| 1/143 | scsi: fix missing include linux/types.h in scsi_netlink.hinclude/scsi/scsi_netlink.h | +1 -1 | 0 replies | |
| 2/143 | Fix lockup related to stop_machine being stuck in __do_softirq.kernel/softirq.c | +10 -3 | 0 replies | |
| 3/143 | Revert "x86, ptrace: fix build breakage with gcc 4.7"arch/x86/include/asm/ptrace.h | +2 -3 | 0 replies | |
| 4/143 | x86, ptrace: fix build breakage with gcc 4.7 (second try)arch/x86/include/asm/ptrace.h | +0 -3 | 0 replies | |
| 5/143 | ipvs: fix CHECKSUM_PARTIAL for TCP, UDPnet/netfilter/ipvs/ip_vs_proto_tcp.c net/netfilter/ipvs/ip_vs_proto_udp.c | +10 -10 | 0 replies | |
| 6/143 | intel-iommu: Flush unmaps at domain_exitdrivers/pci/intel-iommu.c | +4 -0 | 0 replies | |
| 7/143 | staging: comedi: ni_65xx: (bug fix) confine insn_bits to onedrivers/staging/comedi/drivers/ni_65xx.c | +11 -14 | 0 replies | |
| 8/143 | kernel/kmod.c: check for NULL in call_usermodehelper_exec()kernel/kmod.c | +4 -0 | 0 replies | |
| 9/143 | cciss: fix info leak in cciss_ioctl32_passthru()drivers/block/cciss.c | +1 -0 | 0 replies | |
| 10/143 | cpqarray: fix info leak in ida_locked_ioctl()drivers/block/cpqarray.c | +1 -0 | 0 replies | |
| 11/143 | drivers/cdrom/cdrom.c: use kzalloc() for failing hardwaredrivers/cdrom/cdrom.c | +1 -1 | 0 replies | |
| 12/143 | sctp: deal with multiple COOKIE_ECHO chunksinclude/net/sctp/command.h net/sctp/sm_sideeffect.c net/sctp/sm_statefuns.c | +12 -0 | 0 replies | |
| 13/143 | sctp: Use correct sideffect command in duplicate cookie handlingnet/sctp/sm_statefuns.c | +1 -1 | 0 replies | |
| 14/143 | ipv6: ip6_sk_dst_check() must not assume ipv6 dstnet/ipv6/ip6_output.c | +7 -1 | 0 replies | |
| 15/143 | af_key: fix info leaks in notify messagesnet/key/af_key.c | +2 -0 | 0 replies | |
| 16/143 | af_key: initialize satype in key_notify_policy_flush()net/key/af_key.c | +1 -0 | 0 replies | |
| 17/143 | block: do not pass disk names as format stringsdrivers/block/nbd.c fs/partitions/check.c | +4 -2 | 0 replies | |
| 18/143 | b43: stop format string leaking into error msgsdrivers/net/wireless/b43/main.c | +1 -1 | 0 replies | |
| 19/143 | HID: validate HID report id sizedrivers/hid/hid-core.c include/linux/hid.h | +10 -4 | 0 replies | |
| 20/143 | HID: zeroplus: validate output report detailsdrivers/hid/hid-zpff.c | +5 -13 | 0 replies | |
| 21/143 | HID: pantherlord: validate output report detailsdrivers/hid/hid-pl.c | +8 -2 | 0 replies | |
| 22/143 | HID: LG: validate HID output report detailsdrivers/hid/hid-lg2ff.c drivers/hid/hid-lgff.c | +5 -31 | 0 replies | |
| 23/143 | HID: check for NULL field when setting valuesdrivers/hid/hid-core.c | +6 -1 | 0 replies | |
| 24/143 | HID: provide a helper for validating hid reportsdrivers/hid/hid-core.c include/linux/hid.h | +62 -0 | 0 replies | |
| 25/143 | crypto: api - Fix race condition in larval lookupcrypto/api.c | +6 -1 | 0 replies | |
| 26/143 | ipv6: tcp: fix panic in SYN processingnet/ipv6/inet6_connection_sock.c | +1 -1 | 0 replies | |
| 27/143 | tcp: must unclone packets before mangling theminclude/linux/skbuff.h net/ipv4/tcp_output.c | +16 -3 | 0 replies | |
| 28/143 | net: do not call sock_put() on TIMEWAIT socketsnet/ipv4/inet_hashtables.c net/ipv6/inet6_hashtables.c | +2 -2 | 0 replies | |
| 29/143 | net: heap overflow in __audit_sockaddr()net/compat.c net/socket.c | +22 -4 | 0 replies | |
| 30/143 | proc connector: fix info leaksdrivers/connector/cn_proc.c | +16 -0 | 5 replies | |
| 31/143 | can: dev: fix nlmsg size calculation in can_get_size()drivers/net/can/dev.c | +4 -4 | 0 replies | |
| 32/143 | net: vlan: fix nlmsg size calculation in vlan_get_size()net/8021q/vlan_netlink.c | +1 -1 | 0 replies | |
| 33/143 | farsync: fix info leak in ioctldrivers/net/wan/farsync.c | +1 -0 | 0 replies | |
| 34/143 | connector: use nlmsg_len() to check message lengthdrivers/connector/connector.c | +4 -3 | 0 replies | |
| 35/143 | net: dst: provide accessor function to dst->xfrminclude/net/dst.h | +11 -0 | 0 replies | |
| 36/143 | sctp: Use software crc32 checksum when xfrm transform will happen.net/sctp/output.c | +2 -1 | 0 replies | |
| 37/143 | sctp: Perform software checksum if packet has to be fragmented.net/sctp/output.c | +1 -1 | 0 replies | |
| 38/143 | wanxl: fix info leak in ioctldrivers/net/wan/wanxl.c | +1 -0 | 0 replies | |
| 39/143 | davinci_emac.c: Fix IFF_ALLMULTI setupdrivers/net/davinci_emac.c | +1 -1 | 0 replies | |
| 40/143 | resubmit bridge: fix message_age_timer calculationnet/bridge/br_stp.c | +1 -1 | 0 replies | |
| 41/143 | ipv6 mcast: use in6_dev_put in timer handlers instead ofnet/ipv6/mcast.c | +2 -2 | 0 replies | |
| 42/143 | ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_putnet/ipv4/igmp.c | +2 -2 | 0 replies | |
| 43/143 | dm9601: fix IFF_ALLMULTI handlingdrivers/net/usb/dm9601.c | +1 -1 | 0 replies | |
| 44/143 | bonding: Fix broken promiscuity reference counting issuedrivers/net/bonding/bond_main.c | +10 -3 | 0 replies | |
| 45/143 | ll_temac: Reset dma descriptors indexes on ndo_opendrivers/net/ll_temac_main.c | +6 -0 | 0 replies | |
| 46/143 | tcp: fix tcp_md5_hash_skb_data()net/ipv4/tcp.c | +5 -1 | 0 replies | |
| 47/143 | ipv6: fix possible crashes in ip6_cork_release()net/ipv6/ip6_output.c | +1 -1 | 0 replies | |
| 48/143 | ip_tunnel: fix kernel panic with icmp_dest_unreachnet/ipv4/ipip.c | +1 -1 | 0 replies | |
| 49/143 | net: sctp: fix NULL pointer dereference in socket destructionnet/sctp/socket.c | +6 -0 | 0 replies | |
| 50/143 | packet: packet_getname_spkt: make sure string is always 0-terminatednet/packet/af_packet.c | +3 -3 | 0 replies | |
| 51/143 | neighbour: fix a race in neigh_destroy()net/core/neighbour.c | +7 -5 | 0 replies | |
| 52/143 | net: Swap ver and type in pppoe_hdrinclude/linux/if_pppox.h | +2 -2 | 0 replies | |
| 53/143 | sunvnet: vnet_port_remove must call unregister_netdevdrivers/net/sunvnet.c | +2 -0 | 0 replies | |
| 54/143 | ifb: fix rcu_sched self-detected stallsdrivers/net/ifb.c | +4 -1 | 0 replies | |
| 55/143 | dummy: fix oops when loading the dummy faileddrivers/net/dummy.c | +4 -0 | 0 replies | |
| 56/143 | ifb: fix oops when loading the ifb faileddrivers/net/ifb.c | +4 -0 | 0 replies | |
| 57/143 | vlan: fix a race in egress prio managementnet/8021q/vlan_dev.c | +7 -0 | 0 replies | |
| 58/143 | arcnet: cleanup sizeof parameterdrivers/net/arcnet/arcnet.c | +1 -1 | 0 replies | |
| 59/143 | sysctl net: Keep tcp_syn_retries inside the boundarynet/ipv4/sysctl_net_ipv4.c | +5 -1 | 8 replies | |
| 60/143 | sctp: fully initialize sctp_outq in sctp_outq_initnet/sctp/outqueue.c | +2 -6 | 0 replies | |
| 61/143 | net_sched: Fix stack info leak in cbq_dump_wrr().net/sched/sch_cbq.c | +1 -0 | 0 replies | |
| 62/143 | af_key: more info leaks in pfkey messagesnet/key/af_key.c | +4 -0 | 0 replies | |
| 63/143 | net_sched: info leak in atm_tc_dump_class()net/sched/sch_atm.c | +1 -0 | 0 replies | |
| 64/143 | htb: fix sign extension bugnet/sched/sch_htb.c | +1 -1 | 0 replies | |
| 65/143 | net: check net.core.somaxconn sysctl valuesnet/core/sysctl_net_core.c | +6 -1 | 0 replies | |
| 66/143 | tcp: cubic: fix bug in bictcp_acked()net/ipv4/tcp_cubic.c | +1 -1 | 0 replies | |
| 67/143 | ipv6: dont stop backtracking in fib6_lookup_1 if subtree does notnet/ipv6/ip6_fib.c | +12 -4 | 0 replies | |
| 68/143 | ipv6: remove max_addresses check from ipv6_create_tempaddrnet/ipv6/addrconf.c | +4 -6 | 0 replies | |
| 69/143 | ipv6: drop packets with multiple fragmentation headersinclude/linux/ipv6.h net/ipv6/reassembly.c | +6 -0 | 0 replies | |
| 70/143 | ipv6: Dont depend on per socket memory for neighbour discoverynet/ipv6/ndisc.c | +9 -7 | 0 replies | |
| 71/143 | ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTOinclude/linux/icmpv6.h net/ipv6/icmp.c | +11 -1 | 0 replies | |
| 72/143 | tipc: fix lockdep warning during bearer initializationnet/tipc/eth_media.c | +14 -1 | 6 replies | |
| 73/143 | net: Fix "ip rule delete table 256"net/core/fib_rules.c | +2 -1 | 0 replies | |
| 74/143 | ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcvnet/ipv6/route.c | +5 -2 | 0 replies | |
| 75/143 | random32: fix off-by-one in seeding requirementlib/random32.c | +7 -7 | 0 replies | |
| 76/143 | bonding: fix two race conditions in bond_store_updelay/downdelaydrivers/net/bonding/bond_sysfs.c | +6 -0 | 0 replies | |
| 77/143 | isdnloop: use strlcpy() instead of strcpy()drivers/isdn/isdnloop/isdnloop.c | +5 -3 | 0 replies | |
| 78/143 | ipv4: fix possible seqlock deadlocknet/ipv4/datagram.c | +1 -1 | 0 replies | |
| 79/143 | inet: prevent leakage of uninitialized memory to user in recvnet/ipv4/raw.c net/ipv4/udp.c net/ipv6/raw.c +2 more | +8 -21 | 0 replies | |
| 80/143 | net: rework recvmsg handler msg_name and msg_namelen logicdrivers/isdn/mISDN/socket.c include/linux/net.h net/appletalk/ddp.c +22 more | +60 -86 | 3 replies | |
| 81/143 | net: add BUG_ON if kernel advertises msg_namelen > sizeof(structnet/socket.c | +2 -1 | 0 replies | |
| 82/143 | inet: fix addr_len/msg->msg_namelen assignment in recv_error andinclude/net/ip.h include/net/ipv6.h net/ipv4/ip_sockglue.c +5 more | +11 -8 | 0 replies | |
| 83/143 | net: clamp ->msg_namelen instead of returning an errornet/compat.c net/socket.c | +2 -2 | 2 replies | |
| 84/143 | ipv6: fix leaking uninitialized port number of offender sockaddrnet/ipv6/datagram.c | +1 -0 | 0 replies | |
| 85/143 | atm: idt77252: fix dev refcnt leakdrivers/atm/idt77252.c | +1 -0 | 0 replies | |
| 86/143 | net: core: Always propagate flag changes to interfacesnet/core/dev.c | +1 -1 | 0 replies | |
| 87/143 | bridge: flush brs address entry in fdb when remove the bridge devnet/bridge/br_if.c | +2 -0 | 0 replies | |
| 88/143 | inet: fix possible seqlock deadlocksnet/ipv4/tcp_ipv4.c net/ipv4/udp.c | +2 -2 | 0 replies | |
| 89/143 | ipv6: fix possible seqlock deadlock in ip6_finish_output2net/ipv6/ip6_output.c | +2 -2 | 0 replies | |
| 90/143 | {pktgen, xfrm} Update IPv4 header total len and checksum afternet/core/pktgen.c | +7 -0 | 0 replies | |
| 91/143 | net: drop_monitor: fix the value of maxattrnet/core/drop_monitor.c | +0 -1 | 0 replies | |
| 92/143 | net: unix: allow bind to fail on mutex locknet/unix/af_unix.c | +6 -2 | 0 replies | |
| 93/143 | drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()drivers/net/hamradio/hdlcdrv.c | +2 -0 | 0 replies | |
| 94/143 | hamradio/yam: fix info leak in ioctldrivers/net/hamradio/yam.c | +1 -0 | 0 replies | |
| 95/143 | rds: prevent dereference of a NULL devicenet/rds/ib.c | +2 -1 | 0 replies | |
| 96/143 | net: rose: restore old recvmsg behaviornet/rose/af_rose.c | +4 -12 | 0 replies | |
| 97/143 | net: llc: fix use after free in llc_ui_recvmsgnet/llc/af_llc.c | +3 -2 | 0 replies | |
| 98/143 | inet_diag: fix inet_diag_dump_icsk() timewait socket state logicnet/ipv4/inet_diag.c | +3 -1 | 0 replies | |
| 99/143 | net: fix ip rule iif/oif device renamenet/core/fib_rules.c | +7 -0 | 0 replies | |
| 100/143 | tg3: Fix deadlock in tg3_change_mtu()drivers/net/tg3.c | +2 -2 | 0 replies | |
| 101/143 | bonding: 802.3ad: make aggregator_identifier bond-privatedrivers/net/bonding/bond_3ad.c drivers/net/bonding/bond_3ad.h | +3 -4 | 0 replies | |
| 102/143 | net: sctp: fix sctp_connectx abi for ia32 emulation/compat modenet/sctp/socket.c | +32 -9 | 0 replies | |
| 103/143 | virtio-net: alloc big buffers also when guest can receive UFOdrivers/net/virtio_net.c | +2 -1 | 0 replies | |
| 104/143 | tg3: Dont check undefined error bits in RXBDdrivers/net/tg3.c drivers/net/tg3.h | +6 -3 | 0 replies | |
| 105/143 | net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTHnet/sctp/sm_statefuns.c | +7 -0 | 0 replies | |
| 106/143 | net: sctp: fix skb leakage in COOKIE ECHO path of chunk->auth_chunknet/sctp/sm_make_chunk.c net/sctp/sm_statefuns.c | +2 -6 | 0 replies | |
| 107/143 | net: socket: error on a negative msg_namelennet/socket.c | +4 -0 | 0 replies | |
| 108/143 | netlink: dont compare the nul-termination in nla_strcmplib/nlattr.c | +8 -2 | 0 replies | |
| 109/143 | isdnloop: several buffer overflowsdrivers/isdn/isdnloop/isdnloop.c | +9 -8 | 0 replies | |
| 110/143 | rds: prevent dereference of a NULL device in rds_iw_laddr_checknet/rds/iw.c | +2 -1 | 0 replies | |
| 111/143 | isdnloop: Validate NUL-terminated strings from user.drivers/isdn/isdnloop/isdnloop.c | +6 -0 | 0 replies | |
| 112/143 | sctp: unbalanced rcu lock in ip_queue_xmit()net/ipv4/ip_output.c | +1 -1 | 0 replies | |
| 113/143 | aacraid: prevent invalid pointer dereferencedrivers/scsi/aacraid/commctrl.c | +2 -1 | 0 replies | |
| 114/143 | ipv6: udp packets following an UFO enqueued packet need also benet/ipv6/ip6_output.c | +12 -19 | 0 replies | |
| 115/143 | inet: fix possible memory corruption with UDP_CORK and UFOnet/ipv4/ip_output.c net/ipv6/ip6_output.c | +2 -2 | 0 replies | |
| 116/143 | vm: add vm_iomap_memory() helper functioninclude/linux/mm.h mm/memory.c | +49 -0 | 0 replies | |
| 117/143 | Fix a few incorrectly checked [io_]remap_pfn_range() callsdrivers/uio/uio.c drivers/video/au1100fb.c drivers/video/au1200fb.c | +17 -51 | 0 replies | |
| 118/143 | libertas: potential oops in debugfsdrivers/net/wireless/libertas/debugfs.c | +5 -1 | 0 replies | |
| 119/143 | x86, fpu, amd: Clear exceptions in AMD FXSAVE workaroundarch/x86/include/asm/i387.h | +7 -6 | 0 replies | |
| 120/143 | gianfar: disable TX vlan based on kernel 2.6.xdrivers/net/gianfar.c | +1 -7 | 0 replies | |
| 121/143 | powernow-k6: set transition latency value so ondemandarch/x86/kernel/cpu/cpufreq/powernow-k6.c | +1 -1 | 0 replies | |
| 122/143 | powernow-k6: disable cache when changing frequencyarch/x86/kernel/cpu/cpufreq/powernow-k6.c | +39 -17 | 0 replies | |
| 123/143 | powernow-k6: correctly initialize default parametersarch/x86/kernel/cpu/cpufreq/powernow-k6.c | +72 -4 | 0 replies | |
| 124/143 | powernow-k6: reorder frequenciesarch/x86/kernel/cpu/cpufreq/powernow-k6.c | +10 -7 | 0 replies | |
| 125/143 | tcp: fix tcp_trim_head() to adjust segment count with skb MSSnet/ipv4/tcp_output.c | +2 -4 | 0 replies | |
| 126/143 | tcp_cubic: limit delayed_ack ratio to prevent divide errornet/ipv4/tcp_cubic.c | +7 -2 | 0 replies | |
| 127/143 | tcp_cubic: fix the range of delayed_acknet/ipv4/tcp_cubic.c | +1 -1 | 0 replies | |
| 128/143 | n_tty: Fix n_tty_write crash when echoing in raw modedrivers/char/n_tty.c | +2 -0 | 0 replies | |
| 129/143 | exec/ptrace: fix get_dumpable() incorrect testsarch/ia64/include/asm/processor.h fs/exec.c include/linux/binfmts.h +2 more | +12 -5 | 0 replies | |
| 130/143 | ipv6: call udp_push_pending_frames when uncorking a socket withinclude/net/udp.h net/ipv4/udp.c net/ipv6/udp.c | +9 -2 | 0 replies | |
| 131/143 | dm snapshot: fix data corruptiondrivers/md/dm-snap-persistent.c | +12 -6 | 0 replies | |
| 132/143 | crypto: ansi_cprng - Fix off by one error in non-block size requestcrypto/ansi_cprng.c | +2 -2 | 0 replies | |
| 133/143 | uml: check length in exitcode_proc_write()arch/um/kernel/exitcode.c | +3 -1 | 0 replies | |
| 134/143 | KVM: Improve create VCPU parameter (CVE-2013-4587)virt/kvm/kvm_main.c | +3 -0 | 0 replies | |
| 135/143 | KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367)arch/x86/kvm/lapic.c | +2 -1 | 0 replies | |
| 136/143 | qeth: avoid buffer overflow in snmp ioctldrivers/s390/net/qeth_core_main.c | +5 -1 | 0 replies | |
| 137/143 | xfs: underflow bug in xfs_attrlist_by_handle()fs/xfs/linux-2.6/xfs_ioctl.c fs/xfs/linux-2.6/xfs_ioctl32.c | +4 -3 | 4 replies | |
| 138/143 | aacraid: missing capable() check in compat ioctldrivers/scsi/aacraid/linit.c | +2 -0 | 0 replies | |
| 139/143 | SELinux: Fix kernel BUG on empty security contexts.security/selinux/ss/services.c | +4 -0 | 0 replies | |
| 140/143 | s390: fix kernel crash due to linkage stack instructionsarch/s390/kernel/head64.S | +5 -2 | 0 replies | |
| 141/143 | netfilter: nf_conntrack_dccp: fix skb_header_pointer API usagesnet/netfilter/nf_conntrack_proto_dccp.c | +3 -3 | 0 replies | |
| 142/143 | floppy: ignore kernel-only members in FDRAWCMD ioctl inputdrivers/block/floppy.c | +4 -1 | 0 replies | |
| 143/143 | floppy: dont write kernel-only members to FDRAWCMD ioctl outputdrivers/block/floppy.c | +6 -1 | 0 replies | |