Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1493278

[PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors

From Jiri Slaby <jslaby@suse.cz>
Newsgroups linux.kernel
Subject [PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors
Date 2016-09-29 12:30 +0200
Message-ID <smGLh-2Ok-55@gated-at.bofh.it> (permalink)
References <smGLf-2Ok-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


From: Alan Stern <stern@rowland.harvard.edu>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream.

Erroneous or malicious endpoint descriptors may have non-zero bits in
reserved positions, or out-of-bounds values.  This patch helps prevent
these from causing problems by bounds-checking the wMaxPacketValue
entries in endpoint descriptors and capping the values at the maximum
allowed.

This issue was first discovered and tests were conducted by Jake Lamberson
<jake.lamberson1@gmail.com>, an intern working for Rosie Hall.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: roswest <roswest@cisco.com>
Tested-by: roswest <roswest@cisco.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/usb/core/config.c | 66 ++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 63 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index ab6a23227cd6..c7e10f5b1143 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -144,6 +144,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 	}
 }
 
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+	[USB_ENDPOINT_XFER_CONTROL] = 8,
+	[USB_ENDPOINT_XFER_ISOC] = 0,
+	[USB_ENDPOINT_XFER_BULK] = 0,
+	[USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+	[USB_ENDPOINT_XFER_CONTROL] = 64,
+	[USB_ENDPOINT_XFER_ISOC] = 1023,
+	[USB_ENDPOINT_XFER_BULK] = 64,
+	[USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+	[USB_ENDPOINT_XFER_CONTROL] = 64,
+	[USB_ENDPOINT_XFER_ISOC] = 1024,
+	[USB_ENDPOINT_XFER_BULK] = 512,
+	[USB_ENDPOINT_XFER_INT] = 1023,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+	[USB_ENDPOINT_XFER_CONTROL] = 512,
+	[USB_ENDPOINT_XFER_ISOC] = 1024,
+	[USB_ENDPOINT_XFER_BULK] = 1024,
+	[USB_ENDPOINT_XFER_INT] = 1024,
+};
+
 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
     int asnum, struct usb_host_interface *ifp, int num_ep,
     unsigned char *buffer, int size)
@@ -152,6 +177,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 	struct usb_endpoint_descriptor *d;
 	struct usb_host_endpoint *endpoint;
 	int n, i, j, retval;
+	unsigned int maxp;
+	const unsigned short *maxpacket_maxes;
 
 	d = (struct usb_endpoint_descriptor *) buffer;
 	buffer += d->bLength;
@@ -259,6 +286,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 			endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
 	}
 
+	/* Validate the wMaxPacketSize field */
+	maxp = usb_endpoint_maxp(&endpoint->desc);
+
+	/* Find the highest legal maxpacket size for this endpoint */
+	i = 0;		/* additional transactions per microframe */
+	switch (to_usb_device(ddev)->speed) {
+	case USB_SPEED_LOW:
+		maxpacket_maxes = low_speed_maxpacket_maxes;
+		break;
+	case USB_SPEED_FULL:
+		maxpacket_maxes = full_speed_maxpacket_maxes;
+		break;
+	case USB_SPEED_HIGH:
+		/* Bits 12..11 are allowed only for HS periodic endpoints */
+		if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+			i = maxp & (BIT(12) | BIT(11));
+			maxp &= ~i;
+		}
+		/* fallthrough */
+	default:
+		maxpacket_maxes = high_speed_maxpacket_maxes;
+		break;
+	case USB_SPEED_SUPER:
+	case USB_SPEED_SUPER_PLUS:
+		maxpacket_maxes = super_speed_maxpacket_maxes;
+		break;
+	}
+	j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+	if (maxp > j) {
+		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+		    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+		maxp = j;
+		endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+	}
+
 	/*
 	 * Some buggy high speed devices have bulk endpoints using
 	 * maxpacket sizes other than 512.  High speed HCDs may not
@@ -266,9 +329,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 	 */
 	if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
 			&& usb_endpoint_xfer_bulk(d)) {
-		unsigned maxp;
-
-		maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
 		if (maxp != 512)
 			dev_warn(ddev, "config %d interface %d altsetting %d "
 				"bulk endpoint 0x%X has invalid maxpacket %d\n",
-- 
2.10.0

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
  [PATCH 3.12 001/119] MIPS: KVM: Check for pfn noslot case Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 057/119] drm: Reject page_flip for !DRIVER_MODESET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 013/119] usb: xhci: Fix panic if disconnect Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 010/119] usb: dwc3: gadget: increment request->actual once Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 055/119] ipv6: release dst in ping_v6_sendmsg Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 014/119] USB: serial: fix memleak in driver-registration error path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 015/119] USB: serial: option: add D-Link DWM-156/A3 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
    [PATCH 3.12 111/119] metag: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 114/119] mn10300: copy_from_user() should zero on access_ok() failure... Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 089/119] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 098/119] score: fix __get_user/get_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 110/119] alpha: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 101/119] asm-generic: make get_user() clear the destination on errors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 112/119] parisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 102/119] frv: fix clear_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 096/119] m32r: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 105/119] score: fix copy_from_user() and friends Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 106/119] sh: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 109/119] asm-generic: make copy_from_user() zero the destination properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 100/119] ARC: uaccess: get_user to zero out dest in cause of fault Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 093/119] microblaze: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 088/119] ARM: OMAP3: hwmod data: Add sysc information for DSI Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 091/119] microblaze: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 062/119] x86/apic: Do not init irq remapping if ioapic is disabled Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 113/119] openrisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 115/119] sparc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 095/119] mn10300: failing __get_user() and get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 097/119] sh64: failing __get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 118/119] avr32: fix 'undefined reference to `___copy_from_user' Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 090/119] crypto: cryptd - initialize child shash_desc on import Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 085/119] USB: serial: simple: add support for another Infineon flashloader Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 099/119] s390: get_user() should zero on failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 117/119] ia64: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 084/119] iio: accel: kxsd9: Fix scaling bug Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 083/119] iio: accel: kxsd9: Fix raw read return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 116/119] ppc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 103/119] cris: buggered copy_from_user/copy_to_user/clear_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 092/119] avr32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 104/119] blackfin: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 108/119] mips: copy_from_user() must zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 087/119] USB: change bInterval default to 10 ms Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 107/119] hexagon: fix strncpy_from_user() error return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 094/119] fix minor infoleak in get_user_ex() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 119/119] openrisc: fix the fix of copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 086/119] usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
    [PATCH 3.12 033/119] USB: serial: mos7840: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 075/119] ipvs: count pre-established TCP states as active Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 043/119] fix d_walk()/non-delayed __d_free() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 044/119] ext4: avoid modifying checksum fields directly during checksum verification Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 079/119] NFSv4.x: Fix a refcount leak in nfs_callback_up_net Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 048/119] net/irda: handle iriap_register_lsap() allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 082/119] kvm-arm: Unmap shadow pagetables properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 051/119] tcp: properly scale window in tcp_v[46]_reqsk_send_ack() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 039/119] ALSA: oxygen: Fix logical-not-parentheses warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 045/119] timers: Use proper base migration in add_timer_on() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 073/119] mISDN: Fixing missing validation in base_sock_bind() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 069/119] hwrng: exynos - Disable runtime PM on probe failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 071/119] HID: add usb device id for Apple Magic Keyboard Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 040/119] stb6100: fix buffer length check in stb6100_write_reg_range() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 074/119] net: disable fragment reassembly if high_thresh is set to zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 067/119] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 050/119] net/mlx5: Added missing check of msg length in verifying its signature Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 080/119] dm flakey: fix reads to be issued if drop_writes configured Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 070/119] Input: ili210x - fix permissions on "calibrate" attribute Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 063/119] ALSA: rawmidi: Fix possible deadlock with virmidi registration Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 072/119] mISDN: Support DR6 indication in mISDNipac driver Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 037/119] be2iscsi: Fix bogus WARN_ON length check Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 077/119] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 038/119] HID: hid-input: Add parentheses to quell gcc warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 042/119] s390/sclp_ctl: fix potential information leak with /dev/sclp Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 064/119] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 035/119] ACPI / sysfs: fix error code in get_status() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 041/119] ext4: validate that metadata blocks do not overlap superblock Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 046/119] ext4: use __GFP_NOFAIL in ext4_free_blocks() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 078/119] powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 047/119] Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 065/119] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 081/119] x86/paravirt: Do not trace _paravirt_ident_*() functions Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 076/119] x86/mm/pat, /dev/mem: Remove superfluous error message Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 068/119] cpufreq: Fix GOV_LIMITS handling for the userspace governor Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 066/119] ALSA: timer: fix NULL pointer dereference on memory allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 049/119] tcp: fix use after free in tcp_xmit_retransmit_queue() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
    [PATCH 3.12 026/119] gpio: Fix OF build problem on UM Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 027/119] fs/seq_file: fix out-of-bounds read Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 024/119] cdc-acm: fix wrong pipe type on rx interrupt xfers Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 036/119] Revert "can: fix handling of unmodifiable configuration options fix" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 021/119] s390/dasd: fix hanging device after clear subchannel Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 028/119] Input: i8042 - break load dependency between atkbd/psmouse and i8042 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 029/119] Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 031/119] USB: fix typo in wMaxPacketSize validation Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 019/119] xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices. Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 020/119] EDAC: Increment correct counter in edac_inc_ue_error() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 023/119] aacraid: Check size values after double-fetch from user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 034/119] staging: comedi: daqboard2000: bug fix board type matching code Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 002/119] x86/mm: Disable preemption during CR3 read+write Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 022/119] mac80211: fix purging multicast PS buffer queue Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 005/119] PCI: Support PCIe devices with short cfg_size Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 016/119] USB: serial: option: add support for Telit LE920A4 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 004/119] parisc: Fix order of EREFUSED define in errno.h Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 018/119] USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 030/119] crypto: nx - off by one bug in nx_of_update_msc() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 025/119] megaraid_sas: Fix probing cards without io port Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 006/119] PCI: Add Netronome vendor and device IDs Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
    [PATCH 3.12 032/119] USB: serial: mos7720: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
  Re: [PATCH 3.12 000/119] 3.12.64-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-29 16:30 +0200
    Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-10-03 13:00 +0200
  Re: [PATCH 3.12 000/119] 3.12.64-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-09-29 19:20 +0200
  Re: [PATCH 3.12 000/119] 3.12.64-stable review Mike Galbraith <umgwanakikbuti@gmail.com> - 2016-09-30 07:30 +0200
    Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-30 08:50 +0200

csiph-web