[PATCH 4.4 036/117] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.4 036/117] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
Date	2016-02-15 01:50 +0100
Message-ID	<r2fww-1Sa-39@gated-at.bofh.it> (permalink)
References	<r2dl0-tX-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 06ab30034ed9c200a570ab13c017bde248ddb2a6 upstream.

A kernel WARNING in snd_rawmidi_transmit_ack() is triggered by
syzkaller fuzzer:
  WARNING: CPU: 1 PID: 20739 at sound/core/rawmidi.c:1136
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff84f80bd5>] snd_rawmidi_transmit_ack+0x275/0x400 sound/core/rawmidi.c:1136
 [<ffffffff84fdb3c1>] snd_virmidi_output_trigger+0x4b1/0x5a0 sound/core/seq/seq_virmidi.c:163
 [<     inline     >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150
 [<ffffffff84f87ed9>] snd_rawmidi_kernel_write1+0x549/0x780 sound/core/rawmidi.c:1223
 [<ffffffff84f89fd3>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273
 [<ffffffff817b0323>] __vfs_write+0x113/0x480 fs/read_write.c:528
 [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577
 [<     inline     >] SYSC_write fs/read_write.c:624
 [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616
 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185

Also a similar warning is found but in another path:
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82be2c0d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81355139>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff81355369>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff8527e69a>] rawmidi_transmit_ack+0x24a/0x3b0 sound/core/rawmidi.c:1133
 [<ffffffff8527e851>] snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1163
 [<ffffffff852d9046>] snd_virmidi_output_trigger+0x2b6/0x570 sound/core/seq/seq_virmidi.c:185
 [<     inline     >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150
 [<ffffffff85285a0b>] snd_rawmidi_kernel_write1+0x4bb/0x760 sound/core/rawmidi.c:1252
 [<ffffffff85287b73>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1302
 [<ffffffff817ba5f3>] __vfs_write+0x113/0x480 fs/read_write.c:528
 [<ffffffff817bc087>] vfs_write+0x167/0x4a0 fs/read_write.c:577
 [<     inline     >] SYSC_write fs/read_write.c:624
 [<ffffffff817bf371>] SyS_write+0x111/0x220 fs/read_write.c:616
 [<ffffffff86660276>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185

In the former case, the reason is that virmidi has an open code
calling snd_rawmidi_transmit_ack() with the value calculated outside
the spinlock.   We may use snd_rawmidi_transmit() in a loop just for
consuming the input data, but even there, there is a race between
snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack().

Similarly in the latter case, it calls snd_rawmidi_transmit_peek() and
snd_rawmidi_tranmit_ack() separately without protection, so they are
racy as well.

The patch tries to address these issues by the following ways:
- Introduce the unlocked versions of snd_rawmidi_transmit_peek() and
  snd_rawmidi_transmit_ack() to be called inside the explicit lock.
- Rewrite snd_rawmidi_transmit() to be race-free (the former case).
- Make the split calls (the latter case) protected in the rawmidi spin
  lock.

BugLink: http://lkml.kernel.org/r/CACT4Y+YPq1+cYLkadwjWa5XjzF1_Vki1eHnVn-Lm0hzhSpu5PA@mail.gmail.com
BugLink: http://lkml.kernel.org/r/CACT4Y+acG4iyphdOZx47Nyq_VHGbpJQK-6xNpiqUjaZYqsXOGw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/sound/rawmidi.h      |    4 +
 sound/core/rawmidi.c         |   98 +++++++++++++++++++++++++++++++------------
 sound/core/seq/seq_virmidi.c |   17 +++++--
 3 files changed, 88 insertions(+), 31 deletions(-)

--- a/include/sound/rawmidi.h
+++ b/include/sound/rawmidi.h
@@ -167,6 +167,10 @@ int snd_rawmidi_transmit_peek(struct snd
 int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count);
 int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
 			 unsigned char *buffer, int count);
+int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+			      unsigned char *buffer, int count);
+int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream,
+			       int count);
 
 /* main midi functions */
 
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1055,23 +1055,16 @@ int snd_rawmidi_transmit_empty(struct sn
 EXPORT_SYMBOL(snd_rawmidi_transmit_empty);
 
 /**
- * snd_rawmidi_transmit_peek - copy data from the internal buffer
+ * __snd_rawmidi_transmit_peek - copy data from the internal buffer
  * @substream: the rawmidi substream
  * @buffer: the buffer pointer
  * @count: data size to transfer
  *
- * Copies data from the internal output buffer to the given buffer.
- *
- * Call this in the interrupt handler when the midi output is ready,
- * and call snd_rawmidi_transmit_ack() after the transmission is
- * finished.
- *
- * Return: The size of copied data, or a negative error code on failure.
+ * This is a variant of snd_rawmidi_transmit_peek() without spinlock.
  */
-int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
 			      unsigned char *buffer, int count)
 {
-	unsigned long flags;
 	int result, count1;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
@@ -1081,7 +1074,6 @@ int snd_rawmidi_transmit_peek(struct snd
 		return -EINVAL;
 	}
 	result = 0;
-	spin_lock_irqsave(&runtime->lock, flags);
 	if (runtime->avail >= runtime->buffer_size) {
 		/* warning: lowlevel layer MUST trigger down the hardware */
 		goto __skip;
@@ -1106,25 +1098,47 @@ int snd_rawmidi_transmit_peek(struct snd
 		}
 	}
       __skip:
+	return result;
+}
+EXPORT_SYMBOL(__snd_rawmidi_transmit_peek);
+
+/**
+ * snd_rawmidi_transmit_peek - copy data from the internal buffer
+ * @substream: the rawmidi substream
+ * @buffer: the buffer pointer
+ * @count: data size to transfer
+ *
+ * Copies data from the internal output buffer to the given buffer.
+ *
+ * Call this in the interrupt handler when the midi output is ready,
+ * and call snd_rawmidi_transmit_ack() after the transmission is
+ * finished.
+ *
+ * Return: The size of copied data, or a negative error code on failure.
+ */
+int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+			      unsigned char *buffer, int count)
+{
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
+	result = __snd_rawmidi_transmit_peek(substream, buffer, count);
 	spin_unlock_irqrestore(&runtime->lock, flags);
 	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_transmit_peek);
 
 /**
- * snd_rawmidi_transmit_ack - acknowledge the transmission
+ * __snd_rawmidi_transmit_ack - acknowledge the transmission
  * @substream: the rawmidi substream
  * @count: the transferred count
  *
- * Advances the hardware pointer for the internal output buffer with
- * the given size and updates the condition.
- * Call after the transmission is finished.
- *
- * Return: The advanced size if successful, or a negative error code on failure.
+ * This is a variant of __snd_rawmidi_transmit_ack() without spinlock.
  */
-int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
 {
-	unsigned long flags;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
 	if (runtime->buffer == NULL) {
@@ -1132,7 +1146,6 @@ int snd_rawmidi_transmit_ack(struct snd_
 			  "snd_rawmidi_transmit_ack: output is not active!!!\n");
 		return -EINVAL;
 	}
-	spin_lock_irqsave(&runtime->lock, flags);
 	snd_BUG_ON(runtime->avail + count > runtime->buffer_size);
 	runtime->hw_ptr += count;
 	runtime->hw_ptr %= runtime->buffer_size;
@@ -1142,9 +1155,32 @@ int snd_rawmidi_transmit_ack(struct snd_
 		if (runtime->drain || snd_rawmidi_ready(substream))
 			wake_up(&runtime->sleep);
 	}
-	spin_unlock_irqrestore(&runtime->lock, flags);
 	return count;
 }
+EXPORT_SYMBOL(__snd_rawmidi_transmit_ack);
+
+/**
+ * snd_rawmidi_transmit_ack - acknowledge the transmission
+ * @substream: the rawmidi substream
+ * @count: the transferred count
+ *
+ * Advances the hardware pointer for the internal output buffer with
+ * the given size and updates the condition.
+ * Call after the transmission is finished.
+ *
+ * Return: The advanced size if successful, or a negative error code on failure.
+ */
+int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+{
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
+	result = __snd_rawmidi_transmit_ack(substream, count);
+	spin_unlock_irqrestore(&runtime->lock, flags);
+	return result;
+}
 EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
 
 /**
@@ -1160,12 +1196,22 @@ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
 int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
 			 unsigned char *buffer, int count)
 {
+	struct snd_rawmidi_runtime *runtime = substream->runtime;
+	int result;
+	unsigned long flags;
+
+	spin_lock_irqsave(&runtime->lock, flags);
 	if (!substream->opened)
-		return -EBADFD;
-	count = snd_rawmidi_transmit_peek(substream, buffer, count);
-	if (count < 0)
-		return count;
-	return snd_rawmidi_transmit_ack(substream, count);
+		result = -EBADFD;
+	else {
+		count = __snd_rawmidi_transmit_peek(substream, buffer, count);
+		if (count <= 0)
+			result = count;
+		else
+			result = __snd_rawmidi_transmit_ack(substream, count);
+	}
+	spin_unlock_irqrestore(&runtime->lock, flags);
+	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_transmit);
 
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(s
 	struct snd_virmidi *vmidi = substream->runtime->private_data;
 	int count, res;
 	unsigned char buf[32], *pbuf;
+	unsigned long flags;
 
 	if (up) {
 		vmidi->trigger = 1;
 		if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
 		    !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
-			snd_rawmidi_transmit_ack(substream, substream->runtime->buffer_size - substream->runtime->avail);
-			return;		/* ignored */
+			while (snd_rawmidi_transmit(substream, buf,
+						    sizeof(buf)) > 0) {
+				/* ignored */
+			}
+			return;
 		}
 		if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
 			if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
 				return;
 			vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 		}
+		spin_lock_irqsave(&substream->runtime->lock, flags);
 		while (1) {
-			count = snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
+			count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
 			if (count <= 0)
 				break;
 			pbuf = buf;
@@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(s
 					snd_midi_event_reset_encode(vmidi->parser);
 					continue;
 				}
-				snd_rawmidi_transmit_ack(substream, res);
+				__snd_rawmidi_transmit_ack(substream, res);
 				pbuf += res;
 				count -= res;
 				if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
 					if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
-						return;
+						goto out;
 					vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 				}
 			}
 		}
+	out:
+		spin_unlock_irqrestore(&substream->runtime->lock, flags);
 	} else {
 		vmidi->trigger = 0;
 	}

Thread

[PATCH 4.4 000/117] 4.4.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 042/117] ALSA: pcm: Fix potential deadlock in OSS emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 077/117] iommu/io-pgtable-arm: Ensure we free the final level on teardown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 074/117] tty: Wait interruptibly for tty lock on reopen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 004/117] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 046/117] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 069/117] usb: cdc-acm: send zero packet for intel 7260 modem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 005/117] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 065/117] USB: cp210x: add ID for IAI USB to RS485 adaptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 040/117] ALSA: hda/realtek - Support headset mode for ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 070/117] usb: phy: msm: fix error handling in probe. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 041/117] ALSA: hda/realtek - Support Dell headset mode for ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 007/117] block: fix bio splitting on max sectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 056/117] ALSA: hda - Fix speaker output from VAIO AiO machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 009/117] ocfs2/dlm: ignore cleaning the migration mle that is inuse Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 072/117] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 057/117] ALSA: hda - Fix bad dereference of jack object Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 044/117] ALSA: seq: Fix yet another races among ALSA timer accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100
  [PATCH 4.4 019/117] parisc: Protect huge page pte changes with spinlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 016/117] tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 002/117] NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 037/117] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 031/117] ALSA: hda - disable dynamic clock gating on Broxton before reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 020/117] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 022/117] md/raid: only permit hot-add of compatible integrity profiles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 023/117] hrtimer: Handle remaining time proper for TIME_LOW_RES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 030/117] ALSA: Add missing dependency on CONFIG_SND_TIMER Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 038/117] ALSA: rawmidi: Fix race at copying & updating the position Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 021/117] [media] media: i2c: Dont export ir-kbd-i2c module alias Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 017/117] tracing/stacktrace: Show entire trace if passed in function not found Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 033/117] ALSA: dummy: Disable switching timer backend via sysfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 034/117] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 035/117] ALSA: seq: Degrade the error message for too many opens Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 006/117] base/platform: Fix platform drivers with no probe callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 018/117] printk: do cond_resched() between lines while outputting to consoles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 036/117] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 028/117] ALSA: usb-audio: avoid freeing umidi object twice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 026/117] ALSA: usb-audio: Fix OPPO HA-1 vendor ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 003/117] block: split bios to max possible length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 039/117] ALSA: hda/realtek - New codec support of ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 027/117] ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 015/117] PCI: Fix minimum allocation address overwrite Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 010/117] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 032/117] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 025/117] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  [PATCH 4.4 013/117] mtd: nand: assign reasonable default name for NAND drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100
  Re: [PATCH 4.4 000/117] 4.4.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 17:00 +0100
  Re: [PATCH 4.4 000/117] 4.4.2-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-15 18:10 +0100

csiph-web