Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1326025

[PATCH 3.16.y-ckt 020/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event

From Luis Henriques <luis.henriques@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.16.y-ckt 020/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
Date 2016-02-03 23:40 +0100
Message-ID <qYefE-86A-35@gated-at.bofh.it> (permalink)
References <qYefD-86A-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Karl Heiss <kheiss@gmail.com>

commit 635682a14427d241bab7bbdeebb48a7d7b91638e upstream.

A case can occur when sctp_accept() is called by the user during
a heartbeat timeout event after the 4-way handshake.  Since
sctp_assoc_migrate() changes both assoc->base.sk and assoc->ep, the
bh_sock_lock in sctp_generate_heartbeat_event() will be taken with
the listening socket but released with the new association socket.
The result is a deadlock on any future attempts to take the listening
socket lock.

Note that this race can occur with other SCTP timeouts that take
the bh_lock_sock() in the event sctp_accept() is called.

 BUG: soft lockup - CPU#9 stuck for 67s! [swapper:0]
 ...
 RIP: 0010:[<ffffffff8152d48e>]  [<ffffffff8152d48e>] _spin_lock+0x1e/0x30
 RSP: 0018:ffff880028323b20  EFLAGS: 00000206
 RAX: 0000000000000002 RBX: ffff880028323b20 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: ffff880028323be0 RDI: ffff8804632c4b48
 RBP: ffffffff8100bb93 R08: 0000000000000000 R09: 0000000000000000
 R10: ffff880610662280 R11: 0000000000000100 R12: ffff880028323aa0
 R13: ffff8804383c3880 R14: ffff880028323a90 R15: ffffffff81534225
 FS:  0000000000000000(0000) GS:ffff880028320000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
 CR2: 00000000006df528 CR3: 0000000001a85000 CR4: 00000000000006e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process swapper (pid: 0, threadinfo ffff880616b70000, task ffff880616b6cab0)
 Stack:
 ffff880028323c40 ffffffffa01c2582 ffff880614cfb020 0000000000000000
 <d> 0100000000000000 00000014383a6c44 ffff8804383c3880 ffff880614e93c00
 <d> ffff880614e93c00 0000000000000000 ffff8804632c4b00 ffff8804383c38b8
 Call Trace:
 <IRQ>
 [<ffffffffa01c2582>] ? sctp_rcv+0x492/0xa10 [sctp]
 [<ffffffff8148c559>] ? nf_iterate+0x69/0xb0
 [<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0
 [<ffffffff8148c716>] ? nf_hook_slow+0x76/0x120
 [<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0
 [<ffffffff8149757d>] ? ip_local_deliver_finish+0xdd/0x2d0
 [<ffffffff81497808>] ? ip_local_deliver+0x98/0xa0
 [<ffffffff81496ccd>] ? ip_rcv_finish+0x12d/0x440
 [<ffffffff81497255>] ? ip_rcv+0x275/0x350
 [<ffffffff8145cfeb>] ? __netif_receive_skb+0x4ab/0x750
 ...

With lockdep debugging:

 =====================================
 [ BUG: bad unlock balance detected! ]
 -------------------------------------
 CslRx/12087 is trying to release lock (slock-AF_INET) at:
 [<ffffffffa01bcae0>] sctp_generate_timeout_event+0x40/0xe0 [sctp]
 but there are no more locks to release!

 other info that might help us debug this:
 2 locks held by CslRx/12087:
 #0:  (&asoc->timers[i]){+.-...}, at: [<ffffffff8108ce1f>] run_timer_softirq+0x16f/0x3e0
 #1:  (slock-AF_INET){+.-...}, at: [<ffffffffa01bcac3>] sctp_generate_timeout_event+0x23/0xe0 [sctp]

Ensure the socket taken is also the same one that is released by
saving a copy of the socket before entering the timeout event
critical section.

Signed-off-by: Karl Heiss <kheiss@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/sctp/sm_sideeffect.c | 42 +++++++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 85e6f03aeb70..9366510a5867 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -244,12 +244,13 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
 	int error;
 	struct sctp_transport *transport = (struct sctp_transport *) peer;
 	struct sctp_association *asoc = transport->asoc;
-	struct net *net = sock_net(asoc->base.sk);
+	struct sock *sk = asoc->base.sk;
+	struct net *net = sock_net(sk);
 
 	/* Check whether a task is in the sock.  */
 
-	bh_lock_sock(asoc->base.sk);
-	if (sock_owned_by_user(asoc->base.sk)) {
+	bh_lock_sock(sk);
+	if (sock_owned_by_user(sk)) {
 		pr_debug("%s: sock is busy\n", __func__);
 
 		/* Try again later.  */
@@ -272,10 +273,10 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
 			   transport, GFP_ATOMIC);
 
 	if (error)
-		asoc->base.sk->sk_err = -error;
+		sk->sk_err = -error;
 
 out_unlock:
-	bh_unlock_sock(asoc->base.sk);
+	bh_unlock_sock(sk);
 	sctp_transport_put(transport);
 }
 
@@ -285,11 +286,12 @@ out_unlock:
 static void sctp_generate_timeout_event(struct sctp_association *asoc,
 					sctp_event_timeout_t timeout_type)
 {
-	struct net *net = sock_net(asoc->base.sk);
+	struct sock *sk = asoc->base.sk;
+	struct net *net = sock_net(sk);
 	int error = 0;
 
-	bh_lock_sock(asoc->base.sk);
-	if (sock_owned_by_user(asoc->base.sk)) {
+	bh_lock_sock(sk);
+	if (sock_owned_by_user(sk)) {
 		pr_debug("%s: sock is busy: timer %d\n", __func__,
 			 timeout_type);
 
@@ -312,10 +314,10 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
 			   (void *)timeout_type, GFP_ATOMIC);
 
 	if (error)
-		asoc->base.sk->sk_err = -error;
+		sk->sk_err = -error;
 
 out_unlock:
-	bh_unlock_sock(asoc->base.sk);
+	bh_unlock_sock(sk);
 	sctp_association_put(asoc);
 }
 
@@ -365,10 +367,11 @@ void sctp_generate_heartbeat_event(unsigned long data)
 	int error = 0;
 	struct sctp_transport *transport = (struct sctp_transport *) data;
 	struct sctp_association *asoc = transport->asoc;
-	struct net *net = sock_net(asoc->base.sk);
+	struct sock *sk = asoc->base.sk;
+	struct net *net = sock_net(sk);
 
-	bh_lock_sock(asoc->base.sk);
-	if (sock_owned_by_user(asoc->base.sk)) {
+	bh_lock_sock(sk);
+	if (sock_owned_by_user(sk)) {
 		pr_debug("%s: sock is busy\n", __func__);
 
 		/* Try again later.  */
@@ -389,10 +392,10 @@ void sctp_generate_heartbeat_event(unsigned long data)
 			   transport, GFP_ATOMIC);
 
 	 if (error)
-		 asoc->base.sk->sk_err = -error;
+		sk->sk_err = -error;
 
 out_unlock:
-	bh_unlock_sock(asoc->base.sk);
+	bh_unlock_sock(sk);
 	sctp_transport_put(transport);
 }
 
@@ -403,10 +406,11 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 {
 	struct sctp_transport *transport = (struct sctp_transport *) data;
 	struct sctp_association *asoc = transport->asoc;
-	struct net *net = sock_net(asoc->base.sk);
+	struct sock *sk = asoc->base.sk;
+	struct net *net = sock_net(sk);
 
-	bh_lock_sock(asoc->base.sk);
-	if (sock_owned_by_user(asoc->base.sk)) {
+	bh_lock_sock(sk);
+	if (sock_owned_by_user(sk)) {
 		pr_debug("%s: sock is busy\n", __func__);
 
 		/* Try again later.  */
@@ -427,7 +431,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 		   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
 
 out_unlock:
-	bh_unlock_sock(asoc->base.sk);
+	bh_unlock_sock(sk);
 	sctp_association_put(asoc);
 }
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread


Thread

[3.16.y-ckt stable] Linux 3.16.7-ckt24 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 179/180] cifs: Ratelimit kernel log messages Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 017/180] xen-netfront: print correct number of queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 168/180] batman-adv: Drop immediate batadv_neigh_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 159/180] um: Fix build error and kconfig for i386 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 120/180] crypto: af_alg - Disallow bind/setkey/... after accept(2) Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 170/180] batman-adv: Drop immediate batadv_hard_iface free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 057/180] rtlwifi: rtl8192cu: Add missing parameter setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 105/180] cifs: fix race between call_async() and reconnect() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 046/180] arm64: kernel: enforce pmuserenr_el0 initialization and restore Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 050/180] udf: limit the maximum number of indirect extents in a row Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 020/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 156/180] power: test_power: correctly handle empty writes Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 160/180] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 055/180] rtlwifi: rtl8192se: Fix module parameter initialization Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 010/180] bonding: Prevent IPv6 link local address on enslaved devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 071/180] x86/xen: don't reset vcpu_info on a cancelled suspend Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 098/180] x86/mm: Improve switch_mm() barrier comments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 082/180] drm/nouveau/kms: take mode_config mutex in connector hotplug path Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 112/180] zram/zcomp: use GFP_NOIO to allocate streams Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 025/180] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 004/180] connector: bump skb->users before callback invocation Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 006/180] bridge: Only call /sbin/bridge-stp for the initial network namespace Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 092/180] ALSA: seq: Fix race at timer setup and close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 171/180] batman-adv: Drop immediate orig_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 180/180] HID: usbhid: fix recursive deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 040/180] powerpc: Make value-returning atomics fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 149/180] mtd: nand: remove unused and buggy get_platform_nandchip() helper function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 001/180] drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 036/180] EDAC: Fix the leak of mci->bus->name when bus_register fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 014/180] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 096/180] scripts/recordmcount.pl: support data in text section on powerpc Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 077/180] locks: fix unlock when fcntl_setlk races with a close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 054/180] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 030/180] xhci: refuse loading if nousb is used Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 143/180] SCSI: initio: remove duplicate module device table Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
  [PATCH 3.16.y-ckt 155/180] perf/x86: Fix filter_events() bug with event mappings Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 162/180] Btrfs: clean up an error code in btrfs_init_space_info() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 164/180] batman-adv: Avoid recursive call_rcu for batadv_bla_claim Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 175/180] net/mlx4: Remove unused macro Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 174/180] IB/mlx4: Initialize hop_limit when creating address handle Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 157/180] firmware: actually return NULL on failed request_firmware_nowait() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 163/180] bridge: fix lockdep addr_list_lock false positive splat Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 165/180] batman-adv: Avoid recursive call_rcu for batadv_nc_node Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 166/180] batman-adv: fix potential TT client + orig-node memory leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 167/180] batman-adv: Drop immediate batadv_orig_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 176/180] arm64: fix building without CONFIG_UID16 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 173/180] mmc: debugfs: correct wrong voltage value Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 161/180] mmc: sd: limit SD card power limit according to cards capabilities Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 154/180] kconfig: return 'false' instead of 'no' in bool function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 169/180] batman-adv: Drop immediate neigh_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 153/180] sysrq: Fix warning in sysrq generated crash. Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 152/180] x86/LDT: Print the real LDT base address Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 172/180] printk: help pr_debug and pr_devel to optimize out arguments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 158/180] target: Fix a memory leak in target_dev_lba_map_store() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 177/180] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 178/180] openrisc: fix CONFIG_UID16 setting Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
  [PATCH 3.16.y-ckt 151/180] pinctrl: bcm2835: Fix memory leak in error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 141/180] drm/i915: On fb alloc failure, unref gem object where it gets refed Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 145/180] clk: st: avoid uninitialized variable use Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 144/180] clk: xgene: Fix divider with non-zero shift value Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 147/180] mtd: nand: fix ONFI parameter page layout Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 146/180] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 148/180] mtd: nand: denali: add missing nand_release() call in denali_remove() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
  [PATCH 3.16.y-ckt 138/180] MAINTAINERS: return arch/sh to maintained state, with new maintainers Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 142/180] [media] rc: allow rc modules to be loaded if rc-main is not a module Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 134/180] ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 133/180] IB/qib: Support creating qps with GFP_NOIO flag Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 052/180] USB: cp210x: add ID for ELV Marble Sound Board 1 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 140/180] drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 139/180] ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 137/180] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 135/180] iscsi-target: Fix potential dead-lock during node acl delete Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 129/180] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 136/180] ALSA: timer: Handle disconnection more safely Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
  [PATCH 3.16.y-ckt 115/180] memcg: only free spare array when readers are done Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 127/180] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 118/180] printk: do cond_resched() between lines while outputting to consoles Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 110/180] ocfs2/dlm: ignore cleaning the migration mle that is inuse Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 107/180] m32r: fix m32104ut_defconfig build fail Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 124/180] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 111/180] ALSA: timer: Harden slave timer list handling Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 132/180] IB/qib: fix mcast detach when qp not attached Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 117/180] kernel/panic.c: turn off locks debug before releasing console lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 114/180] mm: soft-offline: check return value in second __get_any_page() call Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 083/180] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 123/180] crypto: hash - Add crypto_ahash_has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 128/180] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 116/180] panic: release stale console lock to always get the logbuf printed out Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 126/180] ALSA: hrtimer: Fix stall by hrtimer_cancel() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 119/180] ALSA: hda - Fix bass pin fixup for ASUS N550JX Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 122/180] crypto: af_alg - Add nokey compatibility path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 130/180] crypto: algif_skcipher - Load TX SG list after waiting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 131/180] crypto: crc32c - Fix crc32c soft dependency Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 125/180] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 113/180] zram: try vmalloc() after kmalloc() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 121/180] crypto: af_alg - Fix socket double-free when accept fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 090/180] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
  [PATCH 3.16.y-ckt 093/180] virtio_balloon: fix race by fill and leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 084/180] x86/boot: Double BOOT_HEAP_SIZE to 64KB Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 087/180] xfs: handle dquot buffer readahead in log recovery correctly Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 103/180] ALSA: timer: Fix race among timer ioctls Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 075/180] PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 095/180] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 094/180] virtio_balloon: fix race between migration and ballooning Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 104/180] sparc64: fix incorrect sign extension in sys_sparc64_personality Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 085/180] s390: fix normalization bug in exception table sorting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 088/180] clocksource/drivers/vt8500: Increase the minimum delta Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 100/180] dmaengine: dw: fix cyclic transfer setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 091/180] ALSA: seq: Fix missing NULL check at remove_events ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 101/180] dmaengine: dw: fix cyclic transfer callbacks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 097/180] powerpc/module: Handle R_PPC64_ENTRY relocations Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 108/180] dma-debug: switch check from _text to _stext Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 106/180] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 089/180] Input: elantech - mark protocols v2 and v3 as semi-mt Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 078/180] ASoC: compress: Fix compress device direction check Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 102/180] mmc: mmci: fix an ages old detection error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 086/180] xfs: inode recovery readahead can race with inode buffer creation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 109/180] scripts/bloat-o-meter: fix python3 syntax error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
  [PATCH 3.16.y-ckt 068/180] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 079/180] dm snapshot: fix hung bios when copy error occurs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 067/180] bcache: Change refill_dirty() to always scan entire disk if necessary Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 069/180] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 072/180] udf: Prevent buffer overrun with multi-byte characters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 070/180] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 073/180] udf: Check output buffer length when converting name to CS0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 076/180] iwlwifi: update and fix 7265 series PCI IDs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 080/180] uml: fix hostfs mknod() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 074/180] PCI: Fix minimum allocation address overwrite Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 081/180] uml: flush stdout before forking Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
  [PATCH 3.16.y-ckt 060/180] bcache: fix a livelock when we cause a huge number of cache misses Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 065/180] bcache: allows use of register in udev to avoid "device_busy" error. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 047/180] drm/radeon: clean up fujitsu quirks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 064/180] bcache: unregister reboot notifier if bcache fails to unregister device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 056/180] rtlwifi: rtl8192ce: Fix handling of module parameters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 063/180] bcache: fix a leak in bch_cached_dev_run() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 049/180] mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 058/180] NFSv4: Don't perform cached access checks before we've OPENed the file Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 062/180] bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 044/180] futex: Drop refcount if requeue_pi() acquired the rtmutex Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 066/180] bcache: prevent crash on changing writeback_running Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 053/180] posix-clock: Fix return code on the poll method's error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 048/180] mmc: sdio: Fix invalid vdd in voltage switch power cycle Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 042/180] dm space map metadata: remove unused variable in brb_pop() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 061/180] bcache: Add a cond_resched() call to gc Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 059/180] NFS: Fix attribute cache revalidation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 051/180] nfs: Fix race in __update_open_stateid() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
  [PATCH 3.16.y-ckt 016/180] xen-netfront: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 028/180] KVM: x86: correctly print #AC in traces Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 022/180] sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 029/180] drm/radeon: call hpd_irq_event on resume Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 021/180] sctp: convert sack_needed and sack_generation to bits Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 039/180] arm64: mm: ensure that the zero page is visible to the page table walker Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 026/180] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 015/180] xen-netback: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 035/180] wlcore/wl12xx: spi: fix oops on firmware load Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 023/180] nfs: Fix unused variable error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 041/180] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 031/180] arm64: Clear out any singlestep state on a ptrace detach operation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 024/180] [media] gspca: ov534/topro: prevent a division by 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 034/180] rtlwifi: fix memory leak for USB device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 043/180] dm thin: fix race condition when destroying thin pool workqueue Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 045/180] arm64: mdscr_el1: avoid exposing DCC to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 033/180] Bluetooth: Add support of Toshiba Broadcom based devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 032/180] time: Avoid signed overflow in timekeeping_get_ns() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 027/180] KVM: x86: expose MSR_TSC_AUX to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 018/180] xen-netfront: update num_queues to real created Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 038/180] EDAC: Robustify workqueues destruction Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 037/180] EDAC, mc_sysfs: Fix freeing bus' name Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 019/180] xfrm: dst_entries_init() per-net dst_ops Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
  [PATCH 3.16.y-ckt 011/180] phonet: properly unshare skbs in phonet_rcv() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 009/180] tcp_yeah: don't set ssthresh below 2 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 012/180] net: bpf: reject invalid shifts Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 003/180] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 007/180] vxlan: fix test which detect duplicate vxlan iface Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 013/180] ipv6: update skb->csum when CE mark is propagated Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 005/180] unix: properly account for FDs passed over unix sockets Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 002/180] veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
  [PATCH 3.16.y-ckt 008/180] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100

csiph-web