* Re: [PATCH net v3 0/2] SCTP PMTU discovery fixes
From: Xin Long @ 2018-01-06 5:05 UTC (permalink / raw)
To: Marcelo Ricardo Leitner
Cc: network dev, linux-sctp, Vlad Yasevich, Neil Horman
In-Reply-To: <cover.1515152627.git.marcelo.leitner@gmail.com>
On Fri, Jan 5, 2018 at 9:17 PM, Marcelo Ricardo Leitner
<marcelo.leitner@gmail.com> wrote:
> This patchset fixes 2 issues with PMTU discovery that can lead to flood
> of retransmissions.
> The first patch fixes the issue for when PMTUD is disabled by the
> application, while the second fixes it for when its enabled.
>
> Please consider these to stable.
>
> Thanks,
>
> Marcelo Ricardo Leitner (2):
> sctp: do not retransmit upon FragNeeded if PMTU discovery is disabled
> sctp: fix the handling of ICMP Frag Needed for too small MTUs
>
> include/net/sctp/structs.h | 2 +-
> net/sctp/input.c | 28 ++++++++++++++++------------
> net/sctp/transport.c | 29 +++++++++++++++++++----------
> 3 files changed, 36 insertions(+), 23 deletions(-)
>
> --
> 2.14.3
>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH 22/27] ixgbe: Use timecounter_reset interface
From: Brown, Aaron F @ 2018-01-06 4:33 UTC (permalink / raw)
To: Kamble, Sagar A, linux-kernel@vger.kernel.org
Cc: intel-wired-lan@lists.osuosl.org, Richard Cochran,
Kamble, Sagar A, netdev@vger.kernel.org
In-Reply-To: <1513323522-15021-23-git-send-email-sagar.a.kamble@intel.com>
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Sagar Arun Kamble
> Sent: Thursday, December 14, 2017 11:39 PM
> To: linux-kernel@vger.kernel.org
> Cc: intel-wired-lan@lists.osuosl.org; Richard Cochran
> <richardcochran@gmail.com>; Kamble, Sagar A
> <sagar.a.kamble@intel.com>; netdev@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH 22/27] ixgbe: Use timecounter_reset
> interface
>
> With new interface timecounter_reset we can update the start time for
> timecounter. Update ixgbe_ptp_settime with this new function.
>
> Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com>
> Cc: Richard Cochran <richardcochran@gmail.com>
> Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH 21/27] igb: Use timecounter_reset interface
From: Brown, Aaron F @ 2018-01-06 4:33 UTC (permalink / raw)
To: Kamble, Sagar A, linux-kernel@vger.kernel.org
Cc: intel-wired-lan@lists.osuosl.org, Richard Cochran,
Kamble, Sagar A, netdev@vger.kernel.org
In-Reply-To: <1513323522-15021-22-git-send-email-sagar.a.kamble@intel.com>
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Sagar Arun Kamble
> Sent: Thursday, December 14, 2017 11:39 PM
> To: linux-kernel@vger.kernel.org
> Cc: intel-wired-lan@lists.osuosl.org; Richard Cochran
> <richardcochran@gmail.com>; Kamble, Sagar A
> <sagar.a.kamble@intel.com>; netdev@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH 21/27] igb: Use timecounter_reset
> interface
>
> With new interface timecounter_reset we can update the start time for
> timecounter. Update igb_ptp_settime_82576 with this new function.
>
> Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com>
> Cc: Richard Cochran <richardcochran@gmail.com>
> Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/ethernet/intel/igb/igb_ptp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH 08/27] e1000e: Use timecounter_initialize interface
From: Brown, Aaron F @ 2018-01-06 4:31 UTC (permalink / raw)
To: Kamble, Sagar A, linux-kernel@vger.kernel.org
Cc: intel-wired-lan@lists.osuosl.org, Richard Cochran,
Kamble, Sagar A, netdev@vger.kernel.org
In-Reply-To: <1513323522-15021-9-git-send-email-sagar.a.kamble@intel.com>
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Sagar Arun Kamble
> Sent: Thursday, December 14, 2017 11:38 PM
> To: linux-kernel@vger.kernel.org
> Cc: intel-wired-lan@lists.osuosl.org; Richard Cochran
> <richardcochran@gmail.com>; Kamble, Sagar A
> <sagar.a.kamble@intel.com>; netdev@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH 08/27] e1000e: Use timecounter_initialize
> interface
>
> With new interface timecounter_initialize we can initialize timecounter
> fields and underlying cyclecounter together. Update e1000e timecounter
> init with this new function.
>
> Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com>
> Cc: Richard Cochran <richardcochran@gmail.com>
> Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/ethernet/intel/e1000e/e1000.h | 4 ++++
> drivers/net/ethernet/intel/e1000e/netdev.c | 31 +++++++++++++++++-----
> --------
> 2 files changed, 22 insertions(+), 13 deletions(-)
>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH 20/27] e1000e: Use timecounter_reset interface
From: Brown, Aaron F @ 2018-01-06 4:30 UTC (permalink / raw)
To: Kamble, Sagar A, linux-kernel@vger.kernel.org
Cc: intel-wired-lan@lists.osuosl.org, Richard Cochran,
Kamble, Sagar A, netdev@vger.kernel.org
In-Reply-To: <1513323522-15021-21-git-send-email-sagar.a.kamble@intel.com>
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Sagar Arun Kamble
> Sent: Thursday, December 14, 2017 11:39 PM
> To: linux-kernel@vger.kernel.org
> Cc: intel-wired-lan@lists.osuosl.org; Richard Cochran
> <richardcochran@gmail.com>; Kamble, Sagar A
> <sagar.a.kamble@intel.com>; netdev@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH 20/27] e1000e: Use timecounter_reset
> interface
>
> With new interface timecounter_reset we can update the start time for
> timecounter. Update e1000e_phc_settime with this new function.
>
> Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com>
> Cc: Richard Cochran <richardcochran@gmail.com>
> Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/ethernet/intel/e1000e/ptp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH 1/1] timecounter: Make cyclecounter struct part of timecounter struct
From: Brown, Aaron F @ 2018-01-06 4:29 UTC (permalink / raw)
To: Kirsher, Jeffrey T, Kamble, Sagar A, linux-kernel@vger.kernel.org
Cc: alsa-devel@alsa-project.org, linux-rdma@vger.kernel.org,
netdev@vger.kernel.org, Richard Cochran, Stephen Boyd,
Chris Wilson, John Stultz, intel-wired-lan@lists.osuosl.org,
Thomas Gleixner, kvmarm@lists.cs.columbia.edu,
linux-arm-kernel@lists.infradead.org
In-Reply-To: <1512577496.8693.0.camel@intel.com>
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Jeff Kirsher
> Sent: Wednesday, December 6, 2017 8:25 AM
> To: Kamble, Sagar A <sagar.a.kamble@intel.com>; linux-
> kernel@vger.kernel.org
> Cc: alsa-devel@alsa-project.org; linux-rdma@vger.kernel.org;
> netdev@vger.kernel.org; Richard Cochran <richardcochran@gmail.com>;
> Stephen Boyd <sboyd@codeaurora.org>; Chris Wilson <chris@chris-
> wilson.co.uk>; John Stultz <john.stultz@linaro.org>; intel-wired-
> lan@lists.osuosl.org; Thomas Gleixner <tglx@linutronix.de>;
> kvmarm@lists.cs.columbia.edu; linux-arm-kernel@lists.infradead.org
> Subject: Re: [Intel-wired-lan] [PATCH 1/1] timecounter: Make cyclecounter
> struct part of timecounter struct
>
> On Sat, 2017-12-02 at 10:01 +0530, Sagar Arun Kamble wrote:
> > There is no real need for the users of timecounters to define
> > cyclecounter
> > and timecounter variables separately. Since timecounter will always
> > be
> > based on cyclecounter, have cyclecounter struct as member of
> > timecounter
> > struct.
> >
> > Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Signed-off-by: Sagar Arun Kamble <sagar.a.kamble@intel.com>
> > Cc: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Richard Cochran <richardcochran@gmail.com>
> > Cc: John Stultz <john.stultz@linaro.org>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Stephen Boyd <sboyd@codeaurora.org>
> > Cc: linux-kernel@vger.kernel.org
> > Cc: linux-arm-kernel@lists.infradead.org
> > Cc: netdev@vger.kernel.org
> > Cc: intel-wired-lan@lists.osuosl.org
> > Cc: linux-rdma@vger.kernel.org
> > Cc: alsa-devel@alsa-project.org
> > Cc: kvmarm@lists.cs.columbia.edu
>
> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
> For the changes to the Intel drivers.
>
> > ---
> > arch/microblaze/kernel/timer.c | 20 ++++++------
> > drivers/clocksource/arm_arch_timer.c | 19 ++++++------
> > drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 3 +-
> > drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 9 +++---
> > drivers/net/ethernet/amd/xgbe/xgbe.h | 1 -
> > drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 -
> > drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 20 ++++++------
> > drivers/net/ethernet/freescale/fec.h | 1 -
> > drivers/net/ethernet/freescale/fec_ptp.c | 30 +++++++++---
> > ------
> > drivers/net/ethernet/intel/e1000e/e1000.h | 1 -
> > drivers/net/ethernet/intel/e1000e/netdev.c | 27 ++++++++--
> > ------
> > drivers/net/ethernet/intel/e1000e/ptp.c | 2 +-
> > drivers/net/ethernet/intel/igb/igb.h | 1 -
> > drivers/net/ethernet/intel/igb/igb_ptp.c | 25 ++++++++--
> > -----
> > drivers/net/ethernet/intel/ixgbe/ixgbe.h | 1 -
> > drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 17 +++++-----
> > drivers/net/ethernet/mellanox/mlx4/en_clock.c | 28 ++++++++--
> > -------
> > drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 -
> > .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 34 ++++++++++
> > ----------
> > drivers/net/ethernet/qlogic/qede/qede_ptp.c | 20 ++++++------
> > drivers/net/ethernet/ti/cpts.c | 36
> > ++++++++++++----------
> > drivers/net/ethernet/ti/cpts.h | 1 -
> > include/linux/mlx5/driver.h | 1 -
> > include/linux/timecounter.h | 4 +--
> > include/sound/hdaudio.h | 1 -
> > kernel/time/timecounter.c | 28 ++++++++--
> > -------
> > sound/hda/hdac_stream.c | 7 +++--
> > virt/kvm/arm/arch_timer.c | 6 ++--
> > 28 files changed, 163 insertions(+), 182 deletions(-)
^ permalink raw reply
* Re: [patch net-next v6 00/11] net: sched: allow qdiscs to share filter block instances
From: David Ahern @ 2018-01-06 3:57 UTC (permalink / raw)
To: Jiri Pirko, netdev
Cc: davem, jhs, xiyou.wangcong, mlxsw, andrew, vivien.didelot,
f.fainelli, michael.chan, ganeshgr, saeedm, matanb, leonro,
idosch, jakub.kicinski, simon.horman, pieter.jansenvanvuuren,
john.hurley, alexander.h.duyck, ogerlitz, john.fastabend, daniel
In-Reply-To: <20180105230929.5645-1-jiri@resnulli.us>
On 1/5/18 4:09 PM, Jiri Pirko wrote:
> From: Jiri Pirko <jiri@mellanox.com>
>
> Currently the filters added to qdiscs are independent. So for example if you
> have 2 netdevices and you create ingress qdisc on both and you want to add
> identical filter rules both, you need to add them twice. This patchset
> makes this easier and mainly saves resources allowing to share all filters
> within a qdisc - I call it a "filter block". Also this helps to save
> resources when we do offload to hw for example to expensive TCAM.
>
> So back to the example. First, we create 2 qdiscs. Both will share
> block number 22. "22" is just an identification. If we don't pass any
> block number, a new one will be generated by kernel:
>
> $ tc qdisc add dev ens7 ingress block 22
> ^^^^^^^^
> $ tc qdisc add dev ens8 ingress block 22
> ^^^^^^^^
>
> Now if we list the qdiscs, we will see the block index in the output:
>
> $ tc qdisc
> qdisc ingress ffff: dev ens7 parent ffff:fff1 block 22
> qdisc ingress ffff: dev ens8 parent ffff:fff1 block 22
>
>
> To make is more visual, the situation looks like this:
>
> ens7 ingress qdisc ens7 ingress qdisc
> | |
> | |
> +----------> block 22 <----------+
>
> Unlimited number of qdiscs may share the same block.
>
> Now we can add filter using the block index:
>
> $ tc filter add block 22 protocol ip pref 25 flower dst_ip 192.168.0.0/16 action drop
>
>
> Note we cannot use the qdisc for filter manipulations for shared blocks:
>
> $ tc filter add dev ens8 ingress protocol ip pref 1 flower dst_ip 192.168.100.2 action drop
> Error: Cannot work with shared block, please use block index.
>
>
> We will see the same output if we list filters for ingress qdisc of
> ens7 and ens8, also for the block 22:
>
> $ tc filter show block 22
> filter block 22 protocol ip pref 25 flower chain 0
> filter block 22 protocol ip pref 25 flower chain 0 handle 0x1
> ...
>
> $ tc filter show dev ens7 ingress
> filter block 22 protocol ip pref 25 flower chain 0
> filter block 22 protocol ip pref 25 flower chain 0 handle 0x1
> ...
>
> $ tc filter show dev ens8 ingress
> filter block 22 protocol ip pref 25 flower chain 0
> filter block 22 protocol ip pref 25 flower chain 0 handle 0x1
> ...
I like the API and output shown here, but I am not getting that with the
patches.
In this example, I am using 42 for the block id:
$ tc qdisc show dev eth2
qdisc mq 0: root
qdisc pfifo_fast 0: parent :2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1
1 1 1
qdisc pfifo_fast 0: parent :1 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1
1 1 1
qdisc ingress ffff: parent ffff:fff1 block 42
It allows me to add a filter using the device:
$ tc filter add dev eth2 ingress protocol ip pref 1 flower dst_ip
192.168.101.2 action drop
$ echo $?
0
And it modifies the shared block:
$ tc filter show block 42
filter pref 1 flower chain 0
filter pref 1 flower chain 0 handle 0x1
eth_type ipv4
dst_ip 192.168.100.2
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 2 ref 1 bind 1
filter pref 1 flower chain 0 handle 0x2
eth_type ipv4
dst_ip 192.168.101.2
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 3 ref 1 bind 1
filter pref 25 flower chain 0
filter pref 25 flower chain 0 handle 0x1
eth_type ipv4
dst_ip 192.168.0.0/16
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 1 ref 1 bind 1
Notice the header does not give the 'filter block N protocol' part. I
don't get that using the device either (tc filter show dev eth2 ingress).
Something else I noticed is that I do not get an error message if I pass
an invalid block id:
$ tc filter show block 22
$ echo $?
0
$ tc qdisc show | grep block
qdisc ingress ffff: dev eth2 parent ffff:fff1 block 42
^ permalink raw reply
* [PATCH iproute2] Restore --no-print-directory option for silent builds
From: David Ahern @ 2018-01-06 3:42 UTC (permalink / raw)
To: netdev, stephen; +Cc: David Ahern
Commit 69fed534a533 ("change how Config is used in Makefile's") removed
Config from Makefile. Config had the checks to set VERBOSE based on user
request and VERBOSE is used to add the --no-print-directory argument.
Since Config is gone, add the relevant setup for VERBOSE to Makefile
to restore quieter builds by default.
Fixes: 69fed534a533 ("change how Config is used in Makefile's")
Signed-off-by: David Ahern <dsahern@gmail.com>
---
Makefile | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/Makefile b/Makefile
index 6a51e0db9107..32587db3be70 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,13 @@
# SPDX-License-Identifier: GPL-2.0
# Top level Makefile for iproute2
+ifeq ("$(origin V)", "command line")
+VERBOSE = $(V)
+endif
+ifndef VERBOSE
+VERBOSE = 0
+endif
+
ifeq ($(VERBOSE),0)
MAKEFLAGS += --no-print-directory
endif
--
2.11.0
^ permalink raw reply related
* Re: [PATCH 06/18] x86, barrier: stop speculation for failed access_ok
From: Linus Torvalds @ 2018-01-06 3:09 UTC (permalink / raw)
To: Dan Williams
Cc: Linux Kernel Mailing List, linux-arch, Andi Kleen, Arnd Bergmann,
Greg Kroah-Hartman, Peter Zijlstra, Network Development,
the arch/x86 maintainers, Ingo Molnar, H. Peter Anvin,
Thomas Gleixner, Alan Cox
In-Reply-To: <CA+55aFzeCHgAtz4vCR9YaUxkuesCNEht56dKJmpytx2A-JmJkg@mail.gmail.com>
On Fri, Jan 5, 2018 at 6:52 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> The fact is, we have to stop speculating when access_ok() does *not*
> fail - because that's when we'll actually do the access. And it's that
> access that needs to be non-speculative.
I also suspect we should probably do this entirely differently.
Maybe the whole lfence can be part of uaccess_begin() instead (ie
currently 'stac()'). That would fit the existing structure better, I
think. And it would avoid any confusion about the whole "when to stop
speculation".
Linus
^ permalink raw reply
* Re: [PATCH 01/18] asm-generic/barrier: add generic nospec helpers
From: Linus Torvalds @ 2018-01-06 2:55 UTC (permalink / raw)
To: Dan Williams
Cc: Linux Kernel Mailing List, Mark Rutland, linux-arch,
Peter Zijlstra, Network Development, Will Deacon,
Greg Kroah-Hartman, Thomas Gleixner, Alan Cox
In-Reply-To: <151520099810.32271.11023910901471332353.stgit@dwillia2-desk3.amr.corp.intel.com>
On Fri, Jan 5, 2018 at 5:09 PM, Dan Williams <dan.j.williams@intel.com> wrote:
> +#ifndef nospec_ptr
> +#define nospec_ptr(ptr, lo, hi) \
Do we actually want this horrible interface?
It just causes the compiler - or inline asm - to generate worse code,
because it needs to compare against both high and low limits.
Basically all users are arrays that are zero-based, and where a
comparison against the high _index_ limit would be sufficient.
But the way this is all designed, it's literally designed for bad code
generation for the unusual case, and the usual array case is written
in the form of the unusual and wrong non-array case. That really seems
excessively stupid.
Linus
^ permalink raw reply
* Re: [PATCH 06/18] x86, barrier: stop speculation for failed access_ok
From: Linus Torvalds @ 2018-01-06 2:52 UTC (permalink / raw)
To: Dan Williams
Cc: Linux Kernel Mailing List, linux-arch, Andi Kleen, Arnd Bergmann,
Greg Kroah-Hartman, Peter Zijlstra, Network Development,
the arch/x86 maintainers, Ingo Molnar, H. Peter Anvin,
Thomas Gleixner, Alan Cox
In-Reply-To: <151520102670.32271.8447983009852138826.stgit@dwillia2-desk3.amr.corp.intel.com>
On Fri, Jan 5, 2018 at 5:10 PM, Dan Williams <dan.j.williams@intel.com> wrote:
> From: Andi Kleen <ak@linux.intel.com>
>
> When access_ok fails we should always stop speculating.
> Add the required barriers to the x86 access_ok macro.
Honestly, this seems completely bogus.
The description is pure garbage afaik.
The fact is, we have to stop speculating when access_ok() does *not*
fail - because that's when we'll actually do the access. And it's that
access that needs to be non-speculative.
That actually seems to be what the code does (it stops speculation
when __range_not_ok() returns false, but access_ok() is
!__range_not_ok()). But the explanation is crap, and dangerous.
Linus
^ permalink raw reply
* Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution
From: Eric W. Biederman @ 2018-01-06 2:22 UTC (permalink / raw)
To: Dan Williams
Cc: linux-kernel, Mark Rutland, peterz, Alan Cox, Srinivas Pandruvada,
Will Deacon, Solomon Peachy, H. Peter Anvin, Christian Lamparter,
Elena Reshetova, linux-arch, Andi Kleen, James E.J. Bottomley,
linux-scsi, Jonathan Corbet, x86, Ingo Molnar, Alexey Kuznetsov,
Zhang Rui, linux-media, Arnd Bergmann, Jan Kara,
Eduardo Valentin <
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Dan Williams <dan.j.williams@intel.com> writes:
> Quoting Mark's original RFC:
>
> "Recently, Google Project Zero discovered several classes of attack
> against speculative execution. One of these, known as variant-1, allows
> explicit bounds checks to be bypassed under speculation, providing an
> arbitrary read gadget. Further details can be found on the GPZ blog [1]
> and the Documentation patch in this series."
>
> This series incorporates Mark Rutland's latest api and adds the x86
> specific implementation of nospec_barrier. The
> nospec_{array_ptr,ptr,barrier} helpers are then combined with a kernel
> wide analysis performed by Elena Reshetova to address static analysis
> reports where speculative execution on a userspace controlled value
> could bypass a bounds check. The patches address a precondition for the
> attack discussed in the Spectre paper [2].
Please expand this.
It is not clear what the static analysis is looking for. Have a clear
description of what is being fixed is crucial for allowing any of these
changes.
For the details given in the change description what I read is magic
changes because a magic process says this code is vunlerable.
Given the similarities in the code that is being patched to many other
places in the kernel it is not at all clear that this small set of
changes is sufficient for any purpose.
> A consideration worth noting for reviewing these patches is to weigh the
> dramatic cost of being wrong about whether a given report is exploitable
> vs the overhead nospec_{array_ptr,ptr} may introduce. In other words,
> lets make the bar for applying these patches be "can you prove that the
> bounds check bypass is *not* exploitable". Consider that the Spectre
> paper reports one example of a speculation window being ~180 cycles.
> Note that there is also a proposal from Linus, array_access [3], that
> attempts to quash speculative execution past a bounds check without
> introducing an lfence instruction. That may be a future optimization
> possibility that is compatible with this api, but it would appear to
> need guarantees from the compiler that it is not clear the kernel can
> rely on at this point. It is also not clear that it would be a
> significant performance win vs lfence.
It is also not clear that these changes fix anything, or are in any
sense correct for the problem they are trying to fix as the problem
is not clearly described.
In at least one place (mpls) you are patching a fast path. Compile out
or don't load mpls by all means. But it is not acceptable to change the
fast path without even considering performance.
So because the description sucks, and the due diligence is not there.
Nacked-by: "Eric W. Biederman" <ebiederm@xmission.com>
to the series.
>
> These patches also will also be available via the 'nospec' git branch
> here:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux nospec
>
> [1]: https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
> [2]: https://spectreattack.com/spectre.pdf
> [3]: https://marc.info/?l=linux-kernel&m=151510446027625&w=2
>
> ---
>
> Andi Kleen (1):
> x86, barrier: stop speculation for failed access_ok
>
> Dan Williams (13):
> x86: implement nospec_barrier()
> [media] uvcvideo: prevent bounds-check bypass via speculative execution
> carl9170: prevent bounds-check bypass via speculative execution
> p54: prevent bounds-check bypass via speculative execution
> qla2xxx: prevent bounds-check bypass via speculative execution
> cw1200: prevent bounds-check bypass via speculative execution
> Thermal/int340x: prevent bounds-check bypass via speculative execution
> ipv6: prevent bounds-check bypass via speculative execution
> ipv4: prevent bounds-check bypass via speculative execution
> vfs, fdtable: prevent bounds-check bypass via speculative execution
> net: mpls: prevent bounds-check bypass via speculative execution
> udf: prevent bounds-check bypass via speculative execution
> userns: prevent bounds-check bypass via speculative execution
>
> Mark Rutland (4):
> asm-generic/barrier: add generic nospec helpers
> Documentation: document nospec helpers
> arm64: implement nospec_ptr()
> arm: implement nospec_ptr()
>
> Documentation/speculation.txt | 166 ++++++++++++++++++++
> arch/arm/include/asm/barrier.h | 75 +++++++++
> arch/arm64/include/asm/barrier.h | 55 +++++++
> arch/x86/include/asm/barrier.h | 6 +
> arch/x86/include/asm/uaccess.h | 17 ++
> drivers/media/usb/uvc/uvc_v4l2.c | 7 +
> drivers/net/wireless/ath/carl9170/main.c | 6 -
> drivers/net/wireless/intersil/p54/main.c | 8 +
> drivers/net/wireless/st/cw1200/sta.c | 10 +
> drivers/net/wireless/st/cw1200/wsm.h | 4
> drivers/scsi/qla2xxx/qla_mr.c | 15 +-
> .../thermal/int340x_thermal/int340x_thermal_zone.c | 14 +-
> fs/udf/misc.c | 39 +++--
> include/asm-generic/barrier.h | 68 ++++++++
> include/linux/fdtable.h | 5 -
> kernel/user_namespace.c | 10 -
> net/ipv4/raw.c | 9 +
> net/ipv6/raw.c | 9 +
> net/mpls/af_mpls.c | 12 +
> 19 files changed, 466 insertions(+), 69 deletions(-)
> create mode 100644 Documentation/speculation.txt
^ permalink raw reply
* Re: [PATCH 12/18] Thermal/int340x: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:57 UTC (permalink / raw)
To: Srinivas Pandruvada
Cc: Linux Kernel Mailing List, linux-arch, Greg KH, Peter Zijlstra,
Netdev, Eduardo Valentin, Zhang Rui, Linus Torvalds,
Thomas Gleixner, Elena Reshetova, Alan Cox
In-Reply-To: <1515203635.26317.78.camel@linux.intel.com>
On Fri, Jan 5, 2018 at 5:53 PM, Srinivas Pandruvada
<srinivas.pandruvada@linux.intel.com> wrote:
> On Fri, 2018-01-05 at 17:10 -0800, Dan Williams wrote:
>> Static analysis reports that 'trip' may be a user controlled value
>> that
>> is used as a data dependency to read '*temp' from the 'd->aux_trips'
>> array. In order to avoid potential leaks of kernel memory values,
>> block
>> speculative execution of the instruction stream that could issue
>> reads
>> based on an invalid value of '*temp'.
>
> Not against the change as this is in a very slow path. But the trip is
> not an arbitrary value which user can enter.
>
> This trip value is the one of the sysfs attribute in thermal zone. For
> example
>
> # cd /sys/class/thermal/thermal_zone1
> # ls trip_point_?_temp
> trip_point_0_temp trip_point_1_temp trip_point_2_temp trip_point_3_t
> emp trip_point_4_temp trip_point_5_temp trip_point_6_temp
>
> Here the "trip" is one of the above trip_point_*_temp. So in this case
> it can be from 0 to 6 as user can't do
> # cat trip_point_7_temp
> as there is no sysfs attribute for trip_point_7_temp.
>
> The actual "trip" was obtained in thermal core via
>
> if (sscanf(attr->attr.name, "trip_point_%d_temp", &trip) != 1)
> return -EINVAL;
>
> Thanks,
> Srinivas
Ah, great, thanks. So do we even need the bounds check at that point?
^ permalink raw reply
* Re: [PATCH 12/18] Thermal/int340x: prevent bounds-check bypass via speculative execution
From: Srinivas Pandruvada @ 2018-01-06 1:53 UTC (permalink / raw)
To: Dan Williams, linux-kernel
Cc: linux-arch, gregkh, peterz, netdev, Eduardo Valentin, Zhang Rui,
torvalds, tglx, Elena Reshetova, alan
In-Reply-To: <151520105920.32271.1091443154687576996.stgit@dwillia2-desk3.amr.corp.intel.com>
On Fri, 2018-01-05 at 17:10 -0800, Dan Williams wrote:
> Static analysis reports that 'trip' may be a user controlled value
> that
> is used as a data dependency to read '*temp' from the 'd->aux_trips'
> array. In order to avoid potential leaks of kernel memory values,
> block
> speculative execution of the instruction stream that could issue
> reads
> based on an invalid value of '*temp'.
Not against the change as this is in a very slow path. But the trip is
not an arbitrary value which user can enter.
This trip value is the one of the sysfs attribute in thermal zone. For
example
# cd /sys/class/thermal/thermal_zone1
# ls trip_point_?_temp
trip_point_0_temp trip_point_1_temp trip_point_2_temp trip_point_3_t
emp trip_point_4_temp trip_point_5_temp trip_point_6_temp
Here the "trip" is one of the above trip_point_*_temp. So in this case
it can be from 0 to 6 as user can't do
# cat trip_point_7_temp
as there is no sysfs attribute for trip_point_7_temp.
The actual "trip" was obtained in thermal core via
if (sscanf(attr->attr.name, "trip_point_%d_temp", &trip) != 1)
return -EINVAL;
Thanks,
Srinivas
>
> Based on an original patch by Elena Reshetova.
>
> Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> Cc: Zhang Rui <rui.zhang@intel.com>
> Cc: Eduardo Valentin <edubezval@gmail.com>
> Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
> .../thermal/int340x_thermal/int340x_thermal_zone.c | 14 ++++++++
> ------
> 1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
> b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
> index 145a5c53ff5c..442a1d9bf7ad 100644
> --- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
> +++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
> @@ -17,6 +17,7 @@
> #include <linux/init.h>
> #include <linux/acpi.h>
> #include <linux/thermal.h>
> +#include <linux/compiler.h>
> #include "int340x_thermal_zone.h"
>
> static int int340x_thermal_get_zone_temp(struct thermal_zone_device
> *zone,
> @@ -52,20 +53,21 @@ static int int340x_thermal_get_trip_temp(struct
> thermal_zone_device *zone,
> int trip, int *temp)
> {
> struct int34x_thermal_zone *d = zone->devdata;
> + unsigned long *elem;
> int i;
>
> if (d->override_ops && d->override_ops->get_trip_temp)
> return d->override_ops->get_trip_temp(zone, trip,
> temp);
>
> - if (trip < d->aux_trip_nr)
> - *temp = d->aux_trips[trip];
> - else if (trip == d->crt_trip_id)
> + if ((elem = nospec_array_ptr(d->aux_trips, trip, d-
> >aux_trip_nr))) {
> + *temp = *elem;
> + } else if (trip == d->crt_trip_id) {
> *temp = d->crt_temp;
> - else if (trip == d->psv_trip_id)
> + } else if (trip == d->psv_trip_id) {
> *temp = d->psv_temp;
> - else if (trip == d->hot_trip_id)
> + } else if (trip == d->hot_trip_id) {
> *temp = d->hot_temp;
> - else {
> + } else {
> for (i = 0; i < INT340X_THERMAL_MAX_ACT_TRIP_COUNT;
> i++) {
> if (d->act_trips[i].valid &&
> d->act_trips[i].id == trip) {
>
^ permalink raw reply
* Re: [PATCH bpf-next v4 07/11] bpf: Add support for reading sk_state and more
From: Daniel Borkmann @ 2018-01-06 1:46 UTC (permalink / raw)
To: Lawrence Brakmo, netdev
Cc: Kernel Team, Blake Matheny, Alexei Starovoitov, Eric Dumazet,
Neal Cardwell, Yuchung Cheng
In-Reply-To: <20180104235533.3672006-8-brakmo@fb.com>
On 01/05/2018 12:55 AM, Lawrence Brakmo wrote:
> Add support for reading many more tcp_sock fields
>
> state, same as sk->sk_state
> rtt_min same as sk->rtt_min.s[0].v (current rtt_min)
> snd_ssthresh
> rcv_nxt
> snd_nxt
> snd_una
> mss_cache
> ecn_flags
> rate_delivered
> rate_interval_us
> packets_out
> retrans_out
> total_retrans
> segs_in
> data_segs_in
> segs_out
> data_segs_out
> bytes_received (__u64)
> bytes_acked (__u64)
>
> Signed-off-by: Lawrence Brakmo <brakmo@fb.com>
> ---
> include/uapi/linux/bpf.h | 19 +++++++++
> net/core/filter.c | 101 ++++++++++++++++++++++++++++++++++++++++++++++-
> 2 files changed, 119 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index a1316c7..a8f4cf0 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -963,6 +963,25 @@ struct bpf_sock_ops {
> __u32 snd_cwnd;
> __u32 srtt_us; /* Averaged RTT << 3 in usecs */
> __u32 bpf_sock_ops_flags; /* flags defined in uapi/linux/tcp.h */
> + __u32 state;
> + __u32 rtt_min;
> + __u32 snd_ssthresh;
> + __u32 rcv_nxt;
> + __u32 snd_nxt;
> + __u32 snd_una;
> + __u32 mss_cache;
> + __u32 ecn_flags;
> + __u32 rate_delivered;
> + __u32 rate_interval_us;
> + __u32 packets_out;
> + __u32 retrans_out;
> + __u32 total_retrans;
> + __u32 segs_in;
> + __u32 data_segs_in;
> + __u32 segs_out;
> + __u32 data_segs_out;
> + __u64 bytes_received;
> + __u64 bytes_acked;
> };
>
> /* List of known BPF sock_ops operators.
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 76fd6e9..d4c5c1a 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3829,7 +3829,7 @@ static bool __is_valid_sock_ops_access(int off, int size)
> /* The verifier guarantees that size > 0. */
> if (off % size != 0)
> return false;
> - if (size != sizeof(__u32))
> + if (size != sizeof(__u32) && size != sizeof(__u64))
> return false;
Doesn't this have the side-effect that this would kind of let is_valid_access()
callback allow not for narrower but wider access, e.g. on the u32 members when
doing BPF_DW. It would still get ignored later on in the ctx rewrite, though, but
it also means that we could try with 2nd part of u64 member offsets with BPF_W
which would then return a 'verifier is misconfigured' error. I think it would
be better to enforce BPF_DW access only on the u64 types and BPF_W access only
on the u32 types before it becomes uapi instead opening this up generically. E.g.
we do similar approach in pe_prog_is_valid_access() for sample_period (taking the
the narrow access bits aside from there).
Thanks,
Daniel
^ permalink raw reply
* [PATCH net] ipv6: remove null_entry before adding default route
From: Wei Wang @ 2018-01-06 1:38 UTC (permalink / raw)
To: David Miller, netdev; +Cc: Martin KaFai Lau, Eric Dumazet, Wei Wang
From: Wei Wang <weiwan@google.com>
In the current code, when creating a new fib6 table, tb6_root.leaf gets
initialized to net->ipv6.ip6_null_entry.
If a default route is being added with rt->rt6i_metric = 0xffffffff,
fib6_add() will add this route after net->ipv6.ip6_null_entry. As
null_entry is shared, it could cause problem.
In order to fix it, set fn->leaf to NULL before calling
fib6_add_rt2node() when trying to add the first default route.
And reset fn->leaf to null_entry when adding fails or when deleting the
last default route.
syzkaller reported the following issue which is fixed by this commit:
=============================
WARNING: suspicious RCU usage
4.15.0-rc5+ #171 Not tainted
-----------------------------
net/ipv6/ip6_fib.c:1702 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by swapper/0/0:
#0: ((&net->ipv6.ip6_fib_timer)){+.-.}, at: [<00000000d43f631b>] lockdep_copy_map include/linux/lockdep.h:178 [inline]
#0: ((&net->ipv6.ip6_fib_timer)){+.-.}, at: [<00000000d43f631b>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1310
#1: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-.}, at: [<000000002ff9d65c>] spin_lock_bh include/linux/spinlock.h:315 [inline]
#1: (&(&net->ipv6.fib6_gc_lock)->rlock){+.-.}, at: [<000000002ff9d65c>] fib6_run_gc+0x9d/0x3c0 net/ipv6/ip6_fib.c:2007
#2: (rcu_read_lock){....}, at: [<0000000091db762d>] __fib6_clean_all+0x0/0x3a0 net/ipv6/ip6_fib.c:1560
#3: (&(&tb->tb6_lock)->rlock){+.-.}, at: [<000000009e503581>] spin_lock_bh include/linux/spinlock.h:315 [inline]
#3: (&(&tb->tb6_lock)->rlock){+.-.}, at: [<000000009e503581>] __fib6_clean_all+0x1d0/0x3a0 net/ipv6/ip6_fib.c:1948
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.15.0-rc5+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4585
fib6_del+0xcaa/0x11b0 net/ipv6/ip6_fib.c:1701
fib6_clean_node+0x3aa/0x4f0 net/ipv6/ip6_fib.c:1892
fib6_walk_continue+0x46c/0x8a0 net/ipv6/ip6_fib.c:1815
fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1863
fib6_clean_tree+0x1e6/0x340 net/ipv6/ip6_fib.c:1933
__fib6_clean_all+0x1f4/0x3a0 net/ipv6/ip6_fib.c:1949
fib6_clean_all net/ipv6/ip6_fib.c:1960 [inline]
fib6_run_gc+0x16b/0x3c0 net/ipv6/ip6_fib.c:2016
fib6_gc_timer_cb+0x20/0x30 net/ipv6/ip6_fib.c:2033
call_timer_fn+0x228/0x820 kernel/time/timer.c:1320
expire_timers kernel/time/timer.c:1357 [inline]
__run_timers+0x7ee/0xb70 kernel/time/timer.c:1660
run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:540 [inline]
smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:904
</IRQ>
Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
Signed-off-by: Wei Wang <weiwan@google.com>
---
net/ipv6/ip6_fib.c | 45 +++++++++++++++++++++++++++++++++++----------
1 file changed, 35 insertions(+), 10 deletions(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d11a5578e4f8..37cb4ad1ea29 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -640,6 +640,11 @@ static struct fib6_node *fib6_add_1(struct net *net,
if (!(fn->fn_flags & RTN_RTINFO)) {
RCU_INIT_POINTER(fn->leaf, NULL);
rt6_release(leaf);
+ /* remove null_entry in the root node */
+ } else if (fn->fn_flags & RTN_TL_ROOT &&
+ rcu_access_pointer(fn->leaf) ==
+ net->ipv6.ip6_null_entry) {
+ RCU_INIT_POINTER(fn->leaf, NULL);
}
return fn;
@@ -1270,14 +1275,27 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
return err;
failure:
- /* fn->leaf could be NULL if fn is an intermediate node and we
- * failed to add the new route to it in both subtree creation
- * failure and fib6_add_rt2node() failure case.
- * In both cases, fib6_repair_tree() should be called to fix
+ /* fn->leaf could be NULL if:
+ * 1. fn is the root node in the table and we fail to add the default
+ * route to it.
+ * In this case, we put fn->leaf back to net->ipv6.ip6_null_entry as
+ * the way the table was created.
+ * 2. fn is an intermediate node and we failed to add the new
+ * route to it in both subtree creation failure and fib6_add_rt2node()
+ * failure case.
+ * In this case, fib6_repair_tree() should be called to fix
* fn->leaf.
*/
- if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
- fib6_repair_tree(info->nl_net, table, fn);
+ if (fn) {
+ if (fn->fn_flags & RTN_TL_ROOT) {
+ if (!rcu_access_pointer(fn->leaf)) {
+ rcu_assign_pointer(fn->leaf,
+ info->nl_net->ipv6.ip6_null_entry);
+ }
+ } else if (!(fn->fn_flags & (RTN_RTINFO|RTN_ROOT))) {
+ fib6_repair_tree(info->nl_net, table, fn);
+ }
+ }
/* Always release dst as dst->__refcnt is guaranteed
* to be taken before entering this function
*/
@@ -1685,11 +1703,18 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
}
read_unlock(&net->ipv6.fib6_walker_lock);
- /* If it was last route, expunge its radix tree node */
+ /* If it was last route:
+ * 1. For root node, put back null_entry as how the table was created.
+ * 2. For other nodes, expunge its radix tree node.
+ */
if (!rcu_access_pointer(fn->leaf)) {
- fn->fn_flags &= ~RTN_RTINFO;
- net->ipv6.rt6_stats->fib_route_nodes--;
- fn = fib6_repair_tree(net, table, fn);
+ if (fn->fn_flags & RTN_TL_ROOT) {
+ rcu_assign_pointer(fn->leaf, net->ipv6.ip6_null_entry);
+ } else {
+ fn->fn_flags &= ~RTN_RTINFO;
+ net->ipv6.rt6_stats->fib_route_nodes--;
+ fn = fib6_repair_tree(net, table, fn);
+ }
}
fib6_purge_rt(rt, fn, net);
--
2.16.0.rc0.223.g4a4ac83678-goog
^ permalink raw reply related
* [PATCH 18/18] userns: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, peterz, netdev, Eric W. Biederman, gregkh, tglx,
torvalds, Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'pos' may be a user controlled value that
is used as a data dependency determining which extent to return out of
'map'. In order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue further
reads based on an invalid speculative result from 'm_start()'.
Based on an original patch by Elena Reshetova.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
kernel/user_namespace.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 246d4d4ce5c7..e958f2e5c061 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -648,15 +648,13 @@ static void *m_start(struct seq_file *seq, loff_t *ppos,
{
loff_t pos = *ppos;
unsigned extents = map->nr_extents;
- smp_rmb();
- if (pos >= extents)
- return NULL;
+ /* paired with smp_wmb in map_write */
+ smp_rmb();
if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
- return &map->extent[pos];
-
- return &map->forward[pos];
+ return nospec_array_ptr(map->extent, pos, extents);
+ return nospec_array_ptr(map->forward, pos, extents);
}
static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
^ permalink raw reply related
* [PATCH 17/18] udf: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, gregkh, peterz, netdev, Jan Kara, tglx, torvalds,
Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'eahd->appAttrLocation' and
'eahd->impAttrLocation' may be a user controlled values that are used as
data dependencies for calculating source and destination buffers for
memmove operations. In order to avoid potential leaks of kernel memory
values, block speculative execution of the instruction stream that could
issue further reads based on invalid 'aal' or 'ial' values.
Based on an original patch by Elena Reshetova.
Cc: Jan Kara <jack@suse.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
fs/udf/misc.c | 39 +++++++++++++++++++++------------------
1 file changed, 21 insertions(+), 18 deletions(-)
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 401e64cde1be..9403160822de 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -51,6 +51,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
int offset;
uint16_t crclen;
struct udf_inode_info *iinfo = UDF_I(inode);
+ uint8_t *ea_dst, *ea_src;
+ uint32_t aal, ial;
ea = iinfo->i_ext.i_data;
if (iinfo->i_lenEAttr) {
@@ -100,33 +102,34 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
offset = iinfo->i_lenEAttr;
if (type < 2048) {
- if (le32_to_cpu(eahd->appAttrLocation) <
- iinfo->i_lenEAttr) {
- uint32_t aal =
- le32_to_cpu(eahd->appAttrLocation);
- memmove(&ea[offset - aal + size],
- &ea[aal], offset - aal);
+ aal = le32_to_cpu(eahd->appAttrLocation);
+ if ((ea_dst = nospec_array_ptr(ea, offset - aal + size,
+ iinfo->i_lenEAttr)) &&
+ (ea_src = nospec_array_ptr(ea, aal,
+ iinfo->i_lenEAttr))) {
+ memmove(ea_dst, ea_src, offset - aal);
offset -= aal;
eahd->appAttrLocation =
cpu_to_le32(aal + size);
}
- if (le32_to_cpu(eahd->impAttrLocation) <
- iinfo->i_lenEAttr) {
- uint32_t ial =
- le32_to_cpu(eahd->impAttrLocation);
- memmove(&ea[offset - ial + size],
- &ea[ial], offset - ial);
+
+ ial = le32_to_cpu(eahd->impAttrLocation);
+ if ((ea_dst = nospec_array_ptr(ea, offset - ial + size,
+ iinfo->i_lenEAttr)) &&
+ (ea_src = nospec_array_ptr(ea, ial,
+ iinfo->i_lenEAttr))) {
+ memmove(ea_dst, ea_src, offset - ial);
offset -= ial;
eahd->impAttrLocation =
cpu_to_le32(ial + size);
}
} else if (type < 65536) {
- if (le32_to_cpu(eahd->appAttrLocation) <
- iinfo->i_lenEAttr) {
- uint32_t aal =
- le32_to_cpu(eahd->appAttrLocation);
- memmove(&ea[offset - aal + size],
- &ea[aal], offset - aal);
+ aal = le32_to_cpu(eahd->appAttrLocation);
+ if ((ea_dst = nospec_array_ptr(ea, offset - aal + size,
+ iinfo->i_lenEAttr)) &&
+ (ea_src = nospec_array_ptr(ea, aal,
+ iinfo->i_lenEAttr))) {
+ memmove(ea_dst, ea_src, offset - aal);
offset -= aal;
eahd->appAttrLocation =
cpu_to_le32(aal + size);
^ permalink raw reply related
* [PATCH 16/18] net: mpls: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, peterz, netdev, Eric W. Biederman, gregkh, tglx,
torvalds, David S. Miller, Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'index' may be a user controlled value that
is used as a data dependency reading 'rt' from the 'platform_label'
array. In order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue further
reads based on an invalid 'rt' value.
Based on an original patch by Elena Reshetova.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
net/mpls/af_mpls.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 8ca9915befc8..ebcf0e246cfe 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -8,6 +8,7 @@
#include <linux/ipv6.h>
#include <linux/mpls.h>
#include <linux/netconf.h>
+#include <linux/compiler.h>
#include <linux/vmalloc.h>
#include <linux/percpu.h>
#include <net/ip.h>
@@ -77,12 +78,13 @@ static void rtmsg_lfib(int event, u32 label, struct mpls_route *rt,
static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index)
{
struct mpls_route *rt = NULL;
+ struct mpls_route __rcu **platform_label =
+ rcu_dereference(net->mpls.platform_label);
+ struct mpls_route __rcu **rtp;
- if (index < net->mpls.platform_labels) {
- struct mpls_route __rcu **platform_label =
- rcu_dereference(net->mpls.platform_label);
- rt = rcu_dereference(platform_label[index]);
- }
+ if ((rtp = nospec_array_ptr(platform_label, index,
+ net->mpls.platform_labels)))
+ rt = rcu_dereference(*rtp);
return rt;
}
^ permalink raw reply related
* [PATCH 15/18] vfs, fdtable: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, peterz, netdev, Al Viro, gregkh, tglx, torvalds,
Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Expectedly, static analysis reports that 'fd' is a user controlled value
that is used as a data dependency to read from the 'fdt->fd' array. In
order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue reads
based on an invalid 'file *' returned from __fcheck_files.
Based on an original patch by Elena Reshetova.
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
include/linux/fdtable.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 1c65817673db..4a147c5c2533 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -81,9 +81,10 @@ struct dentry;
static inline struct file *__fcheck_files(struct files_struct *files, unsigned int fd)
{
struct fdtable *fdt = rcu_dereference_raw(files->fdt);
+ struct file __rcu **fdp;
- if (fd < fdt->max_fds)
- return rcu_dereference_raw(fdt->fd[fd]);
+ if ((fdp = nospec_array_ptr(fdt->fd, fd, fdt->max_fds)))
+ return rcu_dereference_raw(*fdp);
return NULL;
}
^ permalink raw reply related
* [PATCH 14/18] ipv4: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, Hideaki YOSHIFUJI, netdev, peterz, gregkh,
Alexey Kuznetsov, tglx, torvalds, David S. Miller,
Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'offset' may be a user controlled value
that is used as a data dependency reading from a raw_frag_vec buffer.
In order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue further
reads based on an invalid '*(rfv->c + offset)' value.
Based on an original patch by Elena Reshetova.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
net/ipv4/raw.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 125c1eab3eaa..f72b20131a15 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -57,6 +57,7 @@
#include <linux/in_route.h>
#include <linux/route.h>
#include <linux/skbuff.h>
+#include <linux/compiler.h>
#include <linux/igmp.h>
#include <net/net_namespace.h>
#include <net/dst.h>
@@ -472,17 +473,17 @@ static int raw_getfrag(void *from, char *to, int offset, int len, int odd,
struct sk_buff *skb)
{
struct raw_frag_vec *rfv = from;
+ char *rfv_buf;
- if (offset < rfv->hlen) {
+ if ((rfv_buf = nospec_array_ptr(rfv->hdr.c, offset, rfv->hlen))) {
int copy = min(rfv->hlen - offset, len);
if (skb->ip_summed == CHECKSUM_PARTIAL)
- memcpy(to, rfv->hdr.c + offset, copy);
+ memcpy(to, rfv_buf, copy);
else
skb->csum = csum_block_add(
skb->csum,
- csum_partial_copy_nocheck(rfv->hdr.c + offset,
- to, copy, 0),
+ csum_partial_copy_nocheck(rfv_buf, to, copy, 0),
odd);
odd = 0;
^ permalink raw reply related
* [PATCH 13/18] ipv6: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:11 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, Hideaki YOSHIFUJI, netdev, peterz, gregkh,
Alexey Kuznetsov, tglx, torvalds, David S. Miller,
Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'offset' may be a user controlled value
that is used as a data dependency reading from a raw6_frag_vec buffer.
In order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue further
reads based on an invalid '*(rfv->c + offset)' value.
Based on an original patch by Elena Reshetova.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
net/ipv6/raw.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 761a473a07c5..384e3d59d148 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -33,6 +33,7 @@
#include <linux/skbuff.h>
#include <linux/compat.h>
#include <linux/uaccess.h>
+#include <linux/compiler.h>
#include <asm/ioctls.h>
#include <net/net_namespace.h>
@@ -725,17 +726,17 @@ static int raw6_getfrag(void *from, char *to, int offset, int len, int odd,
struct sk_buff *skb)
{
struct raw6_frag_vec *rfv = from;
+ char *rfv_buf;
- if (offset < rfv->hlen) {
+ if ((rfv_buf = nospec_array_ptr(rfv->c, offset, rfv->hlen))) {
int copy = min(rfv->hlen - offset, len);
if (skb->ip_summed == CHECKSUM_PARTIAL)
- memcpy(to, rfv->c + offset, copy);
+ memcpy(to, rfv_buf, copy);
else
skb->csum = csum_block_add(
skb->csum,
- csum_partial_copy_nocheck(rfv->c + offset,
- to, copy, 0),
+ csum_partial_copy_nocheck(rfv_buf, to, copy, 0),
odd);
odd = 0;
^ permalink raw reply related
* [PATCH 12/18] Thermal/int340x: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, gregkh, peterz, netdev, Eduardo Valentin,
Srinivas Pandruvada, Zhang Rui, torvalds, tglx, Elena Reshetova,
alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'trip' may be a user controlled value that
is used as a data dependency to read '*temp' from the 'd->aux_trips'
array. In order to avoid potential leaks of kernel memory values, block
speculative execution of the instruction stream that could issue reads
based on an invalid value of '*temp'.
Based on an original patch by Elena Reshetova.
Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: Zhang Rui <rui.zhang@intel.com>
Cc: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
.../thermal/int340x_thermal/int340x_thermal_zone.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
index 145a5c53ff5c..442a1d9bf7ad 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
@@ -17,6 +17,7 @@
#include <linux/init.h>
#include <linux/acpi.h>
#include <linux/thermal.h>
+#include <linux/compiler.h>
#include "int340x_thermal_zone.h"
static int int340x_thermal_get_zone_temp(struct thermal_zone_device *zone,
@@ -52,20 +53,21 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone,
int trip, int *temp)
{
struct int34x_thermal_zone *d = zone->devdata;
+ unsigned long *elem;
int i;
if (d->override_ops && d->override_ops->get_trip_temp)
return d->override_ops->get_trip_temp(zone, trip, temp);
- if (trip < d->aux_trip_nr)
- *temp = d->aux_trips[trip];
- else if (trip == d->crt_trip_id)
+ if ((elem = nospec_array_ptr(d->aux_trips, trip, d->aux_trip_nr))) {
+ *temp = *elem;
+ } else if (trip == d->crt_trip_id) {
*temp = d->crt_temp;
- else if (trip == d->psv_trip_id)
+ } else if (trip == d->psv_trip_id) {
*temp = d->psv_temp;
- else if (trip == d->hot_trip_id)
+ } else if (trip == d->hot_trip_id) {
*temp = d->hot_temp;
- else {
+ } else {
for (i = 0; i < INT340X_THERMAL_MAX_ACT_TRIP_COUNT; i++) {
if (d->act_trips[i].valid &&
d->act_trips[i].id == trip) {
^ permalink raw reply related
* [PATCH 11/18] cw1200: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, peterz, netdev, linux-wireless, Elena Reshetova,
Solomon Peachy, gregkh, tglx, torvalds, Kalle Valo, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'queue' may be a user controlled value that
is used as a data dependency to read 'txq_params' from the
'priv->tx_queue_params.params' array. In order to avoid potential leaks
of kernel memory values, block speculative execution of the instruction
stream that could issue reads based on an invalid value of 'txq_params'.
In this case 'txq_params' is referenced later in the function.
Based on an original patch by Elena Reshetova.
Cc: Solomon Peachy <pizza@shaftnet.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
drivers/net/wireless/st/cw1200/sta.c | 10 ++++++----
drivers/net/wireless/st/cw1200/wsm.h | 4 +---
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/st/cw1200/sta.c b/drivers/net/wireless/st/cw1200/sta.c
index 38678e9a0562..886942617f14 100644
--- a/drivers/net/wireless/st/cw1200/sta.c
+++ b/drivers/net/wireless/st/cw1200/sta.c
@@ -14,6 +14,7 @@
#include <linux/firmware.h>
#include <linux/module.h>
#include <linux/etherdevice.h>
+#include <linux/compiler.h>
#include "cw1200.h"
#include "sta.h"
@@ -612,18 +613,19 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
u16 queue, const struct ieee80211_tx_queue_params *params)
{
struct cw1200_common *priv = dev->priv;
+ struct wsm_set_tx_queue_params *txq_params;
int ret = 0;
/* To prevent re-applying PM request OID again and again*/
bool old_uapsd_flags;
mutex_lock(&priv->conf_mutex);
- if (queue < dev->queues) {
+ if ((txq_params = nospec_array_ptr(priv->tx_queue_params.params,
+ queue, dev->queues))) {
old_uapsd_flags = le16_to_cpu(priv->uapsd_info.uapsd_flags);
- WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0);
- ret = wsm_set_tx_queue_params(priv,
- &priv->tx_queue_params.params[queue], queue);
+ WSM_TX_QUEUE_SET(txq_params, 0, 0, 0);
+ ret = wsm_set_tx_queue_params(priv, txq_params, queue);
if (ret) {
ret = -EINVAL;
goto out;
diff --git a/drivers/net/wireless/st/cw1200/wsm.h b/drivers/net/wireless/st/cw1200/wsm.h
index 48086e849515..8c8d9191e233 100644
--- a/drivers/net/wireless/st/cw1200/wsm.h
+++ b/drivers/net/wireless/st/cw1200/wsm.h
@@ -1099,10 +1099,8 @@ struct wsm_tx_queue_params {
};
-#define WSM_TX_QUEUE_SET(queue_params, queue, ack_policy, allowed_time,\
- max_life_time) \
+#define WSM_TX_QUEUE_SET(p, ack_policy, allowed_time, max_life_time) \
do { \
- struct wsm_set_tx_queue_params *p = &(queue_params)->params[queue]; \
p->ackPolicy = (ack_policy); \
p->allowedMediumTime = (allowed_time); \
p->maxTransmitLifetime = (max_life_time); \
^ permalink raw reply related
* [PATCH 10/18] qla2xxx: prevent bounds-check bypass via speculative execution
From: Dan Williams @ 2018-01-06 1:10 UTC (permalink / raw)
To: linux-kernel
Cc: linux-arch, James E.J. Bottomley, Martin K. Petersen, linux-scsi,
gregkh, peterz, netdev, qla2xxx-upstream, tglx, torvalds,
Elena Reshetova, alan
In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com>
Static analysis reports that 'handle' may be a user controlled value
that is used as a data dependency to read 'sp' from the
'req->outstanding_cmds' array. In order to avoid potential leaks of
kernel memory values, block speculative execution of the instruction
stream that could issue reads based on an invalid value of 'sp'. In this
case 'sp' is directly dereferenced later in the function.
Based on an original patch by Elena Reshetova.
Cc: qla2xxx-upstream@qlogic.com
Cc: "James E.J. Bottomley" <jejb@linux.vnet.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
drivers/scsi/qla2xxx/qla_mr.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
index d5da3981cefe..128b41de3784 100644
--- a/drivers/scsi/qla2xxx/qla_mr.c
+++ b/drivers/scsi/qla2xxx/qla_mr.c
@@ -9,6 +9,7 @@
#include <linux/ktime.h>
#include <linux/pci.h>
#include <linux/ratelimit.h>
+#include <linux/compiler.h>
#include <linux/vmalloc.h>
#include <linux/bsg-lib.h>
#include <scsi/scsi_tcq.h>
@@ -2275,7 +2276,7 @@ qlafx00_ioctl_iosb_entry(scsi_qla_host_t *vha, struct req_que *req,
static void
qlafx00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
{
- srb_t *sp;
+ srb_t *sp, **elem;
fc_port_t *fcport;
struct scsi_cmnd *cp;
struct sts_entry_fx00 *sts;
@@ -2304,8 +2305,9 @@ qlafx00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
req = ha->req_q_map[que];
/* Validate handle. */
- if (handle < req->num_outstanding_cmds)
- sp = req->outstanding_cmds[handle];
+ if ((elem = nospec_array_ptr(req->outstanding_cmds, handle,
+ req->num_outstanding_cmds)))
+ sp = *elem;
else
sp = NULL;
@@ -2626,7 +2628,7 @@ static void
qlafx00_multistatus_entry(struct scsi_qla_host *vha,
struct rsp_que *rsp, void *pkt)
{
- srb_t *sp;
+ srb_t *sp, **elem;
struct multi_sts_entry_fx00 *stsmfx;
struct qla_hw_data *ha = vha->hw;
uint32_t handle, hindex, handle_count, i;
@@ -2655,8 +2657,9 @@ qlafx00_multistatus_entry(struct scsi_qla_host *vha,
req = ha->req_q_map[que];
/* Validate handle. */
- if (handle < req->num_outstanding_cmds)
- sp = req->outstanding_cmds[handle];
+ if ((elem = nospec_array_ptr(req->outstanding_cmds, handle,
+ req->num_outstanding_cmds)))
+ sp = *elem;
else
sp = NULL;
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox