From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.19 10/92] net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
Date: Tue, 28 Jan 2020 15:07:38 +0100 [thread overview]
Message-ID: <20200128135810.511448336@linuxfoundation.org> (raw)
In-Reply-To: <20200128135809.344954797@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit d836f5c69d87473ff65c06a6123e5b2cf5e56f5b ]
rtnl_create_link() needs to apply dev->min_mtu and dev->max_mtu
checks that we apply in do_setlink()
Otherwise malicious users can crash the kernel, for example after
an integer overflow :
BUG: KASAN: use-after-free in memset include/linux/string.h:365 [inline]
BUG: KASAN: use-after-free in __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
Write of size 32 at addr ffff88819f20b9c0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
memset+0x24/0x40 mm/kasan/common.c:108
memset include/linux/string.h:365 [inline]
__alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
alloc_skb include/linux/skbuff.h:1049 [inline]
alloc_skb_with_frags+0x93/0x590 net/core/skbuff.c:5664
sock_alloc_send_pskb+0x7ad/0x920 net/core/sock.c:2242
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2259
mld_newpack+0x1d7/0x7f0 net/ipv6/mcast.c:1609
add_grhead.isra.0+0x299/0x370 net/ipv6/mcast.c:1713
add_grec+0x7db/0x10b0 net/ipv6/mcast.c:1844
mld_send_cr net/ipv6/mcast.c:1970 [inline]
mld_ifc_timer_expire+0x3d3/0x950 net/ipv6/mcast.c:2477
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: 98 6b ea f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 44 1c 60 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 34 1c 60 00 fb f4 <c3> cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 4e 5d 9a f9 e8 79
RSP: 0018:ffffffff89807ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13266ae RBX: ffffffff8987a1c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff8987aa54
RBP: ffffffff89807d18 R08: ffffffff8987a1c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff8a799980 R14: 0000000000000000 R15: 0000000000000000
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
default_idle_call+0x84/0xb0 kernel/sched/idle.c:94
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
rest_init+0x23b/0x371 init/main.c:451
arch_call_rest_init+0xe/0x1b
start_kernel+0x904/0x943 init/main.c:784
x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242
The buggy address belongs to the page:
page:ffffea00067c82c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
raw: 057ffe0000000000 ffffea00067c82c8 ffffea00067c82c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88819f20b880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88819f20b900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88819f20b980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88819f20ba00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88819f20ba80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/netdevice.h | 2 ++
net/core/dev.c | 29 +++++++++++++++++++----------
net/core/rtnetlink.c | 13 +++++++++++--
3 files changed, 32 insertions(+), 12 deletions(-)
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3579,6 +3579,8 @@ int dev_set_alias(struct net_device *, c
int dev_get_alias(const struct net_device *, char *, size_t);
int dev_change_net_namespace(struct net_device *, struct net *, const char *);
int __dev_set_mtu(struct net_device *, int);
+int dev_validate_mtu(struct net_device *dev, int mtu,
+ struct netlink_ext_ack *extack);
int dev_set_mtu_ext(struct net_device *dev, int mtu,
struct netlink_ext_ack *extack);
int dev_set_mtu(struct net_device *, int);
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7752,6 +7752,22 @@ int __dev_set_mtu(struct net_device *dev
}
EXPORT_SYMBOL(__dev_set_mtu);
+int dev_validate_mtu(struct net_device *dev, int new_mtu,
+ struct netlink_ext_ack *extack)
+{
+ /* MTU must be positive, and in range */
+ if (new_mtu < 0 || new_mtu < dev->min_mtu) {
+ NL_SET_ERR_MSG(extack, "mtu less than device minimum");
+ return -EINVAL;
+ }
+
+ if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
+ NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
+ return -EINVAL;
+ }
+ return 0;
+}
+
/**
* dev_set_mtu_ext - Change maximum transfer unit
* @dev: device
@@ -7768,16 +7784,9 @@ int dev_set_mtu_ext(struct net_device *d
if (new_mtu == dev->mtu)
return 0;
- /* MTU must be positive, and in range */
- if (new_mtu < 0 || new_mtu < dev->min_mtu) {
- NL_SET_ERR_MSG(extack, "mtu less than device minimum");
- return -EINVAL;
- }
-
- if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
- NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
- return -EINVAL;
- }
+ err = dev_validate_mtu(dev, new_mtu, extack);
+ if (err)
+ return err;
if (!netif_device_present(dev))
return -ENODEV;
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2875,8 +2875,17 @@ struct net_device *rtnl_create_link(stru
dev->rtnl_link_ops = ops;
dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
- if (tb[IFLA_MTU])
- dev->mtu = nla_get_u32(tb[IFLA_MTU]);
+ if (tb[IFLA_MTU]) {
+ u32 mtu = nla_get_u32(tb[IFLA_MTU]);
+ int err;
+
+ err = dev_validate_mtu(dev, mtu, NULL);
+ if (err) {
+ free_netdev(dev);
+ return ERR_PTR(err);
+ }
+ dev->mtu = mtu;
+ }
if (tb[IFLA_ADDRESS]) {
memcpy(dev->dev_addr, nla_data(tb[IFLA_ADDRESS]),
nla_len(tb[IFLA_ADDRESS]));
next prev parent reply other threads:[~2020-01-28 14:32 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-28 14:07 [PATCH 4.19 00/92] 4.19.100-stable review Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 01/92] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 02/92] firestream: fix memory leaks Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 03/92] gtp: make sure only SOCK_DGRAM UDP sockets are accepted Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 04/92] ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 05/92] net: bcmgenet: Use netif_tx_napi_add() for TX NAPI Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 06/92] net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 07/92] net: ip6_gre: fix moving ip6gre between namespaces Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 08/92] net, ip6_tunnel: fix namespaces move Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 09/92] net, ip_tunnel: " Greg Kroah-Hartman
2020-01-28 14:07 ` Greg Kroah-Hartman [this message]
2020-01-28 14:07 ` [PATCH 4.19 11/92] net_sched: fix datalen for ematch Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 12/92] net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 13/92] net-sysfs: fix netdev_queue_add_kobject() breakage Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 14/92] net-sysfs: Call dev_hold always in netdev_queue_add_kobject Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 15/92] net-sysfs: Call dev_hold always in rx_queue_add_kobject Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 16/92] net-sysfs: Fix reference count leak Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 17/92] net: usb: lan78xx: Add .ndo_features_check Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 18/92] Revert "udp: do rmem bulk free even if the rx sk queue is empty" Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 19/92] tcp_bbr: improve arithmetic division in bbr_update_bw() Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 20/92] tcp: do not leave dangling pointers in tp->highest_sack Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 21/92] tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 22/92] afs: Fix characters allowed into cell names Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 23/92] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 24/92] hwmon: (core) Do not use device managed functions for memory allocations Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 25/92] PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 26/92] tracing: trigger: Replace unneeded RCU-list traversals Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 27/92] Input: keyspan-remote - fix control-message timeouts Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 28/92] Revert "Input: synaptics-rmi4 - dont increment rmiaddr for SMBus transfers" Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 29/92] ARM: 8950/1: ftrace/recordmcount: filter relocation types Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 30/92] mmc: tegra: fix SDR50 tuning override Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.19 31/92] mmc: sdhci: fix minimum clock rate for v3 controller Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 32/92] Documentation: Document arm64 kpti control Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 33/92] Input: pm8xxx-vib - fix handling of separate enable register Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 34/92] Input: sur40 - fix interface sanity checks Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 35/92] Input: gtco - fix endpoint sanity check Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 36/92] Input: aiptek " Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 37/92] Input: pegasus_notetaker " Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 38/92] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 39/92] netfilter: nft_osf: add missing check for DREG attribute Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 40/92] hwmon: (nct7802) Fix voltage limits to wrong registers Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 41/92] scsi: RDMA/isert: Fix a recently introduced regression related to logout Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 42/92] tracing: xen: Ordered comparison of function pointers Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 43/92] do_last(): fetch directory ->i_mode and ->i_uid before its too late Greg Kroah-Hartman
2020-01-31 10:08 ` Rantala, Tommi T. (Nokia - FI/Espoo)
2020-01-31 12:20 ` Al Viro
2020-01-31 13:57 ` Rantala, Tommi T. (Nokia - FI/Espoo)
2020-01-28 14:08 ` [PATCH 4.19 44/92] net/sonic: Add mutual exclusion for accessing shared state Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 45/92] net/sonic: Clear interrupt flags immediately Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 46/92] net/sonic: Use MMIO accessors Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 47/92] net/sonic: Fix interface error stats collection Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 48/92] net/sonic: Fix receive buffer handling Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 49/92] net/sonic: Avoid needless receive descriptor EOL flag updates Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 50/92] net/sonic: Improve receive descriptor status flag check Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 51/92] net/sonic: Fix receive buffer replenishment Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 52/92] net/sonic: Quiesce SONIC before re-initializing descriptor memory Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 53/92] net/sonic: Fix command register usage Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 54/92] net/sonic: Fix CAM initialization Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 55/92] net/sonic: Prevent tx watchdog timeout Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 56/92] tracing: Use hist triggers var_ref array to destroy var_refs Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 57/92] tracing: Remove open-coding of hist trigger var_ref management Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 58/92] tracing: Fix histogram code when expression has same var as value Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 59/92] sd: Fix REQ_OP_ZONE_REPORT completion handling Greg Kroah-Hartman
2020-01-28 18:02 ` Pavel Machek
2020-01-28 18:15 ` Greg Kroah-Hartman
2020-01-29 1:05 ` Damien Le Moal
2020-01-28 14:08 ` [PATCH 4.19 60/92] crypto: geode-aes - switch to skcipher for cbc(aes) fallback Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 61/92] coresight: etb10: Do not call smp_processor_id from preemptible Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 62/92] coresight: tmc-etf: " Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 63/92] libertas: Fix two buffer overflows at parsing bss descriptor Greg Kroah-Hartman
2020-01-29 22:47 ` Pavel Machek
2020-01-28 14:08 ` [PATCH 4.19 64/92] media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 65/92] scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 66/92] netfilter: ipset: use bitmap infrastructure completely Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 67/92] netfilter: nf_tables: add __nft_chain_type_get() Greg Kroah-Hartman
2020-01-28 18:13 ` Pavel Machek
2020-01-28 14:08 ` [PATCH 4.19 68/92] net/x25: fix nonblocking connect Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 69/92] mm/memory_hotplug: make remove_memory() take the device_hotplug_lock Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 70/92] mm, sparse: drop pgdat_resize_lock in sparse_add/remove_one_section() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 71/92] mm, sparse: pass nid instead of pgdat to sparse_add_one_section() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 72/92] drivers/base/memory.c: remove an unnecessary check on NR_MEM_SECTIONS Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 73/92] mm, memory_hotplug: add nid parameter to arch_remove_memory Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 74/92] mm/memory_hotplug: release memory resource after arch_remove_memory() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 75/92] drivers/base/memory.c: clean up relics in function parameters Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 76/92] mm, memory_hotplug: update a comment in unregister_memory() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 77/92] mm/memory_hotplug: make unregister_memory_section() never fail Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 78/92] mm/memory_hotplug: make __remove_section() " Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 79/92] powerpc/mm: Fix section mismatch warning Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 80/92] mm/memory_hotplug: make __remove_pages() and arch_remove_memory() never fail Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 88/92] mm/hotplug: kill is_dev_zone() usage in __remove_pages() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 89/92] drivers/base/node.c: simplify unregister_memory_block_under_nodes() Greg Kroah-Hartman
2020-01-28 14:08 ` [PATCH 4.19 91/92] mm/memory_hotplug: fix try_offline_node() Greg Kroah-Hartman
2020-01-28 14:09 ` [PATCH 4.19 92/92] mm/memory_hotplug: shrink zones when offlining memory Greg Kroah-Hartman
2020-01-28 23:03 ` [PATCH 4.19 00/92] 4.19.100-stable review shuah
2020-01-29 4:54 ` Naresh Kamboju
2020-01-29 11:31 ` Pavel Machek
2020-01-29 12:57 ` Greg Kroah-Hartman
2020-01-29 13:16 ` Jon Hunter
2020-01-29 14:43 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200128135810.511448336@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).