			mutex_init(&pipe->mutex);
 			return pipe;
 		}
+		free_uid(user);
 		kfree(pipe);
 	}
 
@@ -815,6 +850,8 @@ void free_pipe_info(struct pipe_inode_info *pipe)
 {
 	int i;
 
+	account_pipe_buffers(pipe, pipe->buffers, 0);
+	free_uid(pipe->user);
 	for (i = 0; i < pipe->buffers; i++) {
 		struct pipe_buffer *buf = pipe->bufs + i;
 		if (buf->ops)
@@ -1205,6 +1242,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
 			memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
 	}
 
+	account_pipe_buffers(pipe, pipe->buffers, nr_pages);
 	pipe->curbuf = 0;
 	kfree(pipe->bufs);
 	pipe->bufs = bufs;
@@ -1276,6 +1314,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 		if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
 			ret = -EPERM;
 			goto out;
+		} else if ((too_many_pipe_buffers_hard(pipe->user) ||
+			    too_many_pipe_buffers_soft(pipe->user)) &&
+		           !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) {
+			ret = -EPERM;
+			goto out;
 		}
 		ret = pipe_set_size(pipe, nr_pages);
 		break;
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index ab57526..b3374f6 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -42,6 +42,7 @@ struct pipe_buffer {
  *	@fasync_readers: reader side fasync
  *	@fasync_writers: writer side fasync
  *	@bufs: the circular array of pipe buffers
+ *	@user: the user who created this pipe
  **/
 struct pipe_inode_info {
 	struct mutex mutex;
@@ -57,6 +58,7 @@ struct pipe_inode_info {
 	struct fasync_struct *fasync_readers;
 	struct fasync_struct *fasync_writers;
 	struct pipe_buffer *bufs;
+	struct user_struct *user;
 };
 
 /*
@@ -140,6 +142,8 @@ void pipe_unlock(struct pipe_inode_info *);
 void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 
 extern unsigned int pipe_max_size, pipe_min_size;
+extern unsigned long pipe_user_pages_hard;
+extern unsigned long pipe_user_pages_soft;
 int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *);
 
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3f3128b..7069678e 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -684,6 +684,7 @@ struct user_struct {
 #endif
 	unsigned long locked_shm; /* How many pages of mlocked shm ? */
 	unsigned long unix_inflight;	/* How many files in flight in unix sockets */
+	atomic_long_t pipe_bufs;  /* how many pages are allocated in pipe buffers */
 
 #ifdef CONFIG_KEYS
 	struct key *uid_keyring;	/* UID specific keyring */
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index bbf0a95..3ac328e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1654,6 +1654,20 @@ static struct ctl_table fs_table[] = {
 		.proc_handler	= &pipe_proc_fn,
 		.extra1		= &pipe_min_size,
 	},
+	{
+		.procname	= "pipe-user-pages-hard",
+		.data		= &pipe_user_pages_hard,
+		.maxlen		= sizeof(pipe_user_pages_hard),
+		.mode		= 0644,
+		.proc_handler	= proc_doulongvec_minmax,
+	},
+	{
+		.procname	= "pipe-user-pages-soft",
+		.data		= &pipe_user_pages_soft,
+		.maxlen		= sizeof(pipe_user_pages_soft),
+		.mode		= 0644,
+		.proc_handler	= proc_doulongvec_minmax,
+	},
 	{ }
 };
 
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt36 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
  [PATCH 3.13.y-ckt 059/138] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
  [PATCH 3.13.y-ckt 009/138] iio: dac: mcp4725: set iio name property in sysfs Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
  [PATCH 3.13.y-ckt 017/138] drm/i915/dp: fall back to 18 bpp when sink capability is unknown Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
  [PATCH 3.13.y-ckt 070/138] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
  [PATCH 3.13.y-ckt 109/138] KVM: async_pf: do not warn on page allocation failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 126/138] sctp: translate network order to host order when users get a hmacid Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 113/138] hpfs: don't truncate the file when delete fails Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 119/138] pptp: fix illegal memory access caused by multiple bind()s Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 117/138] tcp: fix NULL deref in tcp_v4_send_ack() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 090/138] ALSA: seq: Drop superfluous error/debug messages after malloc failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 131/138] rtnl: RTM_GETNETCONF: fix wrong return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 123/138] ipv6: fix a lockdep splat Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 137/138] af_unix: Don't set err in unix_stream_read_generic unless there was an error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 134/138] bonding: Fix ARP monitor validation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 130/138] pppoe: fix reference counting in PPPoE proxy Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 110/138] tracing: Fix showing function event in available_events Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 114/138] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 125/138] net:Add sysctl_max_skb_frags Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 111/138] libceph: don't bail early from try_read() when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 120/138] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 101/138] USB: option: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 115/138] af_iucv: Validate socket address length in iucv_sock_bind() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 122/138] net/ipv6: add sysctl option accept_ra_min_hop_limit Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 132/138] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 127/138] af_unix: Guard against other == sk in unix_dgram_sendmsg Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 129/138] net/mlx4_en: Count HW buffer overrun only once Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 112/138] KVM: x86: MMU: fix ubsan index-out-of-range warning Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 097/138] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 077/138] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 116/138] net: dp83640: Fix tx timestamp overflow handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 128/138] qmi_wwan: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 136/138] net/mlx4_en: Choose time-stamping shift value according to HW frequency Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 118/138] af_unix: fix struct pid memory leak Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 135/138] ipv4: fix memory leaks in ip_cmsg_send() callers Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 133/138] sctp: Fix port hash table size computation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 124/138] unix: correctly track in-flight fds in sending process user_struct Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 121/138] ipv6/udp: use sticky pktinfo egress ifindex on connect() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
  [PATCH 3.13.y-ckt 103/138] ext4: fix bh->b_state corruption Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 082/138] ARM: 8519/1: ICST: try other dividends than 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 074/138] phy: twl4030-usb: Relase usb phy on unload Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 099/138] USB: option: add support for SIM7100E Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 063/138] pty: fix possible use after free of tty->driver_data Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 094/138] tracing: Fix freak link error caused by branch tracer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 108/138] sunrpc/cache: fix off-by-one in qword_get() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 089/138] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 085/138] ext4: don't read blocks from disk after extents being swapped Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 067/138] ALSA: dummy: Implement timer backend switching more safely Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 100/138] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 081/138] s390/dasd: fix refcount for PAV reassignment Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 064/138] pty: make sure super_block is still valid in final /dev/tty close Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 106/138] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 096/138] drm/radeon: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 086/138] bio: return EINTR if copying to user space got interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 093/138] tracepoints: Do not trace when cpu is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 072/138] ALSA: timer: Fix race between stop and interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 088/138] xen/pciback: Save the number of MSI-X entries to be copied later. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 065/138] ALSA: hda - Fix speaker output from VAIO AiO machines Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 091/138] ALSA: seq: Fix leak of pool buffer at concurrent writes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 084/138] ext4: fix potential integer overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 092/138] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 095/138] ALSA: seq: Fix double port list deletion Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 104/138] ext4: fix crashes in dioread_nolock mode Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 058/138] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 107/138] can: ems_usb: Fix possible tx overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 083/138] btrfs: properly set the termination value of ctx->pos in readdir Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 105/138] kernel/resource.c: fix muxed resource handling in __request_region() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 079/138] cifs: fix erroneous return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 087/138] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 066/138] klist: fix starting point removed bug in klist iterators Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 102/138] hwmon: (ads1015) Handle negative conversion values correctly Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 098/138] NFSv4: Fix a dentry leak on alias use Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
  [PATCH 3.13.y-ckt 053/138] SCSI: Add Marvell Console to VPD blacklist Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 021/138] intel_scu_ipcutil: underflow in scu_reg_access() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 041/138] target: Fix Task Aborted Status (TAS) handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 020/138] iio: inkern: fix a NULL dereference on error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 056/138] dump_stack: avoid potential deadlocks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 027/138] libata: fix sff host state machine locking while polling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 060/138] radix-tree: fix oops after radix_tree_iter_retry Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 049/138] ALSA: timer: Fix leftover link at closing Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 057/138] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 046/138] target: Fix remote-port TMR ABORT + se_cmd fabric stop Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 048/138] [media] tda1004x: only update the frontend properties if locked Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 051/138] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 023/138] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 037/138] radix-tree: fix race in gang lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 035/138] ALSA: seq: Fix lockdep warnings due to double mutex locks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 036/138] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 030/138] module: wrapper for symbol name. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 042/138] target: Add TFO->abort_task for aborted task resources release Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 040/138] xhci: Fix list corruption in urb dequeue at host removal Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 047/138] target: Fix race with SCF_SEND_DELAYED_TAS handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 045/138] target: Fix TAS handling for multi-session se_node_acls Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 038/138] Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 008/138] x86/entry/compat: Add missing CLAC to entry_INT80_32 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 024/138] ALSA: pcm: Fix potential deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 054/138] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 022/138] ALSA: seq: Fix race at closing in virmidi driver Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 052/138] scsi_dh_rdac: always retry MODE SELECT on command lock violation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 031/138] ALSA: hda - Add fixup for Mac Mini 7,1 model Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 050/138] [media] saa7134-alsa: Only frees registered sound cards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 061/138] crypto: user - lock crypto_alg_list on alg dump Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
  [PATCH 3.13.y-ckt 012/138] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 019/138] crypto: algif_hash - wait for crypto_ahash_init() to complete Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 004/138] EVM: Use crypto_memneq() for digest comparisons Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 003/138] iw_cxgb3: Fix incorrectly returning error on success Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 005/138] ALSA: usb-audio: avoid freeing umidi object twice Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 014/138] mac80211: Requeue work after scan complete for all VIF types. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 013/138] mac80211: start_next_roc only if scan was actually running Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 007/138] bcache: Fix a lockdep splat in an error path Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 018/138] target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
  [PATCH 3.13.y-ckt 010/138] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100

csiph-web