From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kuee K1r0a <liulin063@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
John Fastabend <john.fastabend@gmail.com>
Subject: [PATCH 5.18 017/112] bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals
Date: Mon, 11 Jul 2022 11:06:17 +0200 [thread overview]
Message-ID: <20220711090550.048634501@linuxfoundation.org> (raw)
In-Reply-To: <20220711090549.543317027@linuxfoundation.org>
From: Daniel Borkmann <daniel@iogearbox.net>
commit 3844d153a41adea718202c10ae91dc96b37453b5 upstream.
Kuee reported a corner case where the tnum becomes constant after the call
to __reg_bound_offset(), but the register's bounds are not, that is, its
min bounds are still not equal to the register's max bounds.
This in turn allows to leak pointers through turning a pointer register as
is into an unknown scalar via adjust_ptr_min_max_vals().
Before:
func#0 @0
0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
0: (b7) r0 = 1 ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))
1: (b7) r3 = 0 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))
2: (87) r3 = -r3 ; R3_w=scalar()
3: (87) r3 = -r3 ; R3_w=scalar()
4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)
5: (75) if r3 s>= 0x0 goto pc+1 ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)
6: (95) exit
from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
7: (d5) if r3 s<= 0x8000 goto pc+1 ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)
8: (95) exit
from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
9: (07) r3 += -32767 ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)) <--- [*]
10: (95) exit
What can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff;
0x8000)) after the operation R3 += -32767 results in a 'malformed' constant, that
is, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has
not been done at that point via __update_reg_bounds(), which would have improved
the umax to be equal to umin.
Refactor the tnum <> min/max bounds information flow into a reg_bounds_sync()
helper and use it consistently everywhere. After the fix, bounds have been
corrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register
is regarded as a 'proper' constant scalar of 0.
After:
func#0 @0
0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
0: (b7) r0 = 1 ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))
1: (b7) r3 = 0 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))
2: (87) r3 = -r3 ; R3_w=scalar()
3: (87) r3 = -r3 ; R3_w=scalar()
4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)
5: (75) if r3 s>= 0x0 goto pc+1 ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)
6: (95) exit
from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
7: (d5) if r3 s<= 0x8000 goto pc+1 ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)
8: (95) exit
from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))
9: (07) r3 += -32767 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) <--- [*]
10: (95) exit
Fixes: b03c9f9fdc37 ("bpf/verifier: track signed and unsigned min/max values")
Reported-by: Kuee K1r0a <liulin063@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20220701124727.11153-2-daniel@iogearbox.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 72 +++++++++++++++-----------------------------------
1 file changed, 23 insertions(+), 49 deletions(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1417,6 +1417,21 @@ static void __reg_bound_offset(struct bp
reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off);
}
+static void reg_bounds_sync(struct bpf_reg_state *reg)
+{
+ /* We might have learned new bounds from the var_off. */
+ __update_reg_bounds(reg);
+ /* We might have learned something about the sign bit. */
+ __reg_deduce_bounds(reg);
+ /* We might have learned some bits from the bounds. */
+ __reg_bound_offset(reg);
+ /* Intersecting with the old var_off might have improved our bounds
+ * slightly, e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+ * then new var_off is (0; 0x7f...fc) which improves our umax.
+ */
+ __update_reg_bounds(reg);
+}
+
static bool __reg32_bound_s64(s32 a)
{
return a >= 0 && a <= S32_MAX;
@@ -1458,16 +1473,8 @@ static void __reg_combine_32_into_64(str
* so they do not impact tnum bounds calculation.
*/
__mark_reg64_unbounded(reg);
- __update_reg_bounds(reg);
}
-
- /* Intersecting with the old var_off might have improved our bounds
- * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
- * then new var_off is (0; 0x7f...fc) which improves our umax.
- */
- __reg_deduce_bounds(reg);
- __reg_bound_offset(reg);
- __update_reg_bounds(reg);
+ reg_bounds_sync(reg);
}
static bool __reg64_bound_s32(s64 a)
@@ -1483,7 +1490,6 @@ static bool __reg64_bound_u32(u64 a)
static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
{
__mark_reg32_unbounded(reg);
-
if (__reg64_bound_s32(reg->smin_value) && __reg64_bound_s32(reg->smax_value)) {
reg->s32_min_value = (s32)reg->smin_value;
reg->s32_max_value = (s32)reg->smax_value;
@@ -1492,14 +1498,7 @@ static void __reg_combine_64_into_32(str
reg->u32_min_value = (u32)reg->umin_value;
reg->u32_max_value = (u32)reg->umax_value;
}
-
- /* Intersecting with the old var_off might have improved our bounds
- * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
- * then new var_off is (0; 0x7f...fc) which improves our umax.
- */
- __reg_deduce_bounds(reg);
- __reg_bound_offset(reg);
- __update_reg_bounds(reg);
+ reg_bounds_sync(reg);
}
/* Mark a register as having a completely unknown (scalar) value. */
@@ -6485,9 +6484,7 @@ static void do_refine_retval_range(struc
ret_reg->s32_max_value = meta->msize_max_value;
ret_reg->smin_value = -MAX_ERRNO;
ret_reg->s32_min_value = -MAX_ERRNO;
- __reg_deduce_bounds(ret_reg);
- __reg_bound_offset(ret_reg);
- __update_reg_bounds(ret_reg);
+ reg_bounds_sync(ret_reg);
}
static int
@@ -7693,11 +7690,7 @@ static int adjust_ptr_min_max_vals(struc
if (!check_reg_sane_offset(env, dst_reg, ptr_reg->type))
return -EINVAL;
-
- __update_reg_bounds(dst_reg);
- __reg_deduce_bounds(dst_reg);
- __reg_bound_offset(dst_reg);
-
+ reg_bounds_sync(dst_reg);
if (sanitize_check_bounds(env, insn, dst_reg) < 0)
return -EACCES;
if (sanitize_needed(opcode)) {
@@ -8435,10 +8428,7 @@ static int adjust_scalar_min_max_vals(st
/* ALU32 ops are zero extended into 64bit register */
if (alu32)
zext_32_to_64(dst_reg);
-
- __update_reg_bounds(dst_reg);
- __reg_deduce_bounds(dst_reg);
- __reg_bound_offset(dst_reg);
+ reg_bounds_sync(dst_reg);
return 0;
}
@@ -8627,10 +8617,7 @@ static int check_alu_op(struct bpf_verif
insn->dst_reg);
}
zext_32_to_64(dst_reg);
-
- __update_reg_bounds(dst_reg);
- __reg_deduce_bounds(dst_reg);
- __reg_bound_offset(dst_reg);
+ reg_bounds_sync(dst_reg);
}
} else {
/* case: R = imm
@@ -9233,21 +9220,8 @@ static void __reg_combine_min_max(struct
dst_reg->smax_value);
src_reg->var_off = dst_reg->var_off = tnum_intersect(src_reg->var_off,
dst_reg->var_off);
- /* We might have learned new bounds from the var_off. */
- __update_reg_bounds(src_reg);
- __update_reg_bounds(dst_reg);
- /* We might have learned something about the sign bit. */
- __reg_deduce_bounds(src_reg);
- __reg_deduce_bounds(dst_reg);
- /* We might have learned some bits from the bounds. */
- __reg_bound_offset(src_reg);
- __reg_bound_offset(dst_reg);
- /* Intersecting with the old var_off might have improved our bounds
- * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
- * then new var_off is (0; 0x7f...fc) which improves our umax.
- */
- __update_reg_bounds(src_reg);
- __update_reg_bounds(dst_reg);
+ reg_bounds_sync(src_reg);
+ reg_bounds_sync(dst_reg);
}
static void reg_combine_min_max(struct bpf_reg_state *true_src,
next prev parent reply other threads:[~2022-07-11 9:26 UTC|newest]
Thread overview: 124+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-11 9:06 [PATCH 5.18 000/112] 5.18.11-rc1 review Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 001/112] io_uring: fix provided buffer import Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 002/112] ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 003/112] ALSA: hda/realtek: Add quirk for Clevo L140PU Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 004/112] ALSA: cs46xx: Fix missing snd_card_free() call at probe error Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 005/112] can: bcm: use call_rcu() instead of costly synchronize_rcu() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 006/112] can: grcan: grcan_probe(): remove extra of_node_get() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 007/112] can: gs_usb: gs_usb_open/close(): fix memory leak Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 008/112] can: m_can: m_can_chip_config(): actually enable internal timestamping Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 009/112] can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 010/112] can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 011/112] can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 012/112] can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 013/112] can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 014/112] can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 015/112] can: mcp251xfd: mcp251xfd_stop(): add missing hrtimer_cancel() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 016/112] bpf: Fix incorrect verifier simulation around jmp32s jeq/jne Greg Kroah-Hartman
2022-07-11 9:06 ` Greg Kroah-Hartman [this message]
2022-07-11 9:06 ` [PATCH 5.18 018/112] usbnet: fix memory leak in error case Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 019/112] net: rose: fix UAF bug caused by rose_t0timer_expiry Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 020/112] net: lan966x: hardcode the number of external ports Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 021/112] netfilter: nft_set_pipapo: release elements in clone from abort path Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 022/112] netfilter: nf_tables: stricter validation of element data Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 023/112] selftests/net: fix section name when using xdp_dummy.o Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 024/112] can: mcp251xfd: mcp251xfd_register_get_dev_id(): use correct length to read dev_id Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 025/112] can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix endianness conversion Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 026/112] can: rcar_canfd: Fix data transmission failed on R-Car V3U Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 027/112] ASoC: qdsp6: q6apm-dai: unprepare stream if its already prepared Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 028/112] MAINTAINERS: Remove iommu@lists.linux-foundation.org Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 029/112] iommu/vt-d: Fix PCI bus rescan device hot add Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 030/112] iommu/vt-d: Fix RID2PASID setup/teardown failure Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 031/112] cxl/mbox: Use __le32 in get,set_lsa mailbox structures Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 032/112] cxl: Fix cleanup of port devices on failure to probe driver Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 033/112] fbdev: fbmem: Fix logo center image dx issue Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 034/112] fbmem: Check virtual screen sizes in fb_set_var() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 035/112] fbcon: Disallow setting font bigger than screen size Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 036/112] fbcon: Prevent that screen size is smaller than font size Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 037/112] PM: runtime: Redefine pm_runtime_release_supplier() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 038/112] PM: runtime: Fix supplier device management during consumer probe Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 039/112] memregion: Fix memregion_free() fallback definition Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 040/112] video: of_display_timing.h: include errno.h Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 041/112] fscache: Fix invalidation/lookup race Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 042/112] fscache: Fix if condition in fscache_wait_on_volume_collision() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 043/112] powerpc/powernv: delay rng platform device creation until later in boot Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 044/112] net: dsa: qca8k: reset cpu port on MTU change Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 045/112] ARM: meson: Fix refcount leak in meson_smp_prepare_cpus Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 046/112] pinctrl: sunxi: a83t: Fix NAND function name for some pins Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 047/112] srcu: Tighten cleanup_srcu_struct() GP checks Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 048/112] ASoC: rt711: Add endianness flag in snd_soc_component_driver Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 049/112] ASoC: rt711-sdca: " Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 050/112] ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 051/112] ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 052/112] ASoC: SOF: Intel: hda: Fix compressed stream position tracking Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 053/112] arm64: dts: qcom: sm8450: fix interconnects property of UFS node Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 054/112] arm64: dts: qcom: msm8994: Fix CPU6/7 reg values Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 055/112] arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 056/112] ARM: mxs_defconfig: Enable the framebuffer Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 057/112] arm64: dts: imx8mp-evk: correct mmc pad settings Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 058/112] arm64: dts: imx8mp-evk: correct the uart2 pinctl value Greg Kroah-Hartman
2022-07-11 9:06 ` [PATCH 5.18 059/112] arm64: dts: imx8mp-evk: correct gpio-led pad settings Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 060/112] arm64: dts: imx8mp-evk: correct vbus " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 061/112] arm64: dts: imx8mp-evk: correct eqos " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 062/112] arm64: dts: imx8mp-evk: correct I2C5 " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 063/112] arm64: dts: imx8mp-evk: correct I2C1 " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 064/112] arm64: dts: imx8mp-evk: correct I2C3 " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 065/112] arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 066/112] arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 067/112] arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 068/112] pinctrl: sunxi: sunxi_pconf_set: use correct offset Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 069/112] arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 070/112] ARM: at91: pm: use proper compatible for sama5d2s rtc Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 071/112] ARM: at91: pm: use proper compatibles for sam9x60s rtc and rtt Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 072/112] ARM: at91: pm: use proper compatibles for sama7g5s " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 073/112] ARM: dts: at91: sam9x60ek: fix eeprom compatible and size Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 074/112] ARM: dts: at91: sama5d2_icp: fix eeprom compatibles Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 075/112] ARM: at91: fix soc detection for SAM9X60 SiPs Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 076/112] xsk: Clear page contiguity bit when unmapping pool Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 077/112] i2c: piix4: Fix a memory leak in the EFCH MMIO support Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 078/112] i40e: Fix dropped jumbo frames statistics Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 079/112] i40e: Fix VFs MAC Address change on VM Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 080/112] ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 081/112] ibmvnic: Properly dispose of all skbs during a failover Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 082/112] selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 083/112] selftests: forwarding: fix learning_test when h1 " Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 084/112] selftests: forwarding: fix error message in learning_test Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 085/112] ACPI: CPPC: Check _OSC for flexible address space Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 086/112] ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 087/112] ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 088/112] ACPI: CPPC: Dont require _OSC if X86_FEATURE_CPPC is supported Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 089/112] net/mlx5e: Fix matchall police parameters validation Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 090/112] mptcp: Avoid acquiring PM lock for subflow priority changes Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 091/112] mptcp: Acquire the subflow socket lock before modifying MP_PRIO flags Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 092/112] mptcp: fix local endpoint accounting Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 093/112] r8169: fix accessing unset transport header Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 094/112] i2c: cadence: Unregister the clk notifier in error path Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 095/112] net/sched: act_api: Add extack to offload_act_setup() callback Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 096/112] net/sched: act_police: Add extack messages for offload failure Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 097/112] net/sched: act_police: allow continue action offload Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 098/112] dmaengine: imx-sdma: Allow imx8m for imx7 FW revs Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 099/112] dmaengine: imx-sdma: only restart cyclic channel when enabled Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 100/112] misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 101/112] misc: rtsx_usb: use separate command and response buffers Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 102/112] misc: rtsx_usb: set return value in rsp_buf alloc err path Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 103/112] dmaengine: dw-axi-dmac: Fix RMW on channel suspend register Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 104/112] dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 105/112] ida: dont use BUG_ON() for debugging Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 106/112] dmaengine: pl330: Fix lockdep warning about non-static key Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 107/112] dmaengine: lgm: Fix an error handling path in intel_ldma_probe() Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 108/112] dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 109/112] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 110/112] dmaengine: qcom: bam_dma: fix runtime PM underflow Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 111/112] dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate Greg Kroah-Hartman
2022-07-11 9:07 ` [PATCH 5.18 112/112] dmaengine: idxd: force wq context cleanup on device disable path Greg Kroah-Hartman
2022-07-11 15:25 ` [PATCH 5.18 000/112] 5.18.11-rc1 review Holger Hoffstätte
2022-07-11 18:58 ` Florian Fainelli
2022-07-11 20:55 ` Ron Economos
2022-07-12 1:13 ` Guenter Roeck
2022-07-12 2:34 ` Shuah Khan
2022-07-12 3:22 ` Naresh Kamboju
2022-07-12 5:03 ` Fenil Jain
2022-07-12 7:14 ` Rudi Heitbaum
2022-07-12 9:18 ` Jon Hunter
2022-07-12 12:51 ` Bagas Sanjaya
2022-07-12 14:40 ` Sudip Mukherjee (Codethink)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220711090550.048634501@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andrii@kernel.org \
--cc=daniel@iogearbox.net \
--cc=john.fastabend@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=liulin063@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.