Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1593099

[PATCH 3.12 049/113] can: Fix kernel panic at security_sock_rcv_skb

From Jiri Slaby <jslaby@suse.cz>
Newsgroups linux.kernel
Subject [PATCH 3.12 049/113] can: Fix kernel panic at security_sock_rcv_skb
Date 2017-03-06 10:40 +0100
Message-ID <thXhy-6bZ-67@gated-at.bofh.it> (permalink)
References <thWY9-64J-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


From: Eric Dumazet <edumazet@google.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit f1712c73714088a7252d276a57126d56c7d37e64 ]

Zhang Yanmin reported crashes [1] and provided a patch adding a
synchronize_rcu() call in can_rx_unregister()

The main problem seems that the sockets themselves are not RCU
protected.

If CAN uses RCU for delivery, then sockets should be freed only after
one RCU grace period.

Recent kernels could use sock_set_flag(sk, SOCK_RCU_FREE), but let's
ease stable backports with the following fix instead.

[1]
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff81495e25>] selinux_socket_sock_rcv_skb+0x65/0x2a0

Call Trace:
 <IRQ>
 [<ffffffff81485d8c>] security_sock_rcv_skb+0x4c/0x60
 [<ffffffff81d55771>] sk_filter+0x41/0x210
 [<ffffffff81d12913>] sock_queue_rcv_skb+0x53/0x3a0
 [<ffffffff81f0a2b3>] raw_rcv+0x2a3/0x3c0
 [<ffffffff81f06eab>] can_rcv_filter+0x12b/0x370
 [<ffffffff81f07af9>] can_receive+0xd9/0x120
 [<ffffffff81f07beb>] can_rcv+0xab/0x100
 [<ffffffff81d362ac>] __netif_receive_skb_core+0xd8c/0x11f0
 [<ffffffff81d36734>] __netif_receive_skb+0x24/0xb0
 [<ffffffff81d37f67>] process_backlog+0x127/0x280
 [<ffffffff81d36f7b>] net_rx_action+0x33b/0x4f0
 [<ffffffff810c88d4>] __do_softirq+0x184/0x440
 [<ffffffff81f9e86c>] do_softirq_own_stack+0x1c/0x30
 <EOI>
 [<ffffffff810c76fb>] do_softirq.part.18+0x3b/0x40
 [<ffffffff810c8bed>] do_softirq+0x1d/0x20
 [<ffffffff81d30085>] netif_rx_ni+0xe5/0x110
 [<ffffffff8199cc87>] slcan_receive_buf+0x507/0x520
 [<ffffffff8167ef7c>] flush_to_ldisc+0x21c/0x230
 [<ffffffff810e3baf>] process_one_work+0x24f/0x670
 [<ffffffff810e44ed>] worker_thread+0x9d/0x6f0
 [<ffffffff810e4450>] ? rescuer_thread+0x480/0x480
 [<ffffffff810ebafc>] kthread+0x12c/0x150
 [<ffffffff81f9ccef>] ret_from_fork+0x3f/0x70

Reported-by: Zhang Yanmin <yanmin.zhang@intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 include/linux/can/core.h |  7 +++----
 net/can/af_can.c         | 12 ++++++++++--
 net/can/af_can.h         |  3 ++-
 net/can/bcm.c            |  4 ++--
 net/can/gw.c             |  2 +-
 net/can/raw.c            |  4 ++--
 6 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 78c6c52073ad..6bdc00b6df01 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -45,10 +45,9 @@ struct can_proto {
 extern int  can_proto_register(const struct can_proto *cp);
 extern void can_proto_unregister(const struct can_proto *cp);
 
-extern int  can_rx_register(struct net_device *dev, canid_t can_id,
-			    canid_t mask,
-			    void (*func)(struct sk_buff *, void *),
-			    void *data, char *ident);
+int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
+		    void (*func)(struct sk_buff *, void *),
+		    void *data, char *ident, struct sock *sk);
 
 extern void can_rx_unregister(struct net_device *dev, canid_t can_id,
 			      canid_t mask,
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 5a668268f7ff..86f88598a102 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -425,6 +425,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  * @func: callback function on filter match
  * @data: returned parameter for callback function
  * @ident: string for calling module indentification
+ * @sk: socket pointer (might be NULL)
  *
  * Description:
  *  Invokes the callback function with the received sk_buff and the given
@@ -448,7 +449,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  */
 int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
 		    void (*func)(struct sk_buff *, void *), void *data,
-		    char *ident)
+		    char *ident, struct sock *sk)
 {
 	struct receiver *r;
 	struct hlist_head *rl;
@@ -476,6 +477,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
 		r->func    = func;
 		r->data    = data;
 		r->ident   = ident;
+		r->sk      = sk;
 
 		hlist_add_head_rcu(&r->list, rl);
 		d->entries++;
@@ -500,8 +502,11 @@ EXPORT_SYMBOL(can_rx_register);
 static void can_rx_delete_receiver(struct rcu_head *rp)
 {
 	struct receiver *r = container_of(rp, struct receiver, rcu);
+	struct sock *sk = r->sk;
 
 	kmem_cache_free(rcv_cache, r);
+	if (sk)
+		sock_put(sk);
 }
 
 /**
@@ -576,8 +581,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
 	spin_unlock(&can_rcvlists_lock);
 
 	/* schedule the receiver item for deletion */
-	if (r)
+	if (r) {
+		if (r->sk)
+			sock_hold(r->sk);
 		call_rcu(&r->rcu, can_rx_delete_receiver);
+	}
 }
 EXPORT_SYMBOL(can_rx_unregister);
 
diff --git a/net/can/af_can.h b/net/can/af_can.h
index 1dccb4c33894..0e95be423587 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -50,13 +50,14 @@
 
 struct receiver {
 	struct hlist_node list;
-	struct rcu_head rcu;
 	canid_t can_id;
 	canid_t mask;
 	unsigned long matches;
 	void (*func)(struct sk_buff *, void *);
 	void *data;
 	char *ident;
+	struct sock *sk;
+	struct rcu_head rcu;
 };
 
 enum { RX_ERR, RX_ALL, RX_FIL, RX_INV, RX_EFF, RX_MAX };
diff --git a/net/can/bcm.c b/net/can/bcm.c
index e845618f53dd..d64e8bab7c1a 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1178,7 +1178,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 				err = can_rx_register(dev, op->can_id,
 						      REGMASK(op->can_id),
 						      bcm_rx_handler, op,
-						      "bcm");
+						      "bcm", sk);
 
 				op->rx_reg_dev = dev;
 				dev_put(dev);
@@ -1187,7 +1187,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		} else
 			err = can_rx_register(NULL, op->can_id,
 					      REGMASK(op->can_id),
-					      bcm_rx_handler, op, "bcm");
+					      bcm_rx_handler, op, "bcm", sk);
 		if (err) {
 			/* this bcm rx op is broken -> remove it */
 			list_del(&op->list);
diff --git a/net/can/gw.c b/net/can/gw.c
index 233ce53c1852..3ce56716041d 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -441,7 +441,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
 {
 	return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
 			       gwj->ccgw.filter.can_mask, can_can_gw_rcv,
-			       gwj, "gw");
+			       gwj, "gw", NULL);
 }
 
 static inline void cgw_unregister_filter(struct cgw_job *gwj)
diff --git a/net/can/raw.c b/net/can/raw.c
index e10699cc72bd..65a0553bc14b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -168,7 +168,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
 	for (i = 0; i < count; i++) {
 		err = can_rx_register(dev, filter[i].can_id,
 				      filter[i].can_mask,
-				      raw_rcv, sk, "raw");
+				      raw_rcv, sk, "raw", sk);
 		if (err) {
 			/* clean up successfully registered filters */
 			while (--i >= 0)
@@ -189,7 +189,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
 
 	if (err_mask)
 		err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
-				      raw_rcv, sk, "raw");
+				      raw_rcv, sk, "raw", sk);
 
 	return err;
 }
-- 
2.12.0

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.12 000/113] 3.12.71-stable review Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
  [PATCH 3.12 001/113] x86/Kconfig: Simplify X86_IO_APIC dependencies Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 092/113] ocfs2: do not write error flag to user structure we cannot copy from/to Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 111/113] USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 089/113] af_packet: remove a stray tab in packet_set_ring() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 103/113] ipv6: simplify detection of first operational link-local address on interface Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 102/113] net: 6lowpan: fix lowpan_header_create non-compression memcpy call Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 109/113] net: filter: x86: fix JIT address randomization Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 065/113] vfs: fix uninitialized flags in splice_to_pipe() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 077/113] tty: serial: msm: Fix module autoload Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 063/113] l2tp: do not use udp_ioctl() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 068/113] futex: Move futex_init() to core_initcall Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 076/113] net: socket: fix recvmmsg not returning error from sock_error Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 080/113] USB: serial: ftdi_sio: fix modem-status error handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 090/113] ext4: validate s_first_meta_bg at mount time Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 088/113] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 096/113] drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 086/113] x86/platform/goldfish: Prevent unconditional loading Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 074/113] dccp: fix freeing skb too early for IPV6_RECVPKTINFO Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 075/113] irda: Fix lockdep annotations in hashbin_delete(). Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 082/113] USB: serial: ftdi_sio: fix line-status over-reporting Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 059/113] macvtap: read vnet_hdr_size once Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 091/113] ext4: fix fencepost in s_first_meta_bg validation Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 097/113] cpufreq: fix garbage kobjects on errors during suspend/resume Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 099/113] cpufreq: Clean up after a failing light-weight initialization Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 061/113] packet: round up linear to header len Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 081/113] USB: serial: ftdi_sio: fix extreme low-latency setting Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 070/113] rtc: interface: ignore expired timers when enqueuing new timers Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 060/113] sctp: avoid BUG_ON on sctp_wait_for_sndbuf Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 084/113] USB: serial: opticon: fix CTS retrieval at open Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 057/113] tcp: avoid infinite loop in tcp_splice_read() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 071/113] net/llc: avoid BUG_ON() in skb_orphan() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 079/113] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 085/113] USB: serial: ark3116: fix register-accessor error handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 095/113] Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 069/113] printk: use rcuidle console tracepoint Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 062/113] ping: fix a null pointer dereference Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 064/113] scsi: move the nr_phys_segments assert into scsi_init_io Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 072/113] packet: fix races in fanout_add() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 073/113] packet: Do not call fanout_release from atomic contexts Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 058/113] tun: read vnet_hdr_sz once Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 083/113] USB: serial: spcp8x5: fix modem-status handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 078/113] USB: serial: mos7840: fix another NULL-deref at open Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 087/113] goldfish: Sanitize the broken interrupt handler Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
    [PATCH 3.12 023/113] USB: serial: option: add WeTelecom 0x6802 and 0x6803 products Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 037/113] USB: serial: option: add device ID for HP lt2523 (Novatel E371) Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 042/113] mac80211: Fix adding of mesh vendor IEs Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 050/113] ipv6: fix ip6_tnl_parse_tlv_enc_lim() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 034/113] USB: serial: qcserial: add Dell DW5570 QDL Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 055/113] netlabel: out of bound access in cipso_v4_validate() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 040/113] ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 036/113] USB: Add quirk for WORLDE easykey.25 MIDI keyboard Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 041/113] target: Fix COMPARE_AND_WRITE ref leak for non GOOD status Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 051/113] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 054/113] ipv4: keep skb->dst around in presence of IP options Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 043/113] scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 067/113] scsi: don't BUG_ON() empty DMA transfers Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 026/113] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 022/113] USB: serial: option: add WeTelecom WM-D200 Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 053/113] net: use a work queue to defer net_disable_timestamp() work Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 029/113] svcrpc: fix oops in absence of krb5 module Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 033/113] can: bcm: fix hrtimer/tasklet termination in bcm op removal Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 066/113] siano: make it work again with CONFIG_VMAP_STACK Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 039/113] selinux: fix off-by-one in setprocattr Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 056/113] ip6_gre: fix ip6gre_err() invalid reads Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 049/113] can: Fix kernel panic at security_sock_rcv_skb Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 044/113] ALSA: seq: Fix race at creating a queue Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 035/113] USB: serial: pl2303: add ATEN device ID Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 032/113] mm, fs: check for fatal signals in do_generic_file_read() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 021/113] qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 031/113] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 025/113] USB: serial: option: add even more ZTE device ids Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 038/113] ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 052/113] tcp: fix 0 divide in __tcp_select_window() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
    [PATCH 3.12 007/113] ISDN: eicon: silence misleading array-bounds warning Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 012/113] nfs: Don't increment lock sequence ID after NFS4ERR_MOVED Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 011/113] parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 018/113] ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 020/113] af_unix: move unix_mknod() out of bindlock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 009/113] can: ti_hecc: add missing prepare and unprepare of the clock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 016/113] platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 008/113] can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 014/113] drm/i915: Don't leak edid in intel_crt_detect_ddc() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 019/113] tcp: initialize max window for a new fastopen socket Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 015/113] s5k4ecgx: select CRC32 helper Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 003/113] net: possible use after free in dst_release Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 010/113] ARC: [arcompact] handle unaligned access delay slot corner case Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 013/113] SUNRPC: cleanup ida information when removing sunrpc module Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 017/113] net: fix harmonize_features() vs NETIF_F_HIGHDMA Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    [PATCH 3.12 002/113] crypto: caam - fix non-hmac hashes Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
  Re: [PATCH 3.12 000/113] 3.12.71-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-06 15:50 +0100
    Re: [PATCH 3.12 000/113] 3.12.71-stable review Jiri Slaby <jslaby@suse.cz> - 2017-03-09 21:00 +0100
  Re: [PATCH 3.12 000/113] 3.12.71-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-06 20:30 +0100

csiph-web