Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1467080

[PATCH 3.10 129/180] ALSA: dummy: Fix a use-after-free at closing

From Willy Tarreau <w@1wt.eu>
Newsgroups linux.kernel
Subject [PATCH 3.10 129/180] ALSA: dummy: Fix a use-after-free at closing
Date 2016-08-21 17:50 +0200
Message-ID <s8Day-2bE-45@gated-at.bofh.it> (permalink)
References <s8D0R-26R-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

From: Takashi Iwai <tiwai@suse.de>

commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.

syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
>  Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [<      none      >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [<      none      >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
>  [<ffffffff8179e59e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
>  [<     inline     >] rb_set_parent include/linux/rbtree_augmented.h:111
>  [<     inline     >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
>  [<ffffffff82ca5787>] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
>  [<ffffffff82cb02e8>] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
>  [<ffffffff814d0c80>] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
>  [<     inline     >] remove_hrtimer kernel/time/hrtimer.c:945
>  [<ffffffff814d23da>] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
>  [<ffffffff814d2742>] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
>  [<ffffffff85420531>] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
>  [<ffffffff854228bf>] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
>  [<ffffffff85392170>] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
>  [<ffffffff85391b26>] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
>  [<ffffffff85391e01>] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
>  [<     inline     >] snd_pcm_stop sound/core/pcm_native.c:1139
>  [<ffffffff8539754d>] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
>  [<ffffffff8539d3be>] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
>  [<ffffffff8539ee91>] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
>  [<ffffffff8539f2ec>] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
>  [<ffffffff853d9a44>] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
>  [<ffffffff853da27d>] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
>  .....

A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 sound/drivers/dummy.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
index 982a2c2..7f400a1 100644
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -422,6 +422,7 @@ static int dummy_hrtimer_stop(struct snd_pcm_substream *substream)
 
 static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm)
 {
+	hrtimer_cancel(&dpcm->timer);
 	tasklet_kill(&dpcm->tasklet);
 }
 
-- 
2.8.0.rc2.1.gbe9624a

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 000/180] 3.10.103-stable review Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 036/180] usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable() Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 028/180] udp: properly support MSG_PEEK with truncated buffers Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 017/180] netfilter: ip_tables: simplify translate_compat_table args Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 132/180] ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 053/180] MIPS: KVM: Propagate kseg0/mapped tlb fault errors Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 008/180] netfilter: x_tables: add and use xt_check_entry_offsets Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 135/180] scsi: fix race between simultaneous decrements of ->host_failed Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 131/180] ALSA: ctl: Stop notification after disconnection Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 178/180] isdn: hfcpci_softirq: get func return to suppress compiler warning Willy Tarreau <w@1wt.eu> - 2016-08-21 17:40 +0200
  [PATCH 3.10 177/180] net: rfkill: Do not ignore errors from regulator_enable() Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 145/180] ARC: use ASL assembler mnemonic Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 093/180] KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 153/180] x86/mm: Improve switch_mm() barrier comments Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 061/180] Input: xpad - validate USB endpoint count during probe Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 104/180] sit: correct IP protocol used in ipip6_err Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 162/180] s5p-mfc: Add release callback for memory region devs Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 126/180] iio:ad7266: Fix broken regulator error handling Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 049/180] tcp: consider recv buf for the initial window scale Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 127/180] iio:ad7266: Fix probe deferral for vref Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 054/180] MIPS: math-emu: Fix jalr emulation when rd == $0 Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 173/180] be2iscsi: Fix bogus WARN_ON length check Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 020/180] netfilter: ensure number of counters is >0 in do_replace() Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 109/180] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 019/180] netfilter: x_tables: xt_compat_match_from_user doesn't need a retval Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 165/180] netlabel: add address family checks to netlbl_{sock,req}_delattr() Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 039/180] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 055/180] MIPS: Fix siginfo.h to use strict posix types Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 071/180] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 174/180] squash mm: Export migrate_page_... : also make it non-static Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 026/180] signal: remove warning about using SI_TKILL in rt_[tg]sigqueueinfo Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 129/180] ALSA: dummy: Fix a use-after-free at closing Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 009/180] netfilter: x_tables: kill check_entry helper Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 158/180] net/irda: fix NULL pointer dereference on memory allocation failure Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 015/180] netfilter: x_tables: don't reject valid target size on some architectures Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 058/180] MIPS: KVM: Fix modular KVM under QEMU Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 113/180] x86, build: copy ldlinux.c32 to image.iso Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 112/180] IB/mlx4: Fix the SQ size of an RC QP Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 095/180] arm: oabi compat: add missing access checks Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 096/180] parisc: Fix pagefault crash in unaligned __get_user() call Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 059/180] Input: uinput - handle compat ioctl for UI_SET_PHYS Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 064/180] aacraid: Fix for aac_command_thread hang Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 124/180] staging: iio: accel: fix error check Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 052/180] MIPS: KVM: Fix gfn range check in kseg0 tlb faults Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 012/180] netfilter: x_tables: check standard target size too Willy Tarreau <w@1wt.eu> - 2016-08-21 17:50 +0200
  [PATCH 3.10 176/180] ALSA: oxygen: Fix logical-not-parentheses warning Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 111/180] IB/IPoIB: Don't update neigh validity for unresolved entries Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 163/180] Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 094/180] ARM: fix PTRACE_SETVFPREGS on SMP systems Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 024/180] perf/x86: Honor the architectural performance monitoring version Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 130/180] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 141/180] arc: unwind: warn only once if DW2_UNWIND is disabled Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 092/180] xfs: skip stale inodes in xfs_iflush_cluster Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 050/180] MIPS: KVM: Fix mapped fault broken commpage handling Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 128/180] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 161/180] s5p-mfc: Set device name for reserved memory region devs Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 140/180] fs/nilfs2: fix potential underflow in call to crc32_le Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 068/180] powerpc: Fix definition of SIAR and SDAR registers Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 078/180] drm/radeon: add a delay after ATPX dGPU power off Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 018/180] netfilter: ip6_tables: simplify translate_compat_table args Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 136/180] scsi: remove scsi_end_request Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 152/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 062/180] ath5k: Change led pin configuration for compaq c700 laptop Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 100/180] xfs: fix up backport error in fs/xfs/xfs_inode.c Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 076/180] drm/fb_helper: Fix references to dev->mode_config.num_connector Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 099/180] fix d_walk()/non-delayed __d_free() race Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 156/180] block: fix use-after-free in seq file Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 121/180] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 066/180] rtlwifi: Fix logic error in enter/exit power-save mode Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 167/180] ftrace/recordmcount: Work around for addition of metag magic but not relocations Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 149/180] can: fix oops caused by wrong rtnl dellink usage Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 037/180] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 134/180] ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 098/180] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
    Re: [PATCH 3.10 098/180] wext: Fix 32 bit iwpriv compatibility  issue with 64 bit Kernel Johannes Berg <johannes@sipsolutions.net> - 2016-08-22 07:40 +0200
      Re: [PATCH 3.10 098/180] wext: Fix 32 bit iwpriv compatibility issue  with 64 bit Kernel Willy Tarreau <w@1wt.eu> - 2016-08-22 07:50 +0200
  [PATCH 3.10 044/180] libceph: apply new_state before new_up_client on incrementals Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 045/180] tmpfs: don't undo fallocate past its last page Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 168/180] metag: Fix __cmpxchg_u32 asm constraint for CMP Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 046/180] tmpfs: fix regression hang in fallocate undo Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 075/180] drm/gma500: Fix possible out of bounds read Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 169/180] ubi: Make volume resize power cut aware Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 179/180] stb6100: fix buffer length check in stb6100_write_reg_range() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 089/180] dma-debug: avoid spinlock recursion when disabling dma-debug Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 139/180] s390/seccomp: fix error return for filtered system calls Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 103/180] crypto: scatterwalk - Fix test in scatterwalk_done Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 147/180] mmc: block: fix packed command header endianness Willy Tarreau <w@1wt.eu> - 2016-08-21 18:00 +0200
  [PATCH 3.10 102/180] crypto: gcm - Filter out async ghash if necessary Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 142/180] xen/pciback: Fix conf_space read/write overlap check. Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on error Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
    Re: [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on  error Dave Chinner <david@fromorbit.com> - 2016-08-22 06:30 +0200
      Re: [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on  error Willy Tarreau <w@1wt.eu> - 2016-08-22 07:20 +0200
        Re: [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on  error Willy Tarreau <w@1wt.eu> - 2016-08-22 07:30 +0200
        Re: [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on  error Dave Chinner <dchinner@redhat.com> - 2016-08-22 13:00 +0200
          Re: [PATCH 3.10 090/180] xfs: xfs_iflush_cluster fails to abort on  error Willy Tarreau <w@1wt.eu> - 2016-08-22 13:10 +0200
  [PATCH 3.10 003/180] netfilter: x_tables: validate e->target_offset early Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 025/180] perf/x86: Fix undefined shift on 32-bit kernels Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 164/180] cifs: Check for existing directory when opening file with O_CREAT Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 091/180] xfs: fix inode validity check in xfs_iflush_cluster Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 038/180] pipe: limit the per-user amount of pages allocated in pipes Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 118/180] UBIFS: Implement ->migratepage() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 175/180] HID: hid-input: Add parentheses to quell gcc warning Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 065/180] PCI: Disable all BAR sizing for devices with non-compliant BARs Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 144/180] ecryptfs: don't allow mmap when the lower fs doesn't support it Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 043/180] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 067/180] powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 157/180] fuse: fix wrong assignment of ->flags in fuse_send_init() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 023/180] netfilter: x_tables: introduce and use xt_copy_counters_from_user Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 011/180] netfilter: x_tables: add compat version of xt_check_entry_offsets Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 122/180] base: make module_create_drivers_dir race-free Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 087/180] ext4: short-cut orphan cleanup on error Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 125/180] iio: accel: kxsd9: fix the usage of spi_w8r8() Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 070/180] powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 107/180] mac80211: mesh: flush mesh paths unconditionally Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 138/180] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 119/180] cdc_ncm: workaround for EM7455 "silent" data interface Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 106/180] net: alx: Work around the DMA RX overflow issue Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 032/180] USB: EHCI: declare hostpc register as zero-length array Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 031/180] USB: fix up faulty backports Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 150/180] ipr: Clear interrupt on croc/crocodile when running with LSI Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 041/180] mm: migrate dirty page without clear_page_dirty_for_io etc Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 116/180] NFS: Fix another OPEN_DOWNGRADE bug Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 069/180] powerpc: Use privileged SPR number for MMCR2 Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 085/180] ext4: check for extents that wrap around Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 072/180] powerpc/pseries: Fix PCI config address for DDW Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 110/180] IB/security: Restrict use of the write() interface Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 133/180] ALSA: timer: Fix leak in events via snd_timer_user_ccallback Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 123/180] iio: Fix error handling in iio_trigger_attach_poll_func Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 172/180] module: Invalidate signatures on force-loaded modules Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 160/180] hp-wmi: Fix wifi cannot be hard-unblocked Willy Tarreau <w@1wt.eu> - 2016-08-21 18:10 +0200
  [PATCH 3.10 004/180] netfilter: x_tables: make sure e->next_offset covers remaining blob size Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 042/180] printk: do cond_resched() between lines while outputting to consoles Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 001/180] X.509: remove possible code fragility: enumeration values not handled Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 097/180] ecryptfs: forbid opening files without mmap handler Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 021/180] netfilter: x_tables: do compat validation via translate_table Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 030/180] USB: usbfs: fix potential infoleak in devio Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 040/180] KEYS: potential uninitialized variable Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 034/180] usb: musb: Stop bulk endpoint while queue is rotated Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 005/180] netfilter: x_tables: fix unconditional helper Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 014/180] netfilter: x_tables: validate all offsets and sizes in a rule Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200
  [PATCH 3.10 022/180] Revert "netfilter: ensure number of counters is >0 in do_replace()" Willy Tarreau <w@1wt.eu> - 2016-08-21 18:20 +0200

csiph-web