[PATCH 3.19.y-ckt 089/146] KVM: MMU: fix SMAP virtualization

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 089/146] KVM: MMU: fix SMAP virtualization
Date	2015-06-18 01:30 +0200
Message-ID	<pCuWo-7JA-57@gated-at.bofh.it> (permalink)
References	<pCu0i-6mo-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.19.8-ckt2 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xiao Guangrong <guangrong.xiao@linux.intel.com>

commit 0be0226f07d14b153a5eedf2bb86e1eb7dcefab5 upstream.

KVM may turn a user page to a kernel page when kernel writes a readonly
user page if CR0.WP = 1. This shadow page entry will be reused after
SMAP is enabled so that kernel is allowed to access this user page

Fix it by setting SMAP && !CR0.WP into shadow page's role and reset mmu
once CR4.SMAP is updated

Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 Documentation/virtual/kvm/mmu.txt | 18 ++++++++++++++----
 arch/x86/include/asm/kvm_host.h   |  1 +
 arch/x86/kvm/mmu.c                | 16 ++++++++++++----
 arch/x86/kvm/mmu.h                |  2 --
 arch/x86/kvm/x86.c                |  8 +++-----
 5 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
index 53838d9..c59bd9b 100644
--- a/Documentation/virtual/kvm/mmu.txt
+++ b/Documentation/virtual/kvm/mmu.txt
@@ -169,6 +169,10 @@ Shadow pages contain the following information:
     Contains the value of cr4.smep && !cr0.wp for which the page is valid
     (pages for which this is true are different from other pages; see the
     treatment of cr0.wp=0 below).
+  role.smap_andnot_wp:
+    Contains the value of cr4.smap && !cr0.wp for which the page is valid
+    (pages for which this is true are different from other pages; see the
+    treatment of cr0.wp=0 below).
   gfn:
     Either the guest page table containing the translations shadowed by this
     page, or the base page frame for linear translations.  See role.direct.
@@ -344,10 +348,16 @@ on fault type:
 
 (user write faults generate a #PF)
 
-In the first case there is an additional complication if CR4.SMEP is
-enabled: since we've turned the page into a kernel page, the kernel may now
-execute it.  We handle this by also setting spte.nx.  If we get a user
-fetch or read fault, we'll change spte.u=1 and spte.nx=gpte.nx back.
+In the first case there are two additional complications:
+- if CR4.SMEP is enabled: since we've turned the page into a kernel page,
+  the kernel may now execute it.  We handle this by also setting spte.nx.
+  If we get a user fetch or read fault, we'll change spte.u=1 and
+  spte.nx=gpte.nx back.
+- if CR4.SMAP is disabled: since the page has been changed to a kernel
+  page, it can not be reused when CR4.SMAP is enabled. We set
+  CR4.SMAP && !CR0.WP into shadow page's role to avoid this case. Note,
+  here we do not care the case that CR4.SMAP is enabled since KVM will
+  directly inject #PF to guest due to failed permission check.
 
 To prevent an spte that was converted into a kernel page with cr0.wp=0
 from being written by the kernel after cr0.wp has changed to 1, we make
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index d89c6b8..fd2019e 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -202,6 +202,7 @@ union kvm_mmu_page_role {
 		unsigned nxe:1;
 		unsigned cr0_wp:1;
 		unsigned smep_andnot_wp:1;
+		unsigned smap_andnot_wp:1;
 	};
 };
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 2dfca9b..a5f45d1 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3624,8 +3624,8 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
 	}
 }
 
-void update_permission_bitmask(struct kvm_vcpu *vcpu,
-		struct kvm_mmu *mmu, bool ept)
+static void update_permission_bitmask(struct kvm_vcpu *vcpu,
+				      struct kvm_mmu *mmu, bool ept)
 {
 	unsigned bit, byte, pfec;
 	u8 map;
@@ -3806,6 +3806,7 @@ static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
 {
 	bool smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
+	bool smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
 	ASSERT(vcpu);
 	ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
 
@@ -3823,6 +3824,8 @@ void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
 	vcpu->arch.mmu.base_role.cr0_wp  = is_write_protection(vcpu);
 	vcpu->arch.mmu.base_role.smep_andnot_wp
 		= smep && !is_write_protection(vcpu);
+	context->base_role.smap_andnot_wp
+		= smap && !is_write_protection(vcpu);
 }
 EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);
 
@@ -4094,12 +4097,18 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
 		       const u8 *new, int bytes)
 {
 	gfn_t gfn = gpa >> PAGE_SHIFT;
-	union kvm_mmu_page_role mask = { .word = 0 };
 	struct kvm_mmu_page *sp;
 	LIST_HEAD(invalid_list);
 	u64 entry, gentry, *spte;
 	int npte;
 	bool remote_flush, local_flush, zap_page;
+	union kvm_mmu_page_role mask = (union kvm_mmu_page_role) {
+		.cr0_wp = 1,
+		.cr4_pae = 1,
+		.nxe = 1,
+		.smep_andnot_wp = 1,
+		.smap_andnot_wp = 1,
+	};
 
 	/*
 	 * If we don't have indirect shadow pages, it means no page is
@@ -4125,7 +4134,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
 	++vcpu->kvm->stat.mmu_pte_write;
 	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
-	mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
 	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
 		if (detect_write_misaligned(sp, gpa, bytes) ||
 		      detect_write_flooding(sp)) {
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 222fb3e..a6b8764 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -84,8 +84,6 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context);
 void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context,
 		bool execonly);
-void update_permission_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
-		bool ept);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5ec6a99..f643161 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -697,8 +697,9 @@ EXPORT_SYMBOL_GPL(kvm_set_xcr);
 int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
 	unsigned long old_cr4 = kvm_read_cr4(vcpu);
-	unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE |
-				   X86_CR4_PAE | X86_CR4_SMEP;
+	unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
+				   X86_CR4_SMEP | X86_CR4_SMAP;
+
 	if (cr4 & CR4_RESERVED_BITS)
 		return 1;
 
@@ -739,9 +740,6 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 	    (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE)))
 		kvm_mmu_reset_context(vcpu);
 
-	if ((cr4 ^ old_cr4) & X86_CR4_SMAP)
-		update_permission_bitmask(vcpu, vcpu->arch.walk_mmu, false);
-
 	if ((cr4 ^ old_cr4) & X86_CR4_OSXSAVE)
 		kvm_update_cpuid(vcpu);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt2 stable review Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 096/146] ktime: Fix ktime_divns to do signed division Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 063/146] firmware: dmi_scan: Fix ordering of product_uuid Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 104/146] xen/events: don't bind non-percpu VIRQs with percpu chip Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 141/146] udp: fix behavior of wrong checksums Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 009/146] Revert "usb: dwc2: add bus suspend/resume for dwc2" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 052/146] pty: Fix input race when closing Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 098/146] powerpc: Align TOC to 256 bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 00:30 +0200
  [PATCH 3.19.y-ckt 101/146] mmc: atmel-mci: fix bad variable type for clkdiv Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 130/146] Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 122/146] ipv6: fix ECMP route replacement Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 136/146] unix/caif: sk_socket can disappear when state is unlocked Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 133/146] net: dp83640: fix broken calibration routine. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 127/146] staging: vt6655: vnt_tx_packet Correct TX order of OWNED_BY_NIC Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 131/146] net: core: Correct an over-stringent device loop detection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 128/146] staging: vt6655: [BUG] Protect MACvSelectPage1 with lock. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 138/146] net_sched: invoke ->attach() after setting dev->qdisc Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 124/146] staging: vt6655: move setting of PSTxDesc->buff_addr to vnt_tx_packet Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 129/146] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 132/146] x86: bpf_jit: fix compilation of large bpf programs Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 125/146] staging: vt6655: Fix TD_FLAGS_NETIF_SKB only on TYPE_AC0DMA Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 135/146] net: dp83640: fix improper double spin locking. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 137/146] xen/netback: Properly initialize credit_bytes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 126/146] staging: vt6655: vnt_tx_packet fix dma_idx selection. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 134/146] net: dp83640: reinforce locking rules. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 139/146] sctp: Fix mangled IPv4 addresses on a IPv6 listening socket Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 123/146] tcp/ipv6: fix flow label setting in TIME_WAIT state Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 102/146] sd: Disable support for 256 byte/sector disks Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 119/146] ipv4: Avoid crashing in ip_error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:10 +0200
  [PATCH 3.19.y-ckt 103/146] s390/mm: correct return value of pmd_pfn Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 116/146] net: phy: Allow EEE for all RGMII variants Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 117/146] bridge: fix parsing of MLDv2 reports Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 120/146] ipv6: do not delete previously existing ECMP routes if add fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 105/146] kvm: fix crash in kvm_vcpu_reload_apic_access_page Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 111/146] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 110/146] drm/radeon: retry dcpd fetch Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 107/146] kvm/fpu: Enable eager restore kvm FPU for MPX Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 121/146] net/ipv6/udp: Fix ipv6 multicast socket filter regression Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 056/146] perf/x86/rapl: Enable Broadwell-U RAPL support Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 115/146] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 113/146] rtnl/bond: don't send rtnl msg for unregistered iface Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 106/146] Revert "KVM: x86: drop fpu_activate hook" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 114/146] net: sched: fix call_rcu() race on classifier module unloads Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 055/146] x86/vdso: Fix 'make bzImage' on older distros Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 109/146] Revert "libceph: clear r_req_lru_item in __unregister_linger_request()" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 112/146] ipvs: fix memory leak in ip_vs_ctl.c Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 108/146] libceph: request a new osdmap if lingering request maps to no osd Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:20 +0200
  [PATCH 3.19.y-ckt 074/146] igb: Fix NULL assignment to incorrect variable in igb_reset_q_vector Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 082/146] thermal: armada: Update Armada 380 thermal sensor coefficients Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 038/146] sched: Handle priority boosted tasks proper in setscheduler() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 100/146] ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 076/146] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 080/146] clk: exynos5420: Restore GATE_BUS_TOP on suspend Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 091/146] powerpc/mce: fix off by one errors in mce event handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 095/146] ktime: Optimize ktime_divns for constant divisors Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 092/146] ASoC: dapm: Modify widget stream name according to prefix Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 079/146] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 088/146] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 073/146] x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 099/146] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 070/146] power/reset: at91: fix return value check in at91_reset_platform_probe() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 086/146] mac80211: move WEP tailroom size check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 084/146] ALSA: hda - fix headset mic detection problem for one more machine Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 078/146] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 067/146] tools/vm: fix page-flags build Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 081/146] Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 093/146] ASoC: wm8960: fix "RINPUT3" audio route error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 097/146] Input: elantech - fix semi-mt protocol for v3 HW Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 089/146] KVM: MMU: fix SMAP virtualization Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 077/146] ALSA: hda - Add headphone quirk for Lifebook E752 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 087/146] KVM: MMU: fix smap permission check Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 094/146] ASoC: wm8994: correct BCLK DIV 348 to 384 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 075/146] thermal: rockchip: fix an error code Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 064/146] ext4: fix NULL pointer dereference when journal restart fails Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 069/146] igb: Fix oops on changing number of rings Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 071/146] spi: bitbang: Make setup_transfer() callback optional Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:30 +0200
  [PATCH 3.19.y-ckt 044/146] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 051/146] tty/n_gsm.c: fix a memory leak when gsmtty is removed Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 030/146] USB: pl2303: Remove support for Samsung I330 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 047/146] ARC: unbork !LLSC build Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 066/146] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 046/146] xhci: gracefully handle xhci_irq dead device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 048/146] staging: gdm724x: Correction of variable usage after applying ALIGN() Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 058/146] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 054/146] x86/vdso: Fix the x86 vdso2c tool includes Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 062/146] net: phy: micrel: Fix regression in kszphy_probe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 027/146] usb: gadget: configfs: Fix interfaces array NULL-termination Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 045/146] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 028/146] rtlwifi: rtl8192cu: Fix kernel deadlock Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 059/146] RDMA/core: Fix for parsing netlink string attribute Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 033/146] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 041/146] staging: vt6655: Fix 80211 control and management status reporting. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 061/146] parisc,metag: Fix crashes due to stack randomization on stack-grows-upwards architectures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 068/146] mm, numa: really disable NUMA balancing by default on single node machines Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 039/146] staging: vt6656: use ieee80211_tx_info to select packet type. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 032/146] net: can: xilinx_can: fix extended frame handling Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 072/146] iwlwifi: pcie: prevent using unmapped memory in fw monitor Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 034/146] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 049/146] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 057/146] net: qca_spi: Fix possible race during probe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 050/146] ahci: avoton port-disable reset-quirk Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 037/146] md/raid5: don't record new size if resize_stripes fails. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 040/146] staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 042/146] staging: vt6655: lock MACvWriteBSSIDAddress. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 060/146] drm/radeon: add new bonaire pci id Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 035/146] libata: Blacklist queued TRIM on all Samsung 800-series Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 053/146] ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction. Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 031/146] USB: visor: Match I330 phone more precisely Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 043/146] arm64: bpf: fix signedness bug in loading 64-bit immediate Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:40 +0200
  [PATCH 3.19.y-ckt 018/146] iio: light: hid-sensor-prox: Fix modifier Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 003/146] ozwpan: Use proper check to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 001/146] ozwpan: Use unsigned ints to prevent heap overflow Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 022/146] iio: adc: xilinx: Fix VREFP scale Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 012/146] x86: vdso: fix pvclock races with task migration Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 020/146] iio: adc: xilinx: Fix register addresses Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 023/146] iio: adc: xilinx: Fix VREFN sign Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 021/146] iio: adc: xilinx: Fix "vccaux" channel .address Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 025/146] libata: Ignore spurious PHY event on LPM policy change Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 004/146] ozwpan: unchecked signed subtraction leads to DoS Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 008/146] HID: add quirk for PIXART OEM mouse used by HP Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 002/146] ozwpan: divide-by-zero leading to panic Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 005/146] x86: kvm: Revert "remove sched notifier for cross-cpu migrations" Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 026/146] iio:st_sensors: Fix oops when probing SPI devices Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 014/146] jhash: Update jhash_[321]words functions to use correct initval Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 029/146] USB: cp210x: add ID for KCF Technologies PRN device Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 016/146] bridge/mdb: remove wrong use of NLM_F_MULTI Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 013/146] nfsd: fix nsfd startup race triggering BUG_ON Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 007/146] HID: add HP OEM mouse to quirk ALWAYS_POLL Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 019/146] iio: pressure: hid-sensor-press: Fix modifier Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 011/146] usb: isp1760: hcd: use new USB_RESUME_TIMEOUT Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 017/146] iio/axp288_adc: add missing channel info mask Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200
  [PATCH 3.19.y-ckt 010/146] usb: dwc2: hcd: use new USB_RESUME_TIMEOUT Kamal Mostafa <kamal@canonical.com> - 2015-06-18 01:50 +0200

csiph-web