* Re: [PATCH] ipw2x00: clean up clang warning on extraneous parentheses
From: Kalle Valo @ 2018-10-01 15:49 UTC (permalink / raw)
To: Colin King
Cc: Stanislav Yakovlev, David S . Miller, linux-wireless, netdev,
kernel-janitors, linux-kernel
In-Reply-To: <20180930223809.18136-1-colin.king@canonical.com>
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> There are extraneous parantheses that are causing clang to produce a
> warning so remove these.
>
> Clean up clang warning:
> equality comparison with extraneous parentheses [-Wparentheses-equality]
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
I applied an identical patch few minutes ago:
c15ace868dd1 ipw2x00: Remove unnecessary parentheses
Patch set to Rejected.
--
https://patchwork.kernel.org/patch/10621549/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH iproute2/net-next v2] tc_util: Add support for showing TCA_STATS_BASIC_HW statistics
From: Stephen Hemminger @ 2018-10-01 9:10 UTC (permalink / raw)
To: Eelco Chaudron; +Cc: netdev, davem
In-Reply-To: <4203077A-F558-4C2A-82B2-0B0AA8884240@redhat.com>
On Mon, 01 Oct 2018 09:08:32 +0200
"Eelco Chaudron" <echaudro@redhat.com> wrote:
> On 10 Aug 2018, at 16:48, Eelco Chaudron wrote:
>
> > On 10 Aug 2018, at 16:44, Stephen Hemminger wrote:
> >
> >> On Fri, 10 Aug 2018 07:59:30 -0400
> >> Eelco Chaudron <echaudro@redhat.com> wrote:
> >>
> >>> + if (bs.bytes >= bs_hw.bytes && bs.packets >= bs_hw.packets) {
> >>> + print_string(PRINT_FP, NULL, "%s", _SL_);
> >>> + print_string(PRINT_FP, NULL, "%s", prefix);
> >>> + print_lluint(PRINT_ANY, "sw_bytes",
> >>> + "Sent software %llu bytes",
> >>> + bs.bytes - bs_hw.bytes);
> >>> + print_uint(PRINT_ANY, "sw_packets", " %u pkt",
> >>> + bs.packets - bs_hw.packets);
> >>> + }
> >>> + }
> >>> +
> >>> + print_string(PRINT_FP, NULL, "%s", _SL_);
> >>> + print_string(PRINT_FP, NULL, "%s", prefix);
> >>> + print_lluint(PRINT_ANY, "hw_bytes", "Sent hardware %llu bytes",
> >>> + bs_hw.bytes);
> >>
> >> What does the output look like?
> >
> > See the two +’es below:
> >
> > $ tc -s filter show dev enp3s0np0 parent ffff:
> > filter protocol ip pref 1 flower chain 0
> > filter protocol ip pref 1 flower chain 0 handle 0x1
> > eth_type ipv4
> > dst_ip 2.0.0.0
> > src_ip 1.0.0.0
> > ip_flags nofrag
> > in_hw
> > action order 1: mirred (Egress Redirect to device eth1) stolen
> > index 1 ref 1 bind 1 installed 0 sec used 0 sec
> > Action statistics:
> > Sent 534884742 bytes 8915697 pkt (dropped 0, overlimits 0
> > requeues 0)
> > + Sent software 187542 bytes 4077 pkt
> > + Sent hardware 534697200 bytes 8911620 pkt
> > backlog 0b 0p requeues 0
> > cookie 89173e6a44447001becfd486bda17e29
>
> Hi Stephen, anything else required for this patch to be accepted?
>
> FYI the kernel side of this patch has been excepted on net-next.
>
> Cheers,
>
> Eelco
David Ahern handles net-next see patchwork
https://patchwork.ozlabs.org/patch/956225/
I think he was just waiting for the kernel part to merge.
^ permalink raw reply
* Re: [PATCH net-next] bridge: mcast: Default back to multicast enabled state
From: Nikolay Aleksandrov @ 2018-10-01 9:07 UTC (permalink / raw)
To: Ido Schimmel, netdev; +Cc: davem, roopa, bridge, mlxsw
In-Reply-To: <20181001085701.23295-1-idosch@mellanox.com>
On 01/10/2018 11:57, Ido Schimmel wrote:
> Commit 13cefad2f2c1 ("net: bridge: convert and rename mcast disabled")
> converted the 'multicast_disabled' field to an option bit named
> 'BROPT_MULTICAST_ENABLED'.
>
> While the old field was implicitly initialized to 0, the new field is
> not initialized, resulting in the bridge defaulting to multicast
> disabled state and breaking existing applications.
>
> Fix this by explicitly initializing the option.
>
> Fixes: 13cefad2f2c1 ("net: bridge: convert and rename mcast disabled")
> Signed-off-by: Ido Schimmel <idosch@mellanox.com>
> ---
> net/bridge/br_multicast.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
> index 928024d8360d..024139b51d3a 100644
> --- a/net/bridge/br_multicast.c
> +++ b/net/bridge/br_multicast.c
> @@ -1976,6 +1976,7 @@ void br_multicast_init(struct net_bridge *br)
> br->ip6_other_query.delay_time = 0;
> br->ip6_querier.port = NULL;
> #endif
> + br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
> br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
>
> spin_lock_init(&br->multicast_lock);
>
Thanks,
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
^ permalink raw reply
* Re: [PATCH] b43: fix spelling mistake "hw_registred" -> "hw_registered"
From: Kalle Valo @ 2018-10-01 15:43 UTC (permalink / raw)
To: Colin King
Cc: linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
b43-dev-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Philippe Ombredanne,
David S . Miller
In-Reply-To: <20180927161119.6698-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
Colin King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> wrote:
> From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
>
> Trivial fix to spelling mistake struct field name, rename it.
>
> Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
Patch applied to wireless-drivers-next.git, thanks.
297fab130cdf b43: fix spelling mistake "hw_registred" -> "hw_registered"
--
https://patchwork.kernel.org/patch/10618179/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] b43: fix spelling mistake "hw_registred" -> "hw_registered"
From: Kalle Valo @ 2018-10-01 15:43 UTC (permalink / raw)
To: Colin King
Cc: David S . Miller, Philippe Ombredanne, linux-wireless, b43-dev,
netdev, kernel-janitors, linux-kernel
In-Reply-To: <20180927161119.6698-1-colin.king@canonical.com>
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Trivial fix to spelling mistake struct field name, rename it.
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Patch applied to wireless-drivers-next.git, thanks.
297fab130cdf b43: fix spelling mistake "hw_registred" -> "hw_registered"
--
https://patchwork.kernel.org/patch/10618179/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH 5/7] MIPS: mscc: ocelot: add GPIO4 pinmuxing DT node
From: Quentin Schulz @ 2018-10-01 9:02 UTC (permalink / raw)
To: Alexandre Belloni
Cc: ralf, paul.burton, jhogan, robh+dt, mark.rutland, davem, andrew,
f.fainelli, allan.nielsen, linux-mips, devicetree, linux-kernel,
netdev, thomas.petazzoni, antoine.tenart
In-Reply-To: <20180914180222.GT14988@piout.net>
[-- Attachment #1: Type: text/plain, Size: 1720 bytes --]
Hi Alexandre,
On Fri, Sep 14, 2018 at 08:02:22PM +0200, Alexandre Belloni wrote:
> On 14/09/2018 18:26:38+0200, Quentin Schulz wrote:
> > Hi Alexandre,
> >
> > On Fri, Sep 14, 2018 at 04:54:46PM +0200, Alexandre Belloni wrote:
> > > Hi,
> > >
> > > On 14/09/2018 11:44:26+0200, Quentin Schulz wrote:
> > > > In order to use GPIO4 as a GPIO, we need to mux it in this mode so let's
> > > > declare a new pinctrl DT node for it.
> > > >
> > > > Signed-off-by: Quentin Schulz <quentin.schulz@bootlin.com>
> > > > ---
> > > > arch/mips/boot/dts/mscc/ocelot.dtsi | 5 +++++
> > > > 1 file changed, 5 insertions(+)
> > > >
> > > > diff --git a/arch/mips/boot/dts/mscc/ocelot.dtsi b/arch/mips/boot/dts/mscc/ocelot.dtsi
> > > > index 8ce317c..b5c4c74 100644
> > > > --- a/arch/mips/boot/dts/mscc/ocelot.dtsi
> > > > +++ b/arch/mips/boot/dts/mscc/ocelot.dtsi
> > > > @@ -182,6 +182,11 @@
> > > > interrupts = <13>;
> > > > #interrupt-cells = <2>;
> > > >
> > > > + gpio4: gpio4 {
> > > > + pins = "GPIO_4";
> > > > + function = "gpio";
> > > > + };
> > > > +
> > >
> > > For a GPIO, I would do that in the board dts because it is not used
> > > directly in the dtsi.
> > >
> >
> > And the day we've two boards using this pinctrl we move it to a dtsi. Is
> > that the plan?
> >
>
> Not really, at least not for gpios. I've included the pinctrl for the
> uart, i2c and spi because they are the only option if you are to use
> those peripherals. Else, I've would have left the pinctrl to the board
> file. From my point of view, the gpios are too board specific to be in a
> soc dtsi.
>
Understood, will move it to the board file.
Thanks,
Quentin
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v2] rtlwifi: btcoex: Use proper enumerated types for Wi-Fi only interface
From: Kalle Valo @ 2018-10-01 15:37 UTC (permalink / raw)
To: Nathan Chancellor
Cc: Ping-Ke Shih, linux-wireless, netdev, linux-kernel,
Nathan Chancellor
In-Reply-To: <20180923063114.11446-1-natechancellor@gmail.com>
Nathan Chancellor <natechancellor@gmail.com> wrote:
> Clang warns when one enumerated type is implicitly converted to another.
>
> drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c:1327:34:
> warning: implicit conversion from enumeration type 'enum
> btc_chip_interface' to different enumeration type 'enum
> wifionly_chip_interface' [-Wenum-conversion]
> wifionly_cfg->chip_interface = BTC_INTF_PCI;
> ~ ^~~~~~~~~~~~
> drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c:1330:34:
> warning: implicit conversion from enumeration type 'enum
> btc_chip_interface' to different enumeration type 'enum
> wifionly_chip_interface' [-Wenum-conversion]
> wifionly_cfg->chip_interface = BTC_INTF_USB;
> ~ ^~~~~~~~~~~~
> drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c:1333:34:
> warning: implicit conversion from enumeration type 'enum
> btc_chip_interface' to different enumeration type 'enum
> wifionly_chip_interface' [-Wenum-conversion]
> wifionly_cfg->chip_interface = BTC_INTF_UNKNOWN;
> ~ ^~~~~~~~~~~~~~~~
> 3 warnings generated.
>
> Use the values from the correct enumerated type, wifionly_chip_interface.
>
> BTC_INTF_UNKNOWN = WIFIONLY_INTF_UNKNOWN = 0
> BTC_INTF_PCI = WIFIONLY_INTF_PCI = 1
> BTC_INTF_USB = WIFIONLY_INTF_USB = 2
>
> Link: https://github.com/ClangBuiltLinux/linux/issues/135
> Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Patch applied to wireless-drivers-next.git, thanks.
31138a827d1b rtlwifi: btcoex: Use proper enumerated types for Wi-Fi only interface
--
https://patchwork.kernel.org/patch/10611603/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* [PATCH 5/6] xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
Since commit 222d7dbd258d ("net: prevent dst uses after free")
skb_dst_force() might clear the dst_entry attached to the skb.
The xfrm code don't expect this to happen, so we crash with
a NULL pointer dereference in this case. Fix it by checking
skb_dst(skb) for NULL after skb_dst_force() and drop the packet
in cast the dst_entry was cleared.
Fixes: 222d7dbd258d ("net: prevent dst uses after free")
Reported-by: Tobias Hommel <netdev-list@genoetigt.de>
Reported-by: Kristian Evensen <kristian.evensen@gmail.com>
Reported-by: Wolfgang Walter <linux@stwm.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_output.c | 4 ++++
net/xfrm/xfrm_policy.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 89b178a78dc7..36d15a38ce5e 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -101,6 +101,10 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
spin_unlock_bh(&x->lock);
skb_dst_force(skb);
+ if (!skb_dst(skb)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+ goto error_nolock;
+ }
if (xfrm_offload(skb)) {
x->type_offload->encap(x, skb);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 7c5e8978aeaa..626e0f4d1749 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2548,6 +2548,10 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
}
skb_dst_force(skb);
+ if (!skb_dst(skb)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
+ return 0;
+ }
dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, XFRM_LOOKUP_QUEUE);
if (IS_ERR(dst)) {
--
2.17.1
^ permalink raw reply related
* [PATCH 4/6] xfrm: reset crypto_done when iterating over multiple input xfrms
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
We only support one offloaded xfrm (we do not have devices that
can handle more than one offload), so reset crypto_done in
xfrm_input() when iterating over multiple transforms in xfrm_input,
so that we can invoke the appropriate x->type->input for the
non-offloaded transforms
Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_input.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 352abca2605f..86f5afbd0a0c 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -453,6 +453,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
goto drop;
}
+ crypto_done = false;
} while (!err);
err = xfrm_rcv_cb(skb, family, x->type->proto, 0);
--
2.17.1
^ permalink raw reply related
* [PATCH 6/6] xfrm: validate template mode
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
From: Sean Tranchetti <stranche@codeaurora.org>
XFRM mode parameters passed as part of the user templates
in the IP_XFRM_POLICY are never properly validated. Passing
values other than valid XFRM modes can cause stack-out-of-bounds
reads to occur later in the XFRM processing:
[ 140.535608] ================================================================
[ 140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4
[ 140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148
[ 140.557369]
[ 140.558927] Call trace:
[ 140.558936] dump_backtrace+0x0/0x388
[ 140.558940] show_stack+0x24/0x30
[ 140.558946] __dump_stack+0x24/0x2c
[ 140.558949] dump_stack+0x8c/0xd0
[ 140.558956] print_address_description+0x74/0x234
[ 140.558960] kasan_report+0x240/0x264
[ 140.558963] __asan_report_load4_noabort+0x2c/0x38
[ 140.558967] xfrm_state_find+0x17e4/0x1cc4
[ 140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8
[ 140.558975] xfrm_lookup+0x238/0x1444
[ 140.558977] xfrm_lookup_route+0x48/0x11c
[ 140.558984] ip_route_output_flow+0x88/0xc4
[ 140.558991] raw_sendmsg+0xa74/0x266c
[ 140.558996] inet_sendmsg+0x258/0x3b0
[ 140.559002] sock_sendmsg+0xbc/0xec
[ 140.559005] SyS_sendto+0x3a8/0x5a8
[ 140.559008] el0_svc_naked+0x34/0x38
[ 140.559009]
[ 140.592245] page dumped because: kasan: bad access detected
[ 140.597981] page_owner info is not active (free page?)
[ 140.603267]
[ 140.653503] ================================================================
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_user.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5151b3ebf068..d0672c400c2f 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1455,6 +1455,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
(ut[i].family != prev_family))
return -EINVAL;
+ if (ut[i].mode >= XFRM_MODE_MAX)
+ return -EINVAL;
+
prev_family = ut[i].family;
switch (ut[i].family) {
--
2.17.1
^ permalink raw reply related
* [PATCH 3/6] xfrm: reset transport header back to network header after all input transforms ahave been applied
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
A policy may have been set up with multiple transforms (e.g., ESP
and ipcomp). In this situation, the ingress IPsec processing
iterates in xfrm_input() and applies each transform in turn,
processing the nexthdr to find any additional xfrm that may apply.
This patch resets the transport header back to network header
only after the last transformation so that subsequent xfrms
can find the correct transport header.
Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Suggested-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv4/xfrm4_input.c | 1 +
net/ipv4/xfrm4_mode_transport.c | 4 +---
net/ipv6/xfrm6_input.c | 1 +
net/ipv6/xfrm6_mode_transport.c | 4 +---
4 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index bcfc00e88756..f8de2482a529 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -67,6 +67,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
if (xo && (xo->flags & XFRM_GRO)) {
skb_mac_header_rebuild(skb);
+ skb_reset_transport_header(skb);
return 0;
}
diff --git a/net/ipv4/xfrm4_mode_transport.c b/net/ipv4/xfrm4_mode_transport.c
index 3d36644890bb..1ad2c2c4e250 100644
--- a/net/ipv4/xfrm4_mode_transport.c
+++ b/net/ipv4/xfrm4_mode_transport.c
@@ -46,7 +46,6 @@ static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
{
int ihl = skb->data - skb_transport_header(skb);
- struct xfrm_offload *xo = xfrm_offload(skb);
if (skb->transport_header != skb->network_header) {
memmove(skb_transport_header(skb),
@@ -54,8 +53,7 @@ static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
skb->network_header = skb->transport_header;
}
ip_hdr(skb)->tot_len = htons(skb->len + ihl);
- if (!xo || !(xo->flags & XFRM_GRO))
- skb_reset_transport_header(skb);
+ skb_reset_transport_header(skb);
return 0;
}
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 841f4a07438e..9ef490dddcea 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -59,6 +59,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
if (xo && (xo->flags & XFRM_GRO)) {
skb_mac_header_rebuild(skb);
+ skb_reset_transport_header(skb);
return -1;
}
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 9ad07a91708e..3c29da5defe6 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -51,7 +51,6 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
{
int ihl = skb->data - skb_transport_header(skb);
- struct xfrm_offload *xo = xfrm_offload(skb);
if (skb->transport_header != skb->network_header) {
memmove(skb_transport_header(skb),
@@ -60,8 +59,7 @@ static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
}
ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
sizeof(struct ipv6hdr));
- if (!xo || !(xo->flags & XFRM_GRO))
- skb_reset_transport_header(skb);
+ skb_reset_transport_header(skb);
return 0;
}
--
2.17.1
^ permalink raw reply related
* [PATCH 1/6] xfrm: Validate address prefix lengths in the xfrm selector.
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
We don't validate the address prefix lengths in the xfrm
selector we got from userspace. This can lead to undefined
behaviour in the address matching functions if the prefix
is too big for the given address family. Fix this by checking
the prefixes and refuse SA/policy insertation when a prefix
is invalid.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Air Icy <icytxw@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_user.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 33878e6e0d0a..5151b3ebf068 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
err = -EINVAL;
switch (p->family) {
case AF_INET:
+ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ goto out;
+
break;
case AF_INET6:
#if IS_ENABLED(CONFIG_IPV6)
+ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+ goto out;
+
break;
#else
err = -EAFNOSUPPORT;
@@ -1359,10 +1365,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
switch (p->sel.family) {
case AF_INET:
+ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ return -EINVAL;
+
break;
case AF_INET6:
#if IS_ENABLED(CONFIG_IPV6)
+ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+ return -EINVAL;
+
break;
#else
return -EAFNOSUPPORT;
--
2.17.1
^ permalink raw reply related
* [PATCH 2/6] xfrm6: call kfree_skb when skb is toobig
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20181001085855.12057-1-steffen.klassert@secunet.com>
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching
and reporting on xmit"), some too big skbs might be potentially passed down to
__xfrm6_output, causing it to fail to transmit but not free the skb, causing a
leak of skb, and consequentially a leak of dst references.
After running pmtu.sh, that shows as failure to unregister devices in a namespace:
[ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1
The fix is to call kfree_skb in case of transmit failures.
Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv6/xfrm6_output.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 5959ce9620eb..6a74080005cf 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -170,9 +170,11 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
if (toobig && xfrm6_local_dontfrag(skb)) {
xfrm6_local_rxpmtu(skb, mtu);
+ kfree_skb(skb);
return -EMSGSIZE;
} else if (!skb->ignore_df && toobig && skb->sk) {
xfrm_local_error(skb, mtu);
+ kfree_skb(skb);
return -EMSGSIZE;
}
--
2.17.1
^ permalink raw reply related
* pull request (net): ipsec 2018-10-01
From: Steffen Klassert @ 2018-10-01 8:58 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
1) Validate address prefix lengths in the xfrm selector,
otherwise we may hit undefined behaviour in the
address matching functions if the prefix is too
big for the given address family.
2) Fix skb leak on local message size errors.
From Thadeu Lima de Souza Cascardo.
3) We currently reset the transport header back to the network
header after a transport mode transformation is applied. This
leads to an incorrect transport header when multiple transport
mode transformations are applied. Reset the transport header
only after all transformations are already applied to fix this.
From Sowmini Varadhan.
4) We only support one offloaded xfrm, so reset crypto_done after
the first transformation in xfrm_input(). Otherwise we may call
the wrong input method for subsequent transformations.
From Sowmini Varadhan.
5) Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
skb_dst_force does not really force a dst refcount anymore, it might
clear it instead. xfrm code did not expect this, add a check to not
dereference skb_dst() if it was cleared by skb_dst_force.
6) Validate xfrm template mode, otherwise we can get a stack-out-of-bounds
read in xfrm_state_find. From Sean Tranchetti.
Please pull or let me know if there are problems.
Thanks!
The following changes since commit 25432eba9cd8f2ef5afef55be811b010a004b5fa:
openvswitch: meter: Fix setting meter id for new entries (2018-07-29 13:20:54 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git master
for you to fetch changes up to 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa:
xfrm: validate template mode (2018-09-20 08:30:42 +0200)
----------------------------------------------------------------
Sean Tranchetti (1):
xfrm: validate template mode
Sowmini Varadhan (2):
xfrm: reset transport header back to network header after all input transforms ahave been applied
xfrm: reset crypto_done when iterating over multiple input xfrms
Steffen Klassert (2):
xfrm: Validate address prefix lengths in the xfrm selector.
xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
Thadeu Lima de Souza Cascardo (1):
xfrm6: call kfree_skb when skb is toobig
net/ipv4/xfrm4_input.c | 1 +
net/ipv4/xfrm4_mode_transport.c | 4 +---
net/ipv6/xfrm6_input.c | 1 +
net/ipv6/xfrm6_mode_transport.c | 4 +---
net/ipv6/xfrm6_output.c | 2 ++
net/xfrm/xfrm_input.c | 1 +
net/xfrm/xfrm_output.c | 4 ++++
net/xfrm/xfrm_policy.c | 4 ++++
net/xfrm/xfrm_user.c | 15 +++++++++++++++
9 files changed, 30 insertions(+), 6 deletions(-)
^ permalink raw reply
* [PATCH net-next] bridge: mcast: Default back to multicast enabled state
From: Ido Schimmel @ 2018-10-01 8:57 UTC (permalink / raw)
To: netdev; +Cc: davem, nikolay, roopa, bridge, mlxsw, Ido Schimmel
Commit 13cefad2f2c1 ("net: bridge: convert and rename mcast disabled")
converted the 'multicast_disabled' field to an option bit named
'BROPT_MULTICAST_ENABLED'.
While the old field was implicitly initialized to 0, the new field is
not initialized, resulting in the bridge defaulting to multicast
disabled state and breaking existing applications.
Fix this by explicitly initializing the option.
Fixes: 13cefad2f2c1 ("net: bridge: convert and rename mcast disabled")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
---
net/bridge/br_multicast.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 928024d8360d..024139b51d3a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1976,6 +1976,7 @@ void br_multicast_init(struct net_bridge *br)
br->ip6_other_query.delay_time = 0;
br->ip6_querier.port = NULL;
#endif
+ br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
spin_lock_init(&br->multicast_lock);
--
2.17.1
^ permalink raw reply related
* Re: [PATCH] rsi: Remove unnecessary boolean condition
From: Kalle Valo @ 2018-10-01 15:32 UTC (permalink / raw)
To: Nathan Chancellor; +Cc: linux-wireless, netdev, linux-kernel, Nathan Chancellor
In-Reply-To: <20180921094828.16976-1-natechancellor@gmail.com>
Nathan Chancellor <natechancellor@gmail.com> wrote:
> Clang warns that the address of a pointer will always evaluated as true
> in a boolean context.
>
> drivers/net/wireless/rsi/rsi_91x_mac80211.c:927:50: warning: address of
> array 'key->key' will always evaluate to 'true'
> [-Wpointer-bool-conversion]
> if (vif->type == NL80211_IFTYPE_STATION && key->key &&
> ~~ ~~~~~^~~
> 1 warning generated.
>
> Link: https://github.com/ClangBuiltLinux/linux/issues/136
> Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Patch applied to wireless-drivers-next.git, thanks.
f613e4803dd6 rsi: Remove unnecessary boolean condition
--
https://patchwork.kernel.org/patch/10609513/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ipw2x00: Remove unnecessary parentheses
From: Kalle Valo @ 2018-10-01 15:30 UTC (permalink / raw)
To: Nathan Chancellor
Cc: Stanislav Yakovlev, linux-wireless, netdev, linux-kernel,
Nathan Chancellor
In-Reply-To: <20180920204548.2405-1-natechancellor@gmail.com>
Nathan Chancellor <natechancellor@gmail.com> wrote:
> Clang warns when multiple pairs of parentheses are used for a single
> conditional statement.
>
> drivers/net/wireless/intel/ipw2x00/ipw2200.c:5655:28: warning: equality
> comparison with extraneous parentheses [-Wparentheses-equality]
> if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
> ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
> drivers/net/wireless/intel/ipw2x00/ipw2200.c:5655:28: note: remove
> extraneous parentheses around the comparison to silence this warning
> if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
> ~ ^ ~
> drivers/net/wireless/intel/ipw2x00/ipw2200.c:5655:28: note: use '=' to
> turn this equality comparison into an assignment
> if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
> ^~
> =
> 1 warning generated.
>
> Link: https://github.com/ClangBuiltLinux/linux/issues/134
> Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Patch applied to wireless-drivers-next.git, thanks.
c15ace868dd1 ipw2x00: Remove unnecessary parentheses
--
https://patchwork.kernel.org/patch/10608735/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH net-next v1 1/5] net: allow binding socket in a VRF when there's an unbound socket
From: Mike Manning @ 2018-10-01 8:48 UTC (permalink / raw)
To: David Ahern, netdev; +Cc: Robert Shearman
In-Reply-To: <d00ca59b-1065-0f5e-f798-8551e1e01be2@gmail.com>
On 25/09/2018 18:16, David Ahern wrote:
> On 9/25/18 9:26 AM, Mike Manning wrote:
>> On 24/09/2018 23:44, David Ahern wrote:
>>> On 9/24/18 10:13 AM, Mike Manning wrote:
>>>> From: Robert Shearman <rshearma@vyatta.att-mail.com>
>>>>
>>>> There is no easy way currently for applications that want to receive
>>>> packets in the default VRF to be isolated from packets arriving in
>>>> VRFs, which makes using VRF-unaware applications in a VRF-aware system
>>>> a potential security risk.
>>> That comment is not correct.
>>>
>>> The point of the l3mdev sysctl's is to prohibit this case. Setting
>>> net.ipv4.{tcp,udp}_l3mdev_accept=0 means that a packet arriving on an
>>> interface enslaved to a VRF can not be received by a global socket.
>> Hi David, thanks for reviewing this. The converse does not hold though,
>> i.e. there is no guarantee that the unbound socket will be selected for
>> packets when not in a VRF, if there is an unbound socket and a socket
>> bound to a VRF. Also, such packets should not be handled by the socket
> I need an explicit example here. You are saying a packet arriving on an
> interface not enslaved to a VRF might match a socket bound to a VRF?
This problem occurs when different service instances are listening on an
unbound socket and sockets bound to VRFs respectively. Received packets
that are not in a VRF are not guaranteed to be handled by the unbound
socket.
>> in the VRF if there is no unbound socket. We also had an issue with raw
>> socket lookup device bind matching. I can break this particular patch
>> into smaller patches and provide more detail, would this help? I will
>> also update/break up the other patches according to your comments.
> Why not add an l3mdev sysctl for raw sockets then?
I have now added this, see patch 4/10.
> Yes, please send smaller patches. A diff stat of:
> 15 files changed, 109 insertions(+), 62 deletions(-)
> is a bit harsh.
I have removed the 2 patches you are ok with and have submitted them
separately , and have split the remaining 3 into 10 smaller patches.
>>> Setting the l3mdev to 1 allows the default socket to work across VRFs.
>>> If that is not what you want for a given app or a given VRF, then one
>>> option is to add netfilter rules on the VRF device to prohibit it. I
>>> just verified this works for both tcp and udp.
>> Netfilter is per application and so does not scale. I have not checked
>> if it is suitable for packet handling on raw sockets.
>>
>>> Further, overlapping binds are allowed using SO_REUSEPORT meaning I can
>>> have a server running in the default vrf bound to a port AND a server
>>> running bound to a specific vrf and the same port:
>>>
>>> udp UNCONN 0 0 *%red:12345 *:*
>>> users:(("vrf-test",pid=1376,fd=3))
>>> udp UNCONN 0 0 *:12345 *:*
>>> users:(("vrf-test",pid=1375,fd=3))
>>>
>>> tcp LISTEN 0 1 *%red:12345 *:*
>>> users:(("vrf-test",pid=1356,fd=3))
>>> tcp LISTEN 0 1 *:12345 *:*
>>> users:(("vrf-test",pid=1352,fd=3))
>>>
>>> For packets arriving on an interface enslaved to a VRF the socket lookup
>>> will pick the VRF server over the global one.
>> Agreed, but the converse is not guaranteed to hold i.e. packets that are
>> not in a VRF may be handled by a socket bound to a VRF.
>>
>> We do use SO_REUSEPORT for our own applications so as to run instances
>> in the default and other VRFs, but still require these patches (or
>> similar) due to how packets are handled when there is an unbound socket
>> and sockets bound to different VRFs.
> Why can't compute_score be adjusted to account for that case?
Yes, this is what we are doing. This is now in patch 2/10 for stream and
3/10 for datagram sockets, and see 5/10 for raw sockets.
>>> --
>>>
>>> With this patch set I am seeing a number of tests failing -- socket
>>> connections working when they should not or not working when they
>>> should. I only skimmed the results. I am guessing this patch is the
>>> reason, but that is just a guess.
>>>
>>> You need to make sure all permutations of:
>>> 1. net.ipv4.{tcp,udp}_l3mdev_accept={0,1},
>>> 2. connection in the default VRF and in a VRF,
>>> 3. locally originated and remote traffic,
>>> 4. ipv4 and ipv6
>>>
>> We are using raw, datagram and stream sockets for ipv4 & ipv6, require
>> connectivity for local and remote addresses where appropriate and need
>> route leaking between VRFs when configured, we are unaware of any
>> outstanding bugs. Is there some way that I can run/analyze the tests
>> that are failing for you?
> I am not distributing my vrf tests right now. Before sending the
> response I quickly verified one case is easy for you to see: set the udp
> sysctl to 0, start a global server, send a packet to it via an interface
> enslaved to a VRF. It should fail ECONNREFUSED (no socket match) but
> instead packet reaches the server.
I have tried with netcat & socat to check this, and while the
connectivity handling is correct, this does not show the failure error
(it doesn't without the changes either). Before I look further into
this, can I check whether you had only the udp sysctl set to 0 i.e. the
tcp sysctl to 1? The reason I ask is that in the original series, we
were using a common function inet_sk_bound_dev_eq() for
raw/stream/datagram sockets, and this fn was checking only the tcp
sysctl (as we always have the udp and tcp sysctl set to 0). In series
v2, I have provided separate fns which check the relevant raw, tcp or
udp sysctl.
>> Also cf patch 2/5 note that ping to link-local addresses is handled
>> consistently with that to global addresses in a VRF, so this now
>> succeeds if ping is done in the VRF, i.e. 'sudo ip vrf exec <vrf> ping
>> <ll> -I <intf>
> Shifting packets destined to a LLA from the real device to the vrf
> device is a change in behavior. It is not clear to me at the moment that
> it will not cause a problem.
I have provided a clearer description of why we have had to do this in
patch 7/10.
>>> continue to work as expected meaning packets flow when they should and
>>> fail with the right error when they should not. I believe the UDP cases
>>> were the main ones failing.
>>>
>>> Given the test failures, I did not look at the code changes in the patch.
>>>
> A couple of the patches are fine as is - or need a small change. It
> might be easier for you to send those outside of the socket lookup set.
Thank you for reviewing these.
^ permalink raw reply
* Re: [PATCH net 2/5] net/smc: remove duplicate mutex_unlock
From: Ursula Braun @ 2018-10-01 15:22 UTC (permalink / raw)
To: Dan Carpenter, kbuild
Cc: kbuild-all, davem, netdev, linux-s390, schwidefsky,
heiko.carstens, raspl, linux-kernel
In-Reply-To: <20180920091243.xgansymg6a4dfixg@mwanda>
On 09/20/2018 11:12 AM, Dan Carpenter wrote:
> Hi Ursula,
>
> I love your patch! Perhaps something to improve:
>
> [auto build test WARNING on net/master]
>
> url: https://github.com/0day-ci/linux/commits/Ursula-Braun/net-smc-fixes-2018-09-18/20180919-080857
>
> smatch warnings:
> net/smc/af_smc.c:1289 smc_listen_work() warn: inconsistent returns 'mutex:&smc_create_lgr_pending'.
> Locked on: line 1285
> Unlocked on: line 1209
>
> # https://github.com/0day-ci/linux/commit/c69342ef9becfe90f3778db1c386abdd80b786d1
> git remote add linux-review https://github.com/0day-ci/linux
> git remote update linux-review
> git checkout c69342ef9becfe90f3778db1c386abdd80b786d1
> vim +1289 net/smc/af_smc.c
>
> 3b2dec260 Hans Wippel 2018-05-18 1231 /* IPSec connections opt out of SMC-R optimizations */
> 3b2dec260 Hans Wippel 2018-05-18 1232 if (using_ipsec(new_smc)) {
> 3b2dec260 Hans Wippel 2018-05-18 1233 smc_listen_decline(new_smc, SMC_CLC_DECL_IPSEC, 0);
> 3b2dec260 Hans Wippel 2018-05-18 1234 return;
> 3b2dec260 Hans Wippel 2018-05-18 1235 }
> 3b2dec260 Hans Wippel 2018-05-18 1236
> 3b2dec260 Hans Wippel 2018-05-18 1237 mutex_lock(&smc_create_lgr_pending);
> 3b2dec260 Hans Wippel 2018-05-18 1238 smc_close_init(new_smc);
> 3b2dec260 Hans Wippel 2018-05-18 1239 smc_rx_init(new_smc);
> 3b2dec260 Hans Wippel 2018-05-18 1240 smc_tx_init(new_smc);
> 3b2dec260 Hans Wippel 2018-05-18 1241
> 413498440 Hans Wippel 2018-06-28 1242 /* check if ISM is available */
> 413498440 Hans Wippel 2018-06-28 1243 if ((pclc->hdr.path == SMC_TYPE_D || pclc->hdr.path == SMC_TYPE_B) &&
> 413498440 Hans Wippel 2018-06-28 1244 !smc_check_ism(new_smc, &ismdev) &&
> 413498440 Hans Wippel 2018-06-28 1245 !smc_listen_ism_init(new_smc, pclc, ismdev, &local_contact)) {
> 413498440 Hans Wippel 2018-06-28 1246 ism_supported = true;
> 413498440 Hans Wippel 2018-06-28 1247 }
> 413498440 Hans Wippel 2018-06-28 1248
> 3b2dec260 Hans Wippel 2018-05-18 1249 /* check if RDMA is available */
> 413498440 Hans Wippel 2018-06-28 1250 if (!ism_supported &&
> 413498440 Hans Wippel 2018-06-28 1251 ((pclc->hdr.path != SMC_TYPE_R && pclc->hdr.path != SMC_TYPE_B) ||
> 7005ada68 Ursula Braun 2018-07-25 1252 smc_vlan_by_tcpsk(new_smc->clcsock, &vlan) ||
> 7005ada68 Ursula Braun 2018-07-25 1253 smc_check_rdma(new_smc, &ibdev, &ibport, vlan, NULL) ||
> 3b2dec260 Hans Wippel 2018-05-18 1254 smc_listen_rdma_check(new_smc, pclc) ||
> 3b2dec260 Hans Wippel 2018-05-18 1255 smc_listen_rdma_init(new_smc, pclc, ibdev, ibport,
> 3b2dec260 Hans Wippel 2018-05-18 1256 &local_contact) ||
> 413498440 Hans Wippel 2018-06-28 1257 smc_listen_rdma_reg(new_smc, local_contact))) {
> 3b2dec260 Hans Wippel 2018-05-18 1258 /* SMC not supported, decline */
> 145686baa Ursula Braun 2017-10-25 1259 mutex_unlock(&smc_create_lgr_pending);
> 603cc1498 Karsten Graul 2018-07-25 1260 smc_listen_decline(new_smc, SMC_CLC_DECL_MODEUNSUPP,
> 603cc1498 Karsten Graul 2018-07-25 1261 local_contact);
> 3b2dec260 Hans Wippel 2018-05-18 1262 return;
> a046d57da Ursula Braun 2017-01-09 1263 }
> a046d57da Ursula Braun 2017-01-09 1264
> 3b2dec260 Hans Wippel 2018-05-18 1265 /* send SMC Accept CLC message */
> 3b2dec260 Hans Wippel 2018-05-18 1266 rc = smc_clc_send_accept(new_smc, local_contact);
> 3b2dec260 Hans Wippel 2018-05-18 1267 if (rc) {
> 145686baa Ursula Braun 2017-10-25 1268 mutex_unlock(&smc_create_lgr_pending);
> 3b2dec260 Hans Wippel 2018-05-18 1269 smc_listen_decline(new_smc, rc, local_contact);
> 3b2dec260 Hans Wippel 2018-05-18 1270 return;
> 3b2dec260 Hans Wippel 2018-05-18 1271 }
> 3b2dec260 Hans Wippel 2018-05-18 1272
> 3b2dec260 Hans Wippel 2018-05-18 1273 /* receive SMC Confirm CLC message */
> 3b2dec260 Hans Wippel 2018-05-18 1274 reason_code = smc_clc_wait_msg(new_smc, &cclc, sizeof(cclc),
> 3b2dec260 Hans Wippel 2018-05-18 1275 SMC_CLC_CONFIRM);
> 3b2dec260 Hans Wippel 2018-05-18 1276 if (reason_code) {
> 3b2dec260 Hans Wippel 2018-05-18 1277 mutex_unlock(&smc_create_lgr_pending);
> 3b2dec260 Hans Wippel 2018-05-18 1278 smc_listen_decline(new_smc, reason_code, local_contact);
> 3b2dec260 Hans Wippel 2018-05-18 1279 return;
> 3b2dec260 Hans Wippel 2018-05-18 1280 }
> 3b2dec260 Hans Wippel 2018-05-18 1281
> 3b2dec260 Hans Wippel 2018-05-18 1282 /* finish worker */
> c69342ef9 Ursula Braun 2018-09-18 1283 if (!ism_supported) {
> c69342ef9 Ursula Braun 2018-09-18 1284 if (smc_listen_rdma_finish(new_smc, &cclc, local_contact))
> c69342ef9 Ursula Braun 2018-09-18 1285 return;
> ^^^^^^
> We need to mutex_unlock(&smc_create_lgr_pending); before the return.
>
The smatch warning is not necessary, since the mutex_unlock(&smc_create_lgr_pending)
for this case is done within smc_listen_rdma_finish().
> c69342ef9 Ursula Braun 2018-09-18 1286 }
> 3b2dec260 Hans Wippel 2018-05-18 1287 smc_conn_save_peer_info(new_smc, &cclc);
> 3b2dec260 Hans Wippel 2018-05-18 1288 mutex_unlock(&smc_create_lgr_pending);
> 3b2dec260 Hans Wippel 2018-05-18 @1289 smc_listen_out_connected(new_smc);
> a046d57da Ursula Braun 2017-01-09 1290 }
> a046d57da Ursula Braun 2017-01-09 1291
>
> ---
> 0-DAY kernel test infrastructure Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all Intel Corporation
>
But you could argue the code confuses smatch and other readers. Thus I could improve
readability with a patch like this:
---
net/smc/af_smc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1184,7 +1184,6 @@ static int smc_listen_rdma_finish(struct
return 0;
decline:
- mutex_unlock(&smc_create_lgr_pending);
smc_listen_decline(new_smc, reason_code, local_contact);
return reason_code;
}
@@ -1284,8 +1283,10 @@ static void smc_listen_work(struct work_
/* finish worker */
if (!ism_supported) {
- if (smc_listen_rdma_finish(new_smc, &cclc, local_contact))
+ if (smc_listen_rdma_finish(new_smc, &cclc, local_contact)) {
+ mutex_unlock(&smc_create_lgr_pending);
return;
+ }
}
smc_conn_save_peer_info(new_smc, &cclc);
mutex_unlock(&smc_create_lgr_pending);
---
^ permalink raw reply
* [PATCH net-next v2 10/10] ipv6: do not drop vrf udp multicast packets
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev; +Cc: Dewi Morgan
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
From: Dewi Morgan <morgand@vyatta.att-mail.com>
For bound udp sockets in a vrf, also check the sdif to get the index
for ingress devices enslaved to an l3mdev.
Signed-off-by: Dewi Morgan <morgand@vyatta.att-mail.com>
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
net/ipv6/udp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6722490c87b9..821fdc31dbc0 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -637,7 +637,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk,
__be16 loc_port, const struct in6_addr *loc_addr,
__be16 rmt_port, const struct in6_addr *rmt_addr,
- int dif, unsigned short hnum)
+ int dif, int sdif, unsigned short hnum)
{
struct inet_sock *inet = inet_sk(sk);
@@ -649,7 +649,7 @@ static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk,
(inet->inet_dport && inet->inet_dport != rmt_port) ||
(!ipv6_addr_any(&sk->sk_v6_daddr) &&
!ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) ||
- (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) ||
+ !udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif) ||
(!ipv6_addr_any(&sk->sk_v6_rcv_saddr) &&
!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)))
return false;
@@ -683,6 +683,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
unsigned int offset = offsetof(typeof(*sk), sk_node);
unsigned int hash2 = 0, hash2_any = 0, use_hash2 = (hslot->count > 10);
int dif = inet6_iif(skb);
+ int sdif = inet6_sdif(skb);
struct hlist_node *node;
struct sk_buff *nskb;
@@ -697,7 +698,8 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) {
if (!__udp_v6_is_mcast_sock(net, sk, uh->dest, daddr,
- uh->source, saddr, dif, hnum))
+ uh->source, saddr, dif, sdif,
+ hnum))
continue;
/* If zero checksum and no_check is not on for
* the socket then skip it.
--
2.11.0
^ permalink raw reply related
* [PATCH net-next v2 08/10] ipv6: allow ping to link-local address in VRF
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
If link-local packets are marked as enslaved to a VRF, then to allow
ping to the link-local from a vrf, the error handling for IPV6_PKTINFO
needs to be relaxed to also allow the pkt ipi6_ifindex to be that of a
slave device to the vrf.
Note that the real device also needs to be retrieved in icmp6_iif()
to set the ipv6 flow oif to this for icmp echo reply handling. The
recent commit 24b711edfc34 ("net/ipv6: Fix linklocal to global address
with VRF") takes care of this, so the sdif does not need checking here.
This fix makes ping to link-local consistent with that to global
addresses, in that this can now be done from within the same VRF that
the address is in.
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
net/ipv6/ipv6_sockglue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 7dfbc797b130..4ebd395dd3df 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -486,7 +486,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
retv = -EFAULT;
break;
}
- if (sk->sk_bound_dev_if && pkt.ipi6_ifindex != sk->sk_bound_dev_if)
+ if (!sk_dev_equal_l3scope(sk, pkt.ipi6_ifindex))
goto e_inval;
np->sticky_pktinfo.ipi6_ifindex = pkt.ipi6_ifindex;
--
2.11.0
^ permalink raw reply related
* [PATCH net-next v2 09/10] ipv6: handling of multicast packets received in VRF
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev; +Cc: Dewi Morgan
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
If the skb for multicast packets marked as enslaved to a VRF are
received, then the secondary device index should be used to obtain
the real device. And verify the multicast address against the
enslaved rather than the l3mdev device.
Signed-off-by: Dewi Morgan <morgand@vyatta.att-mail.com>
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
net/ipv6/ip6_input.c | 35 ++++++++++++++++++++++++++++++++---
1 file changed, 32 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 96577e742afd..df58e1100226 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -359,6 +359,8 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
}
} else if (ipprot->flags & INET6_PROTO_FINAL) {
const struct ipv6hdr *hdr;
+ int sdif = inet6_sdif(skb);
+ struct net_device *dev;
/* Only do this once for first final protocol */
have_final = true;
@@ -371,9 +373,19 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
skb_postpull_rcsum(skb, skb_network_header(skb),
skb_network_header_len(skb));
hdr = ipv6_hdr(skb);
+
+ /* skb->dev passed may be master dev for vrfs. */
+ if (sdif) {
+ dev = dev_get_by_index_rcu(net, sdif);
+ if (!dev)
+ goto discard;
+ } else {
+ dev = skb->dev;
+ }
+
if (ipv6_addr_is_multicast(&hdr->daddr) &&
- !ipv6_chk_mcast_addr(skb->dev, &hdr->daddr,
- &hdr->saddr) &&
+ !ipv6_chk_mcast_addr(dev, &hdr->daddr,
+ &hdr->saddr) &&
!ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb)))
goto discard;
}
@@ -432,15 +444,32 @@ EXPORT_SYMBOL_GPL(ip6_input);
int ip6_mc_input(struct sk_buff *skb)
{
+ int sdif = inet6_sdif(skb);
const struct ipv6hdr *hdr;
+ struct net_device *dev;
bool deliver;
__IP6_UPD_PO_STATS(dev_net(skb_dst(skb)->dev),
__in6_dev_get_safely(skb->dev), IPSTATS_MIB_INMCAST,
skb->len);
+ /* skb->dev passed may be master dev for vrfs. */
+ if (sdif) {
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(dev_net(skb->dev), sdif);
+ if (!dev) {
+ rcu_read_unlock();
+ kfree_skb(skb);
+ return -ENODEV;
+ }
+ } else {
+ dev = skb->dev;
+ }
+
hdr = ipv6_hdr(skb);
- deliver = ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
+ deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, NULL);
+ if (sdif)
+ rcu_read_unlock();
#ifdef CONFIG_IPV6_MROUTE
/*
--
2.11.0
^ permalink raw reply related
* [PATCH net-next v2 04/10] net: provide a sysctl raw_l3mdev_accept for raw socket lookup with VRFs
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
Add a sysctl raw_l3mdev_accept to control raw socket lookup in a manner
similar to use of tcp_l3mdev_accept for stream and of udp_l3mdev_accept
for datagram sockets. Have this default to off as this is what users
expect, given that there is no explicit mechanism to set unmodified
VRF-unaware application into a default VRF.
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
Documentation/networking/ip-sysctl.txt | 9 +++++++++
Documentation/networking/vrf.txt | 8 +++++---
include/net/netns/ipv4.h | 3 +++
net/ipv4/sysctl_net_ipv4.c | 11 +++++++++++
4 files changed, 28 insertions(+), 3 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 8313a636dd53..a46be4a5b7a0 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -788,6 +788,15 @@ udp_wmem_min - INTEGER
total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
Default: 4K
+RAW variables:
+
+raw_l3mdev_accept - BOOLEAN
+ Enabling this option allows a "global" bound socket to work
+ across L3 master domains (e.g., VRFs) with packets capable of
+ being received regardless of the L3 domain in which they
+ originated. Only valid when the kernel was compiled with
+ CONFIG_NET_L3_MASTER_DEV.
+
CIPSOv4 Variables:
cipso_cache_enable - BOOLEAN
diff --git a/Documentation/networking/vrf.txt b/Documentation/networking/vrf.txt
index d4b129402d57..deb798342f1e 100644
--- a/Documentation/networking/vrf.txt
+++ b/Documentation/networking/vrf.txt
@@ -108,11 +108,13 @@ limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.
-TCP & UDP services running in the default VRF context (ie., not bound
-to any VRF device) can work across all VRF domains by enabling the
-tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:
+TCP & UDP services & services using RAW sockets that are running in the
+default VRF context (ie., not bound to any VRF device) can work across
+all VRF domains by enabling the tcp_l3mdev_accept, udp_l3mdev_accept and
+raw_l3mdev_accept sysctl options:
sysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1
+ sysctl -w net.ipv4.raw_l3mdev_accept=1
netfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index e47503b4e4d1..104a6669e344 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -103,6 +103,9 @@ struct netns_ipv4 {
/* Shall we try to damage output packets if routing dev changes? */
int sysctl_ip_dynaddr;
int sysctl_ip_early_demux;
+#ifdef CONFIG_NET_L3_MASTER_DEV
+ int sysctl_raw_l3mdev_accept;
+#endif
int sysctl_tcp_early_demux;
int sysctl_udp_early_demux;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b92f422f2fa8..d173337040ee 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -601,6 +601,17 @@ static struct ctl_table ipv4_net_table[] = {
.mode = 0644,
.proc_handler = ipv4_ping_group_range,
},
+#ifdef CONFIG_NET_L3_MASTER_DEV
+ {
+ .procname = "raw_l3mdev_accept",
+ .data = &init_net.ipv4.sysctl_raw_l3mdev_accept,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &zero,
+ .extra2 = &one,
+ },
+#endif
{
.procname = "tcp_ecn",
.data = &init_net.ipv4.sysctl_tcp_ecn,
--
2.11.0
^ permalink raw reply related
* [PATCH net-next v2 07/10] vrf: mark skb for multicast or link-local as enslaved to VRF
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
The skb for packets that are multicast or to a link-local address are
not marked as being enslaved to a VRF, if they are received on a socket
bound to the VRF. This is needed for ND and it is preferable for the
kernel not to have to deal with the additional use-cases if ll or mcast
packets are handled as enslaved. However, this does not allow service
instances listening on unbound and bound to VRF sockets to distinguish
the VRF used, if packets are sent as multicast or to a link-local
address. The fix is for the VRF driver to also mark these skb as being
enslaved to the VRF.
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
drivers/net/vrf.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 69b7227c637e..21ad4b1d7f03 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -981,24 +981,23 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
struct sk_buff *skb)
{
int orig_iif = skb->skb_iif;
- bool need_strict;
+ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+ bool is_ndisc = ipv6_ndisc_frame(skb);
- /* loopback traffic; do not push through packet taps again.
- * Reset pkt_type for upper layers to process skb
+ /* loopback, multicast & non-ND link-local traffic; do not push through
+ * packet taps again. Reset pkt_type for upper layers to process skb
*/
- if (skb->pkt_type == PACKET_LOOPBACK) {
+ if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
skb->dev = vrf_dev;
skb->skb_iif = vrf_dev->ifindex;
IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
- skb->pkt_type = PACKET_HOST;
+ if (skb->pkt_type == PACKET_LOOPBACK)
+ skb->pkt_type = PACKET_HOST;
goto out;
}
- /* if packet is NDISC or addressed to multicast or link-local
- * then keep the ingress interface
- */
- need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
- if (!ipv6_ndisc_frame(skb) && !need_strict) {
+ /* if packet is NDISC then keep the ingress interface */
+ if (!is_ndisc) {
vrf_rx_stats(vrf_dev, skb->len);
skb->dev = vrf_dev;
skb->skb_iif = vrf_dev->ifindex;
--
2.11.0
^ permalink raw reply related
* [PATCH net-next v2 02/10] net: ensure unbound stream socket to be chosen when not in a VRF
From: Mike Manning @ 2018-10-01 8:43 UTC (permalink / raw)
To: netdev
In-Reply-To: <20181001084320.32453-1-mmanning@vyatta.att-mail.com>
The commit a04a480d4392 ("net: Require exact match for TCP socket
lookups if dif is l3mdev") only ensures that the correct socket is
selected for packets in a VRF. However, there is no guarantee that
the unbound socket will be selected for packets when not in a VRF.
By checking for a device match in compute_score() also for the case
when there is no bound device and attaching a score to this, the
unbound socket is selected. And if a failure is returned when there
is no device match, this ensures that bound sockets are never selected,
even if there is no unbound socket.
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
---
include/net/inet_hashtables.h | 11 +++++++++++
include/net/inet_sock.h | 8 ++++++++
net/ipv4/inet_hashtables.c | 14 ++++++--------
net/ipv6/inet6_hashtables.c | 14 ++++++--------
4 files changed, 31 insertions(+), 16 deletions(-)
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 4ae060b4bac2..5de2d9f24c05 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -189,6 +189,17 @@ static inline void inet_ehash_locks_free(struct inet_hashinfo *hashinfo)
hashinfo->ehash_locks = NULL;
}
+static inline bool inet_sk_bound_dev_eq(struct net *net, int bound_dev_if,
+ int dif, int sdif)
+{
+#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
+ return inet_bound_dev_eq(net->ipv4.sysctl_tcp_l3mdev_accept,
+ bound_dev_if, dif, sdif);
+#else
+ return inet_bound_dev_eq(1, bound_dev_if, dif, sdif);
+#endif
+}
+
struct inet_bind_bucket *
inet_bind_bucket_create(struct kmem_cache *cachep, struct net *net,
struct inet_bind_hashbucket *head,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 92e0aa3958f6..47c03ea989ad 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -143,6 +143,14 @@ static inline int inet_sk_bound_l3mdev(const struct sock *sk)
return 0;
}
+static inline bool inet_bound_dev_eq(bool l3mdev_accept, int bound_dev_if,
+ int dif, int sdif)
+{
+ if (!bound_dev_if)
+ return !sdif || l3mdev_accept;
+ return bound_dev_if == dif || bound_dev_if == sdif;
+}
+
static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq)
{
return rcu_dereference_check(ireq->ireq_opt,
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 260531dc6458..2ec684057ebd 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -235,6 +235,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
{
int score = -1;
struct inet_sock *inet = inet_sk(sk);
+ bool dev_match;
if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
!ipv6_only_sock(sk)) {
@@ -245,15 +246,12 @@ static inline int compute_score(struct sock *sk, struct net *net,
return -1;
score += 4;
}
- if (sk->sk_bound_dev_if || exact_dif) {
- bool dev_match = (sk->sk_bound_dev_if == dif ||
- sk->sk_bound_dev_if == sdif);
+ dev_match = inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if,
+ dif, sdif);
+ if (!dev_match)
+ return -1;
+ score += 4;
- if (!dev_match)
- return -1;
- if (sk->sk_bound_dev_if)
- score += 4;
- }
if (sk->sk_incoming_cpu == raw_smp_processor_id())
score++;
}
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 3d7c7460a0c5..5eeeba7181a1 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -99,6 +99,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
const int dif, const int sdif, bool exact_dif)
{
int score = -1;
+ bool dev_match;
if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
sk->sk_family == PF_INET6) {
@@ -109,15 +110,12 @@ static inline int compute_score(struct sock *sk, struct net *net,
return -1;
score++;
}
- if (sk->sk_bound_dev_if || exact_dif) {
- bool dev_match = (sk->sk_bound_dev_if == dif ||
- sk->sk_bound_dev_if == sdif);
+ dev_match = inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if,
+ dif, sdif);
+ if (!dev_match)
+ return -1;
+ score++;
- if (!dev_match)
- return -1;
- if (sk->sk_bound_dev_if)
- score++;
- }
if (sk->sk_incoming_cpu == raw_smp_processor_id())
score++;
}
--
2.11.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox