Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1627109

[PATCH 3.18 056/124] mm: Tighten x86 /dev/mem with zeroing reads

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.18 056/124] mm: Tighten x86 /dev/mem with zeroing reads
Date 2017-04-20 09:00 +0200
Message-ID <tyeen-5AX-31@gated-at.bofh.it> (permalink)
References <tydUZ-5tf-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <keescook@chromium.org>

commit a4866aa812518ed1a37d8ea0c881dc946409de94 upstream.

Under CONFIG_STRICT_DEVMEM, reading System RAM through /dev/mem is
disallowed. However, on x86, the first 1MB was always allowed for BIOS
and similar things, regardless of it actually being System RAM. It was
possible for heap to end up getting allocated in low 1MB RAM, and then
read by things like x86info or dd, which would trip hardened usercopy:

usercopy: kernel memory exposure attempt detected from ffff880000090000 (dma-kmalloc-256) (4096 bytes)

This changes the x86 exception for the low 1MB by reading back zeros for
System RAM areas instead of blindly allowing them. More work is needed to
extend this to mmap, but currently mmap doesn't go through usercopy, so
hardened usercopy won't Oops the kernel.

Reported-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Tested-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/mm/init.c |   40 +++++++++++++++++++------
 drivers/char/mem.c |   82 +++++++++++++++++++++++++++++++++--------------------
 2 files changed, 82 insertions(+), 40 deletions(-)

--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -581,20 +581,40 @@ void __init init_mem_mapping(void)
  * is valid. The argument is a physical page number.
  *
  *
- * On x86, access has to be given to the first megabyte of ram because that area
- * contains bios code and data regions used by X and dosemu and similar apps.
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
+ * On x86, access has to be given to the first megabyte of RAM because that
+ * area traditionally contains BIOS code and data regions used by X, dosemu,
+ * and similar apps. Since they map the entire memory range, the whole range
+ * must be allowed (for mapping), but any areas that would otherwise be
+ * disallowed are flagged as being "zero filled" instead of rejected.
+ * Access has to be given to non-kernel-ram areas as well, these contain the
+ * PCI mmio resources as well as potential bios/acpi data regions.
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-	if (pagenr < 256)
-		return 1;
-	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+	if (page_is_ram(pagenr)) {
+		/*
+		 * For disallowed memory regions in the low 1MB range,
+		 * request that the page be shown as all zeros.
+		 */
+		if (pagenr < 256)
+			return 2;
+
 		return 0;
-	if (!page_is_ram(pagenr))
-		return 1;
-	return 0;
+	}
+
+	/*
+	 * This must follow RAM test, since System RAM is considered a
+	 * restricted resource under CONFIG_STRICT_IOMEM.
+	 */
+	if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
+		/* Low 1MB bypasses iomem restrictions. */
+		if (pagenr < 256)
+			return 1;
+
+		return 0;
+	}
+
+	return 1;
 }
 
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -59,6 +59,10 @@ static inline int valid_mmap_phys_addr_r
 #endif
 
 #ifdef CONFIG_STRICT_DEVMEM
+static inline int page_is_allowed(unsigned long pfn)
+{
+	return devmem_is_allowed(pfn);
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
 	u64 from = ((u64)pfn) << PAGE_SHIFT;
@@ -78,6 +82,10 @@ static inline int range_is_allowed(unsig
 	return 1;
 }
 #else
+static inline int page_is_allowed(unsigned long pfn)
+{
+	return 1;
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
 	return 1;
@@ -122,23 +130,31 @@ static ssize_t read_mem(struct file *fil
 
 	while (count > 0) {
 		unsigned long remaining;
+		int allowed;
 
 		sz = size_inside_page(p, count);
 
-		if (!range_is_allowed(p >> PAGE_SHIFT, count))
+		allowed = page_is_allowed(p >> PAGE_SHIFT);
+		if (!allowed)
 			return -EPERM;
+		if (allowed == 2) {
+			/* Show zeros for restricted memory. */
+			remaining = clear_user(buf, sz);
+		} else {
+			/*
+			 * On ia64 if a page has been mapped somewhere as
+			 * uncached, then it must also be accessed uncached
+			 * by the kernel or data corruption may occur.
+			 */
+			ptr = xlate_dev_mem_ptr(p);
+			if (!ptr)
+				return -EFAULT;
 
-		/*
-		 * On ia64 if a page has been mapped somewhere as uncached, then
-		 * it must also be accessed uncached by the kernel or data
-		 * corruption may occur.
-		 */
-		ptr = xlate_dev_mem_ptr(p);
-		if (!ptr)
-			return -EFAULT;
+			remaining = copy_to_user(buf, ptr, sz);
+
+			unxlate_dev_mem_ptr(p, ptr);
+		}
 
-		remaining = copy_to_user(buf, ptr, sz);
-		unxlate_dev_mem_ptr(p, ptr);
 		if (remaining)
 			return -EFAULT;
 
@@ -181,30 +197,36 @@ static ssize_t write_mem(struct file *fi
 #endif
 
 	while (count > 0) {
+		int allowed;
+
 		sz = size_inside_page(p, count);
 
-		if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+		allowed = page_is_allowed(p >> PAGE_SHIFT);
+		if (!allowed)
 			return -EPERM;
 
-		/*
-		 * On ia64 if a page has been mapped somewhere as uncached, then
-		 * it must also be accessed uncached by the kernel or data
-		 * corruption may occur.
-		 */
-		ptr = xlate_dev_mem_ptr(p);
-		if (!ptr) {
-			if (written)
-				break;
-			return -EFAULT;
-		}
+		/* Skip actual writing when a page is marked as restricted. */
+		if (allowed == 1) {
+			/*
+			 * On ia64 if a page has been mapped somewhere as
+			 * uncached, then it must also be accessed uncached
+			 * by the kernel or data corruption may occur.
+			 */
+			ptr = xlate_dev_mem_ptr(p);
+			if (!ptr) {
+				if (written)
+					break;
+				return -EFAULT;
+			}
 
-		copied = copy_from_user(ptr, buf, sz);
-		unxlate_dev_mem_ptr(p, ptr);
-		if (copied) {
-			written += sz - copied;
-			if (written)
-				break;
-			return -EFAULT;
+			copied = copy_from_user(ptr, buf, sz);
+			unxlate_dev_mem_ptr(p, ptr);
+			if (copied) {
+				written += sz - copied;
+				if (written)
+					break;
+				return -EFAULT;
+			}
 		}
 
 		buf += sz;

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 047/124] xen/acpi: upload PM state from init-domain to Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 055/124] rtc: tegra: Implement clock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 019/124] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 027/124] metag/ptrace: Reject partial NT_METAG_RPIPE writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 006/124] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 013/124] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 025/124] metag/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 004/124] x86/vdso: Plug race between mapping and ELF header setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 050/124] zram: do not use copy_page with non-page aligned address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 001/124] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 062/124] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 024/124] sparc/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 031/124] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 063/124] catc: Use heap buffer for memory size test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 045/124] scsi: sg: check length passed to SG_NEXT_CMD_LEN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
  [PATCH 3.18 103/124] xfs: fix up xfs_swap_extent_forks inline extent handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 104/124] xfs: clear _XBF_PAGES from buffers when readahead page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 080/124] Input: hanwang - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 105/124] ACPI: Fix incompatibility with mcount-based function graph tracing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 074/124] isdn/gigaset: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 100/124] igb: Workaround for igb i210 firmware issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 084/124] Input: sur40 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 075/124] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 117/124] metag/usercopy: Drop unused macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 109/124] block: allow WRITE_SAME commands with the SG_IO ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 124/124] give up on gcc ilog2() constant optimizations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 040/124] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 120/124] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 083/124] Input: kbtab - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 081/124] Input: yealink - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 115/124] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 123/124] metag/usercopy: Add missing fixups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 116/124] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 106/124] ACPI: Do not create a platform_device for IOAPIC/IOxAPIC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 097/124] ext4: mark inode dirty after converting inline directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 082/124] Input: cm109 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 114/124] mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 092/124] mmc: ushc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 102/124] xfs: dont allow di_size with high bit set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 079/124] Input: ims-pcu - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 078/124] Input: iforce - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 118/124] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 119/124] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 086/124] net/mlx5: Increase number of max QPs in default profile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 122/124] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 121/124] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 077/124] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 107/124] serial: 8250_pci: Detach low-level driver during PCI error recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 101/124] igb: add i211 to i210 PHY workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 073/124] target: Fix VERIFY_16 handling in sbc_parse_cdb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 112/124] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 108/124] [media] uvcvideo: uvc_scan_fallback() for webcams with broken chain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 110/124] virtio_balloon: init 1st buffer in stats vq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 111/124] pinctrl: qcom: Dont clear status bit on irq_unmask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
  [PATCH 3.18 098/124] mmc: sdhci: Do not disable interrupts while waiting for clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 032/124] Drivers: hv: balloon: dont crash when memory is added in non-sorted order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 059/124] virtio-console: avoid DMA from stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 069/124] KVM: kvm_io_bus_unregister_dev() should never fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 041/124] powerpc/boot: Fix zImage TOC alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 067/124] KVM: PPC: Book3S PR: Fix illegal opcode emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 093/124] uwb: hwa-rc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 088/124] net: properly release sk_frag.page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 076/124] ipv4: provide stronger user input validation in nl_fib_input() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 094/124] uwb: i1480-dfu: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 066/124] net sched actions: decrement module reference count after table flush. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 095/124] USB: usbtmc: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 056/124] mm: Tighten x86 /dev/mem with zeroing reads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 061/124] rtl8150: Use heap buffers for all register access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 096/124] iio: adc: ti_am335x_adc: fix fifo overrun recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 090/124] socket, bpf: fix sk_filter use after free in sk_clone_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 052/124] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 071/124] perf/core: Fix event inheritance on fork() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 072/124] md/raid1/10: fix potential deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 099/124] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 089/124] net: unix: properly re-increment inflight counter of GC discarded candidates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 039/124] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 038/124] ALSA: seq: Fix race during FIFO resize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 051/124] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 087/124] net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 091/124] tcp: initialize icsk_ack.lrcvtime at session start time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
  [PATCH 3.18 014/124] Revert "ARM: 8457/1: psci-smp is built only for SMP" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 012/124] char: Drop bogus dependency of DEVPORT on !M68K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 002/124] Input: xpad - add support for Razer Wildcat gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 053/124] [media] dvb-usb-v2: avoid use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 023/124] mips/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 022/124] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 043/124] scsi: lpfc: Add shutdown method for kexec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 017/124] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 008/124] scsi: sr: Sanity check returned mode data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 009/124] scsi: sd: Fix capacity calculation with 32-bit sector_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 049/124] tty/serial: atmel: fix race condition (TX+DMA) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    Re: [PATCH 3.18 049/124] tty/serial: atmel: fix race condition  (TX+DMA) Richard Genoud <richard.genoud@gmail.com> - 2017-04-20 09:50 +0200
      Re: [PATCH 3.18 049/124] tty/serial: atmel: fix race condition  (TX+DMA) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 15:40 +0200
  [PATCH 3.18 021/124] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 028/124] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 015/124] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 026/124] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 029/124] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 007/124] iscsi-target: Drop work-around for legacy GlobalSAN initiator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 042/124] target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 005/124] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 044/124] scsi: libiscsi: add lock around task lists to fix list corruption regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 020/124] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 030/124] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 046/124] scsi: libsas: fix ata xfer length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  [PATCH 3.18 018/124] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
  Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-20 15:50 +0200
    Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 16:30 +0200
      Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 22:00 +0200
        Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-21 05:40 +0200
          Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 06:40 +0200
            Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-21 19:10 +0200
              Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 20:20 +0200
  Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 09:20 +0200
    Re: [PATCH 3.18 000/124] 3.18.50-stable review Mark Brown <broonie@kernel.org> - 2017-04-21 12:20 +0200

csiph-web