Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1368830

[PATCH 4.2.y-ckt 014/218] Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 4.2.y-ckt 014/218] Input: ati_remote2 - fix crashes on detecting device with invalid descriptor
Date 2016-03-31 23:30 +0200
Message-ID <riSkc-2AW-45@gated-at.bofh.it> (permalink)
References <riReq-1PN-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


4.2.8-ckt7 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vladis Dronov <vdronov@redhat.com>

commit 950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d upstream.

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
index cfd58e8..1c5914c 100644
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	ar2->udev = udev;
 
+	/* Sanity check, first interface must have an endpoint */
+	if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+		dev_err(&interface->dev,
+			"%s(): interface 0 must have an endpoint\n", __func__);
+		r = -ENODEV;
+		goto fail1;
+	}
 	ar2->intf[0] = interface;
 	ar2->ep[0] = &alt->endpoint[0].desc;
 
+	/* Sanity check, the device must have two interfaces */
 	ar2->intf[1] = usb_ifnum_to_if(udev, 1);
+	if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
+		dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
+			__func__, udev->actconfig->desc.bNumInterfaces);
+		r = -ENODEV;
+		goto fail1;
+	}
+
 	r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
 	if (r)
 		goto fail1;
+
+	/* Sanity check, second interface must have an endpoint */
 	alt = ar2->intf[1]->cur_altsetting;
+	if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+		dev_err(&interface->dev,
+			"%s(): interface 1 must have an endpoint\n", __func__);
+		r = -ENODEV;
+		goto fail2;
+	}
 	ar2->ep[1] = &alt->endpoint[0].desc;
 
 	r = ati_remote2_urb_init(ar2);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	ar2->channel_mask = channel_mask;
 	ar2->mode_mask = mode_mask;
 
 	r = ati_remote2_setup(ar2, ar2->channel_mask);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
 	strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
 	if (r)
-		goto fail2;
+		goto fail3;
 
 	r = ati_remote2_input_init(ar2);
 	if (r)
-		goto fail3;
+		goto fail4;
 
 	usb_set_intfdata(interface, ar2);
 
@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
 
 	return 0;
 
- fail3:
+ fail4:
 	sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
- fail2:
+ fail3:
 	ati_remote2_urb_cleanup(ar2);
+ fail2:
 	usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
  fail1:
 	kfree(ar2);
-- 
2.7.4

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[4.2.y-ckt stable] Linux 4.2.8-ckt7 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:20 +0200
  [PATCH 4.2.y-ckt 084/218] bcache: fix cache_set_flush() NULL pointer dereference on OOM Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:20 +0200
  [PATCH 4.2.y-ckt 009/218] Input: powermate - fix oops with malicious USB descriptors Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:20 +0200
  [PATCH 4.2.y-ckt 039/218] [media] adv7511: TX_EDID_PRESENT is still 1 after a disconnect Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:20 +0200
  [PATCH 4.2.y-ckt 199/218] bpf: avoid copying junk bytes in bpf_get_current_comm() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 202/218] mac80211: fix ibss scan parameters Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 191/218] sched/preempt, sh: kmap_coherent relies on disabled preemption Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 200/218] mac80211: fix unnecessary frame drops in mesh fwding Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 198/218] kbuild/mkspec: fix grub2 installkernel issue Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 197/218] [media] coda: fix error path in case of missing pdata on non-DT platform Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 196/218] clk: meson: Fix meson_clk_register_clks() signature type mismatch Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 213/218] ARM: prima2: always enable reset controller Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 193/218] spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 188/218] sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 207/218] paride: make 'verbose' parameter an 'int' again Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 211/218] net: add description for len argument of dev_get_phys_port_name Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 214/218] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 186/218] efi: Expose non-blocking set_variable() wrapper to efivars Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 189/218] ipv4: fix broadcast packets reception Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 159/218] mdio-sun4i: oops in error handling in probe Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 205/218] perf pmu: Fix misleadingly indented assignment (whitespace) Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 204/218] rtc: hym8563: fix invalid year calculation Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 190/218] lpfc: fix misleading indentation Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 203/218] at803x: fix reset handling Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 210/218] clk: versatile: sp810: support reentrance Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 217/218] ipvs: drop first packet to redirect conntrack Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 209/218] ppp: ensure file->private_data can't be overridden Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 218/218] rtc: max77686: Properly handle regmap_irq_get_virq() error code Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 141/218] target: Fix target_release_cmd_kref shutdown comp leak Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 208/218] regulator: s5m8767: fix get_register() error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 215/218] perf stat: Document --detailed option Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 201/218] mtd: brcmnand: Fix v7.1 register offsets Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 206/218] nbd: ratelimit error msgs after socket close Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 185/218] ARM: OMAP3: Add cpuidle parameters table for omap3430 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  RE: [PATCH 4.2.y-ckt 092/218] EDAC/sb_edac: Fix computation of  channel address "Luck, Tony" <tony.luck@intel.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 216/218] [media] v4l: vsp1: Set the SRU CTRL0 register when starting the stream Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 133/218] tracing: Have preempt(irqs)off trace preempt disabled functions Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 212/218] net: bcmgenet: fix dma api length mismatch Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:30 +0200
  [PATCH 4.2.y-ckt 154/218] mac80211: avoid excessive stack usage in sta_info Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 177/218] spi: rockchip: modify DMA max burst to 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 167/218] megaraid_sas: add missing curly braces in ioctl handler Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 161/218] ARC: bitops: Remove non relevant comments Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 170/218] HID: logitech: fix Dual Action gamepad support Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 187/218] rtc: vr41xx: Wire up alarm_irq_enable Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 180/218] perf tools: handle spaces in file names obtained from /proc/pid/maps Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 176/218] drm/i915: Cleanup phys status page too Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 183/218] drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 181/218] rtc: ds1685: passing bogus values to irq_restore Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 162/218] mac80211: fix txq queue related crashes Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 179/218] ath9k: fix buffer overrun for ar9287 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 192/218] ipip: Properly mark ipip GRO packets as encapsulated. Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 171/218] net/mlx5: Make command timeout way shorter Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 163/218] net: Fix use after free in the recvmmsg exit path Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 175/218] ipvs: correct initial offset of Call-ID header search in SIP persistence engine Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 174/218] clk: qcom: msm8960: fix ce3_core clk enable register Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 165/218] sctp: fix the transports round robin issue when init is retransmitted Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 169/218] misc/bmp085: Enable building as a module Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 172/218] ASoC: ssm4567: Reset device before regcache_sync() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 140/218] bitops: Do not default to __clear_bit() for __clear_bit_unlock() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 164/218] ath9k: fix misleading indentation Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 153/218] mm/page_alloc: prevent merging between isolated and other pageblocks Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 195/218] mlx4: add missing braces in verify_qp_parameters Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 121/218] x86/iopl: Fix iopl capability check on Xen PV Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 166/218] ethernet: micrel: fix some error codes Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 145/218] fs/coredump: prevent fsuid=0 dumps into user-controlled directories Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 173/218] fbdev: da8xx-fb: fix videomodes of lcd panels Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 182/218] ARM: davinci: make I2C support optional Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 184/218] mtd: map: fix .set_vpp() documentation Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 151/218] ocfs2/dlm: fix race between convert and recovery Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 168/218] clk-divider: make sure read-only dividers do not write to their register Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 194/218] ASoC: s3c24xx: use const snd_soc_component_driver pointer Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 178/218] ata: ahci_xgene: dereferencing uninitialized pointer in probe Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:40 +0200
  [PATCH 4.2.y-ckt 124/218] drm/amdgpu: include the right version of gmc header files for iceland Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 137/218] writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 138/218] fs-writeback: unplug before cond_resched in writeback_sb_inodes Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 150/218] MAINTAINERS: Update mailing list and web page for hwmon subsystem Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 132/218] USB: uas: Reduce can_queue to MAX_CMNDS Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 134/218] tracing: Fix crash from reading trace_pipe with sendfile Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 143/218] KVM: fix spin_lock_init order on x86 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 149/218] ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 155/218] clk: xgene: Add missing parenthesis when clearing divider value Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 139/218] writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 144/218] tracing: Fix trace_printk() to print when not using bprintk() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 146/218] rapidio/rionet: fix deadlock on SMP Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 158/218] ppp: take reference on channels netns Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 130/218] x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 136/218] ALSA: usb-audio: add Microsoft HD-5001 to quirks Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 131/218] USB: usb_driver_claim_interface: add sanity checking Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 148/218] staging: android: ion_test: fix check of platform_device_register_simple() error code Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 157/218] xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND" Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 147/218] staging: comedi: ni_mio_common: fix the ni_write[blw]() functions Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 142/218] KVM: VMX: avoid guest hang on invalid invept instruction Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 126/218] watchdog: don't run proc_watchdog_update if new value is same as old Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 135/218] splice: handle zero nr_pages in splice_to_pipe() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 129/218] Input: synaptics - handle spurious release of trackstick buttons, again Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 120/218] vfs: show_vfsstat: do not ignore errors from show_devname method Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 160/218] clk: rockchip: free memory in error cases when registering clock branches Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 127/218] mm: memcontrol: reclaim when shrinking memory.high below usage Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 156/218] clk: qcom: msm8960: Fix ce3_src register offset Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 152/218] ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list Kamal Mostafa <kamal@canonical.com> - 2016-03-31 22:50 +0200
  [PATCH 4.2.y-ckt 114/218] net: mvneta: enable change MAC address when interface is up Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 105/218] Bluetooth: Fix potential buffer overflow with Add Advertising Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 104/218] xtensa: clear all DBREAKC registers on start Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 119/218] nfsd: fix deadlock secinfo+readdir compound Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 079/218] perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 089/218] sg: fix dxferp in from_to case Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 110/218] fuse: Add reference counting for fuse_io_priv Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 106/218] ARC: [BE] readl()/writel() to work in Big Endian CPU configuration Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 118/218] mmc: mmc_spi: Add Card Detect comments and fix CD GPIO case Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 091/218] ALSA: hda - Apply reboot D3 fix for CX20724 codec, too Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 102/218] xtensa: ISS: don't hang if stdin EOF is reached Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 092/218] EDAC/sb_edac: Fix computation of channel address Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 108/218] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 080/218] perf/x86/intel: Fix PEBS warning by only restoring active PMU in pmi Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 123/218] mmc: sdhci: Fix override of timeout clk wrt max_busy_timeout Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 117/218] ALSA: hda - Fix unconditional GPIO toggle via automute Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 128/218] mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 109/218] fuse: do not use iocb after it may have been freed Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 101/218] ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 115/218] dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 107/218] bus: imx-weim: Take the 'status' property value into account Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 103/218] xtensa: fix preemption in {clear,copy}_user_highpage Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 097/218] dm cache: make sure every metadata function checks fail_io Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 112/218] drm/radeon: rework fbdev handling on chips with no connectors Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 111/218] s390/pci: enforce fmb page boundary rule Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 116/218] HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:00 +0200
  [PATCH 4.2.y-ckt 083/218] bcache: cleaned up error handling around register_cache() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 072/218] usb: hub: fix a typo in hub_port_init() leading to wrong logic Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 088/218] drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards. Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 087/218] md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 093/218] Bluetooth: btusb: Add a new AR3012 ID 13d3:3472 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 099/218] iser-target: Add new state ISER_CONN_BOUND to isert_conn Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 100/218] iser-target: Separate flows for np listeners and connections cma events Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 065/218] mtip32xx: Remove unwanted code from taskfile error handler Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 090/218] jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 071/218] of: alloc anywhere from memblock if range not specified Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 067/218] mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 096/218] dm thin metadata: don't issue prefetches if a transaction abort has failed Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 077/218] pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 066/218] mtip32xx: Print exact time when an internal command is interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 094/218] ALSA: pcm: Avoid "BUG:" string for warnings again Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 085/218] x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 070/218] mtip32xx: Handle FTL rebuild failure state during device initialization Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 073/218] KVM: i8254: change PIT discard tick policy Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 098/218] iser-target: Fix identification of login rx descriptor type Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 078/218] perf/core: Fix perf_sched_count derailment Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 064/218] mtip32xx: Fix broken service thread handling Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 074/218] sched/cputime: Fix steal time accounting vs. CPU hotplug Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 069/218] mtip32xx: Handle safe removal during IO Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 082/218] bcache: fix race of writeback thread starting before complete initialization Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 095/218] dm snapshot: disallow the COW and origin devices from being identical Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 081/218] sched/cputime: Fix steal_account_process_tick() to always return jiffies Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:10 +0200
  [PATCH 4.2.y-ckt 050/218] md/raid5: Compare apples to apples (or sectors to sectors) Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 042/218] perf tools: Dont stop PMU parsing on alias parse error Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 036/218] usb: retry reset if a device times out Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 049/218] PCI: Disable IO/MEM decoding for devices with non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 034/218] tpm: fix the cleanup of struct tpm_chip Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 028/218] net: irda: Fix use-after-free in irtty_open() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 061/218] nfsd4: fix bad bounds checking Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 053/218] crypto: ccp - memset request context to zero during import Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 041/218] tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 051/218] RAID5: check_reshape() shouldn't call mddev_suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 060/218] watchdog: rc32434_wdt: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 026/218] crypto: ccp - Don't assume export/import areas are aligned Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 035/218] ARM: dts: armada-375: use armada-370-sata for SATA Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 057/218] perf tools: Fix python extension build Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 063/218] quota: Fix possible GPF due to uninitialised pointers Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 062/218] xfs: fix two memory leaks in xfs_attr_list.c error paths Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 054/218] Bluetooth: btusb: Add a new AR3012 ID 04ca:3014 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 068/218] mtip32xx: Fix for rmmod crash when drive is in FTL rebuild Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 058/218] IB/srpt: Simplify srpt_handle_tsk_mgmt() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 043/218] Bluetooth: btusb: Add new AR3012 ID 13d3:3395 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 052/218] RAID5: revert e9e4c377e2f563 to fix a livelock Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 038/218] scripts/coccinelle: modernize & Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 047/218] aic7xxx: Fix queue depth handling Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 055/218] mmc: sdhci: fix data timeout (part 1) Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 048/218] mtd: onenand: fix deadlock in onenand_block_markbad Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 056/218] mmc: sdhci: fix data timeout (part 2) Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 040/218] [media] saa7134: Fix bytesperline not being set correctly for planar formats Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 037/218] HID: fix hid_ignore_special_drivers module parameter Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 044/218] Bluetooth: Add new AR3012 ID 0489:e095 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 045/218] aacraid: Fix RRQ overload Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 032/218] tools/hv: Use include/uapi with __EXPORTED_HEADERS__ Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:20 +0200
  [PATCH 4.2.y-ckt 019/218] clk: rockchip: add pclk_cpu to the list of rk3188 critical clocks Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 011/218] ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 031/218] staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 024/218] [media] pwc: Add USB id for Philips Spc880nc webcam Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 012/218] ALSA: usb-audio: Add sanity checks for endpoint accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 015/218] USB: cdc-acm: more sanity checking Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 029/218] mei: bus: fix drivers and devices names confusion Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 004/218] crypto: algif_skcipher - Do not dereference ctx without socket lock Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 027/218] 8250: use callbacks to access UART_DLL/UART_DLM Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 001/218] crypto: skcipher - Add crypto_skcipher_has_setkey Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 018/218] crypto: ccp - Add hash state import and export support Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 030/218] mei: bus: check if the device is enabled before data transfer Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 016/218] drm/i915: Workaround CHV pipe C cursor fail Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 022/218] tty: Fix GPF in flush_to_ldisc(), part 2 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 008/218] ipv4: Don't do expensive useless work during inetdev destroy. Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 014/218] Input: ati_remote2 - fix crashes on detecting device with invalid descriptor Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 033/218] tpm: fix the rollback in tpm_chip_register() Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 006/218] gpio: add a data pointer to gpio_chip Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 020/218] clk: rockchip: Add pclk_peri to critical clocks on RK3066/RK3188 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 010/218] USB: iowarrior: fix oops with malicious USB descriptors Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 021/218] clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 005/218] gpiolib: do not allow to insert an empty gpiochip Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 007/218] gpio: rcar: Add Runtime PM handling for interrupts Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 023/218] [media] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32 Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 002/218] crypto: algif_skcipher - Add key check exception for cipher_null Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200
  [PATCH 4.2.y-ckt 025/218] crypto: ccp - Limit the amount of information exported Kamal Mostafa <kamal@canonical.com> - 2016-03-31 23:30 +0200

csiph-web