From nobody Fri Oct 2 13:10:57 2026 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA048368D55 for ; Fri, 31 Jul 2026 07:05:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481531; cv=none; b=gRKfD+Le7uElTC9GVfQ5wLmh1W54gfUXxPN031FNM2Z0PlXQwz/rl/Qcwou+tzOgCTW/MCKZrc7MS5OVwjIoGL0C3qa5fwiFOpvQWNu80Nr2oCR6Q7NJO4GHxGuuk5ILCIpyg3T31/JN8XfNyR3Yw0Y63RdOaay3IjqZQ5aE36k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481531; c=relaxed/simple; bh=q5UEPjHCTM3HJeezdrQHBgApF6M5fV7Fh+3R+qmBDNI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PnmEPurTrLFHSsYhQ3O0aI2iS3cpTETfKSe1gVn36Gik3Bd+Ce3JKVcYTh/3NOOTu4U1BrpbYM9jNuQdCYlaLMT5TuR9Pr/O0DTPqpfwVVLE9K9+FpbC4esMo79ZQGOah70nM19+tN0+WSXG/Ky+f4ElE0zmJ1/7csE/bgSU9uw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=ynu04UYV; arc=none smtp.client-ip=209.85.210.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="ynu04UYV" Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-8486672f03cso850067b3a.0 for ; Fri, 31 Jul 2026 00:05:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785481529; x=1786086329; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yz1oRNcg19iVfX+eVJWelaG34L/oIKLecIITUvBw3oY=; b=ynu04UYV36bcpXgFNnAm7cnc4cagUawnHr4WtmAI0nh4Sbhdorvf65UnVDq5LOODii URC8pvbePcfFUwdhxYnE+uHBf3hcTxiUwKmffhl6dkwIKQveltFLPWtUPg5Cnm8FUZU7 TExmRZzEn/lUsWOsr8XRHxlhU9U2M0EAErYvC22mMId5W39fqP2bDsMMs5mCqJiU0+YQ 4X3vp5XTvP0Rg/p072uPzb67g5md+xPQRgx+SFZAaCoTeMLIK0nAo8MoW89gViFloh0R qtOqgUKRihJrJc+zGPiVTev18X973uYWLU5I1idaAulXi4BU33qGatUV4bgJyp3aXJzK t35Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785481529; x=1786086329; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yz1oRNcg19iVfX+eVJWelaG34L/oIKLecIITUvBw3oY=; b=j8bw/UqCwUe9jw2rfi/TqXxdrnCFFqdz0h3rI/5BGHg+1bHmGWerlxUI2ibT7De6jB qqHibsuOlIJ9gweqW7BiMdTWI1VPgXWn9+3xhRYUZtnWMbYyVHpvEmIixv8W3ZeEz2he 2vMmEWsSh3WCEioBCW3lznSWa3cn9VhQ76selzlazfnpiuJ58EjAOhgkzIaWP9+zVH7f /z7F4EzJi/+XIbh29aEhlHOZ+1Esr0efdduwQFJV0ERDdpLF08NZiugaCGcHTSVV4kNH Vg62C2iBjLGkqJkPk7BQMk43fkRHFg5Cj9N5hneLziVnmgBe9evuFMEg/XUyfGlQbC+m 4qcg== X-Forwarded-Encrypted: i=1; AHgh+RovIFsOOIUR4QX/T5Sev7TjVKyRGD3QmHnd3B8l6oVp1ScD0szUn+ca4lNaiZ8V6OltHtueerpMO2XHRoE=@vger.kernel.org X-Gm-Message-State: AOJu0YyDJM1YKcHS7BuNGWyUnEDNkDJJkGiTqbKTfCpXukoLZu52gGlR f+EcneBTHWv3IaxD9XW6GFQ6oJ606J3Rc+WC4dzjaYWSLqldV97+Km+8v7FD3XR0ZtdzqVfd415 BaTz+iGWMdQ== X-Gm-Gg: AR+sD11bIFfGYofUj22+Q8SY/BfZHDzXR+l7d2yHOEybREVzzT05xHIQkmUEjtEYcOZ lumFLyHqzm1tvlv2xqhV+4P/cnJevyZ9Ye5GlB/06YxyX4VKw9iDYieQ76zdAVCeK4LBZCjaFYg HP2ZlDnACHqizqT6J/Pg8Xxfmt134yqH2IpE+SWxbR1GTGeX3IKM+GhlWF1UaMvB73X/BvtqfXZ K/708Bi0f8l7rBvJbf2wC0yVakb0qB5Fa8NAxMBZY+CdD2WBjC/dqNkSeoAHgU6hb+HfTa9P0nx zOt19fvvJXMPagEesBly+NgETNE03lTclbexkI8C4lQn4PXL2kpALDvIeCOWGakdU15XvUemmh6 T9/8T4/Aiyas4/E4A8Ok4hLNxwXewi+/VolXCBZszl8qeHtinytzCDUzOZX5ltmDW91y0dEuDxR u9os8bTQyfxYM9XcdArLfYNip5jq+qRu5ufgnpqJRRi5kcQziFjsboBoR8nCIX15Rga8eZ X-Received: by 2002:a05:6a00:990:b0:848:2f7a:2e57 with SMTP id d2e1a72fcca58-84ed722d703mr744876b3a.70.1785481529132; Fri, 31 Jul 2026 00:05:29 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84edc2d4473sm39233b3a.40.2026.07.31.00.05.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 00:05:28 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee , stable@vger.kernel.org Subject: [PATCH net v4 1/3] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Date: Fri, 31 Jul 2026 16:05:07 +0900 Message-ID: <20260731070509.1818665-2-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> References: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc =3D &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ... u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; smc_llc.c:1504 smc_llc_save_add_link_rkeys(link, link_new, llc_msg); smc_llc.c:1506 smc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared v2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is already freed. Before the Fixes: commit that branch always used lgr->wr_rx_buf_v2 and add_llc was not used after the free. Detach the entry instead of freeing it there, and free it explicitly on both exit paths. The reject path has to detach as well, otherwise it would be freed twice. Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_r= ecv_sge equals to 1") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- Reproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot and a link forced to max_recv_sge =3D=3D 1: the entry is freed and read by the sa= me call, and the freeing frame is smc_llc_srv_add_link() itself. BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350 Read of size 2 at addr ffff8880052194de by task kworker/0:1/11 Workqueue: smc_hs_wq smc_listen_work smc_llc_save_add_link_rkeys+0x333/0x350 smc_llc_srv_add_link+0xaa2/0x1e50 smc_listen_work+0x489e/0x4d00 Allocated by task 48: smc_llc_enqueue+0x72/0x560 smc_wr_rx_tasklet_fn+0x474/0xa80 Freed by task 11: kfree+0x121/0x380 smc_llc_srv_add_link+0x9a8/0x1e50 smc_listen_work+0x489e/0x4d00 The buggy address is located 94 bytes inside of freed 96-byte region [ffff888005219480, ffff8880052194e0) The offset is past the 72-byte queue entry because the out-of-bounds read fixed by the next patch is on the same line; what this patch removes is the free at smc_llc_srv_add_link+0x9a8 happening before the read at +0xaa2. net/smc/smc_llc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 954b2ff1815c..90746cd1e29a 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -1481,7 +1481,7 @@ int smc_llc_srv_add_link(struct smc_link *link, } add_llc =3D &qentry->msg.add_link; if (add_llc->hd.flags & SMC_LLC_FLAG_ADD_LNK_REJ) { - smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); + smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl); rc =3D -ENOLINK; goto out_err; } @@ -1492,7 +1492,8 @@ int smc_llc_srv_add_link(struct smc_link *link, lgr_new_t =3D SMC_LGR_ASYMMETRIC_PEER; } smc_llc_save_add_link_info(link_new, add_llc); - smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); + /* add_llc still points into qentry, so only detach it here */ + smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl); =20 rc =3D smc_ib_ready_link(link_new); if (rc) @@ -1512,6 +1513,7 @@ int smc_llc_srv_add_link(struct smc_link *link, rc =3D smc_llc_srv_conf_link(link, link_new, lgr_new_t); if (rc) goto out_err; + kfree(qentry); kfree(ini); return 0; out_err: @@ -1520,6 +1522,7 @@ int smc_llc_srv_add_link(struct smc_link *link, smcr_link_clear(link_new, false); } out: + kfree(qentry); kfree(ini); if (send_req_add_link_resp) smc_llc_send_req_add_link_response(req_qentry); --=20 2.43.0 From nobody Fri Oct 2 13:10:57 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB9662E1F0E for ; Fri, 31 Jul 2026 07:05:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481537; cv=none; b=d4tUZH56gY7NGcvZdNcDDpsvB2FrrqpTGD267kkrcCV0iKZOobHJSaUFXrKwb2YF5aTEjBb862Vku7JJb46J4kuCHtZxhFpcSvEbfqcWP1szqDAqZHkqpbZCGIeL7aUeIFE85PyNsrPLOEQbiNNbUBUxz4CVzXmrpb3gxf3Rd+0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481537; c=relaxed/simple; bh=XecrAEo3DqtUGtYdAI8FRG6FQKrQ5+SiDs/finIWQZ0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=G+hbe9K/mLqLDwc9BVYQnTHz5ssLvzenaw8PkHyQSVt93a+Y84BkJJmhkGSPXAxVZUNQEM3dTAascuOtDXP7LCcAGXVuyWZyURHTqoEVicOZOvg6GiiNodo1r3y5GkgGv48o8N+pHnbf3XPpJmxVMYOCOfURZLjM82QfDxQreyY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=i0WWFV6V; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="i0WWFV6V" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-8487b7b3fc8so829932b3a.3 for ; Fri, 31 Jul 2026 00:05:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785481534; x=1786086334; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ffyeDegVY5OzCAul1Kv1QWcYqJ0UI22/KMFweLvIIWQ=; b=i0WWFV6V9MkVRa97g6SRF5LgbtWQuPXnpLR5Q1DAZ0QYeGdTMLPTv1Mrr67nNKz/wd UrTRBw2Kd8YuAOOBsEQvjcS1j736NR1XlAyLF6dZXYnG1zMaytLXqb63oUPiytgn/9Qy +RPlI1GFJkgIb4SxPvK6mW6ckO//KpUpunljOcA0dquTj8HISQkgLR4Yp1Ug+zmQJ7bw omvctj82l2OO7FyENRP0UK34lZqAUXvQDyuTW9zK1LMPCrou8kFNcYZBhNKDYXAZ2KO/ Va5vP4qYpnOHAFtHDcsRVc4yUiWdnRkGuGeo4ZnZtiiN4MFcpkCXorAo0uykV4v5WbAP MK9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785481534; x=1786086334; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ffyeDegVY5OzCAul1Kv1QWcYqJ0UI22/KMFweLvIIWQ=; b=GrST5wkJ+gqS1qiC13A133sS289TMmNFHBtytOYzC4Z9ulZIVxvJAOU4uOVHC6JCWK MGIDQe2owpaFr7CzgpSK1jg7nyd+q7nf0MbYboBk35APGWsIw/GmGb0Fh6Ei8Q8NaFnx R1IZfiy21fYYsofljJB12EQ3Qit3wMYHptw+HM9RWZoyK5bgv/4Qqdiqp2zdguCeoxhF duROhyqXJ/NhHq+EVtgNMg6WasQoqrRaispPJqwgjXQgPZnyo9MFU6GKNCzAA653U2iq BI3ae8UD1UQYvj8g3lVoTBi3nb6xBwx61Yx3xhDDue+YrdUgzfcdQnDjoHo+60DgJeya g4dg== X-Forwarded-Encrypted: i=1; AHgh+RrpMbGWsswaH2DOjy3uJga5u8wK00Pf2H00BAJCocw6igs/zlJ/BRHXren1BR/uNQuF2UhPh9ovarUZ0wU=@vger.kernel.org X-Gm-Message-State: AOJu0YwjK9X3unFeD787Xz+rPTBfxmICFMtKKY4hEC/szi/4tSbqZeBo ehbbq27u6eVECA1Bi7jhc8kskYmmCRUXg56Q6JfDIW+slrqh6FCYdkWSyohbY3MATTk= X-Gm-Gg: AR+sD10aPZi75kv4MZvsNX4GU4+6qeJYTx0FG+lVdnOgEDhcUarHuSZB6Orwxp7nSXn ngSKJQJ3BMKFAv1wugyvHfe/z4IEtfTjK2/youSsGNa8LpoymjRPcujx+EqZeF2goB5CwHHdKCm PRx8tAf+FTjW68al8Xojpp46dBA403UFjEP9n5Q+QA5kKj4eDVMWY+9pofOozy6GD8o04jXyQtc RmooIgU1HtZ7PIjK0qc415x6Cw28f16nlfPUV9jalMKThTOMc8TChcAv00KKP58E8Bwxvr2qHL5 n6YyENzHzQumhJBklaswVO9iAFeHCcFzYu0lCt3i6qlPoShidTwuF6/XBm0lAq/qEmO+vFfzMpN Yrxu5JYvvuu9lEenxoHphNvKETjtQjmPD5Abr3dM1Hd6KUva8XEs7pDBNKF+IYzgea8jg9hp+tw CG8eFhLmlYNtfYPtEzohrSljepnUQt3c3VtPvAdIvKkKr6p+YLUhAjckcJI+68cAxhEuSk X-Received: by 2002:a05:6a00:298e:b0:84e:1a9d:d879 with SMTP id d2e1a72fcca58-84ed6ecedcfmr669687b3a.28.1785481534224; Fri, 31 Jul 2026 00:05:34 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84edc2d4473sm39233b3a.40.2026.07.31.00.05.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 00:05:33 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee , stable@vger.kernel.org Subject: [PATCH net v4 2/3] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Date: Fri, 31 Jul 2026 16:05:08 +0900 Message-ID: <20260731070509.1818665-3-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> References: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On a link whose device has max_recv_sge =3D=3D 1 there is no shared v2 rece= ive buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44 bytes past the start of the queue entry's inline message: ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); The entry is a 72-byte allocation and the extension starts at offset 68, so ext->num_rkeys at offset 94 is already past it. This happens on every SMC-Rv2 link addition, whatever the peer sends: BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350 Read of size 2 at addr ffff8880056406de by task smctest/106 Call Trace: smc_llc_save_add_link_rkeys+0x333/0x350 smc_llc_cli_add_link+0xca7/0x1e80 __smc_connect+0x3f5c/0x4980 smc_connect+0x42c/0x580 __sys_connect+0xfc/0x130 Allocated by task 44: smc_llc_enqueue+0x72/0x560 smc_wr_rx_tasklet_fn+0x474/0xa80 The buggy address is located 22 bytes to the right of allocated 72-byte region [ffff888005640680, ffff8880056406c8) Whatever that read finds then bounds the ext->rt[] loop, so a peer that declares 255 rkeys reads much further. smc_llc_rmt_delete_rkey() has the same shape for llcv2->rkey[]. Bound both loops by the buffer they read from, and skip the extension altogether when there is no shared v2 receive buffer, because nothing beyond the 44 inline bytes was received in that case. Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_r= ecv_sge equals to 1") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- Measured over rxe with KASAN and max_recv_sge forced to 1, five test cells (plain 1-rkey delete, delete declaring 255, plain ADD_LINK v2, ADD_LINK declaring 255, and an SMC-Rv1 link group). Without this patch four of the five report; with it none do. With kasan_multi_shot the unpatched kernel reports 491 times in a single ADD_LINK run, the patched one not at all. net/smc/smc_llc.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 90746cd1e29a..606d2dc8c7ec 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -1000,13 +1000,22 @@ static void smc_llc_save_add_link_rkeys(struct smc_= link *link, struct smc_link *link_new, u8 *llc_msg) { + const u32 rt_off =3D offsetof(struct smc_llc_msg_add_link_v2_ext, rt); struct smc_llc_msg_add_link_v2_ext *ext; struct smc_link_group *lgr =3D link->lgr; int max, i; =20 + /* The extension follows the 44 bytes of the LLC message. Without a + * shared v2 receive buffer nothing beyond those 44 bytes was received, + * so not even ext->num_rkeys is there to be read. + */ + if (!smc_link_shared_v2_rxbuf(link)) + return; ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); max =3D min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); + max =3D min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) / + sizeof(ext->rt[0])); down_write(&lgr->rmbs_lock); for (i =3D 0; i < max; i++) { smc_rtoken_set(lgr, link->link_idx, link_new->link_idx, @@ -1813,17 +1822,27 @@ static void smc_llc_rmt_delete_rkey(struct smc_link= _group *lgr) link =3D qentry->link; =20 if (lgr->smc_version =3D=3D SMC_V2) { + const u32 rkey_off =3D + offsetof(struct smc_llc_msg_delete_rkey_v2, rkey); struct smc_llc_msg_delete_rkey_v2 *llcv2; + u32 buf_len; =20 if (smc_link_shared_v2_rxbuf(link)) { memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc)); llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2; + buf_len =3D SMC_WR_BUF_V2_SIZE; } else { llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)llc; + buf_len =3D sizeof(qentry->msg); } llcv2->num_inval_rkeys =3D 0; =20 max =3D min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); + /* the rkeys live in the buffer llcv2 points at, and nothing + * beyond it was received + */ + max =3D min_t(u32, max, (buf_len - rkey_off) / + sizeof(llcv2->rkey[0])); for (i =3D 0; i < max; i++) { if (smc_rtoken_delete(link, llcv2->rkey[i])) llcv2->num_inval_rkeys++; --=20 2.43.0 From nobody Fri Oct 2 13:10:57 2026 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 679242E1F0E for ; Fri, 31 Jul 2026 07:05:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481544; cv=none; b=YsE3f2F3+MsZWNET32CEP9LI91m9sGEcAbOYGuQFeRXFlg7XT1RmJuVg/sOXfEm61jmsR0mzloNv92sxkSoYiCIMP6TLgOUxawKxXbbbl9yzLRAqhA5sK5u1KR+TDE0Aa9nwvSsLViCDoKvMMary/7K1LLon3atP31PRifQTZPk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481544; c=relaxed/simple; bh=o8ZLTYxhcXzPRf5S2bPjLwVLXQm4w7mMn2A1mL4EhI4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ab0h7MqobolXoIDN0jHVUcOVlwDLCWoIyULSqlOu9hkBbBDMDpnHzu+XBB/uLBllysTEOZo0uIxI2kbtlx5unU5aL5jNkU9yUGfjFJdg/s+4ghqFDSUHe23fhWLDDYgPfL4dpqfYx3/mG+Rv2vt1CLQAlzSrSA4ZreL76GI5DZ4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=GM7jkiP1; arc=none smtp.client-ip=209.85.210.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="GM7jkiP1" Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-848479c9bd5so596135b3a.3 for ; Fri, 31 Jul 2026 00:05:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785481542; x=1786086342; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FgLt4GkS9rEaQzQpllAATuVO40pAU6qd6YyA7G+85XY=; b=GM7jkiP1VhBAfcQWWthw7Opgblz5IBFGvkLxLQwNeK+0E7FNjRx8/GfDX7F1Mx5U9X onb82ls7cqlgRSZR03OcA/+soY7YRLC779PzoB9+EHwbUuApeieChoKSlXnEqeCUs0C2 HhcCO1EvyTNz50LAfHA2kXKBiqadSvhvU0lN9astGv7bahybQ6E0pIbkbE7bWh8NS3A1 hE81Kfp1yAmSNx+B6/7GiAh+02EwIjNH4BtY1UtW88vz4KIGC5ZwVzjOmEPvurXrHk5E ceI1X0uoPcxNywTyXMoG/x1wMITxlVgdsLDkiuT/6lrp2nO9/h+V5FxZe+4W2siSnQtp evqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785481542; x=1786086342; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=FgLt4GkS9rEaQzQpllAATuVO40pAU6qd6YyA7G+85XY=; b=CeXCmbIRp/n5id7x3TC+T+mnnUhIEoJ+BTK6mB9crTzPaq72RFSNnNBWBslOKayX15 WJMQlnEipxBzJFJH3DVa9g63bDjhat/K+Mx/RL6xpTgeC4FOz7hipqREl+SyRWcwSmk4 eeL1ALnVfavpkb2P5xsQF7B/KjMZ8+DIqPKjFFIBmuij0mdG8VrAqwiMT8nDjPWVMN9t 8GWevLJMoS6QLIwRxovj8OpnealSktR3PUtDBXVqFpS/thOKpBg/5qIS0u7qmmB2aEW6 JAPNpnjF5zJ2YaN+LqdaeukrXdmY1TnNTJhsdk3/EHfuj9fWYya2456BcXhfoLwPDsXM qZDA== X-Forwarded-Encrypted: i=1; AHgh+RpAvLayeMG0vOB17kFRXSMSrH/fyDYH6BVzKboQfKZTrnEKZGK3zPjESDk4s9fX/jdXxHyDnhhF6CGwLBg=@vger.kernel.org X-Gm-Message-State: AOJu0YwKkWIiDfnvBO+Ny1FXmxS8oszawYFeseaa5NiFrDT6z47Q7KJ/ SO5aGSB6Hoc7cywbnSD22ikdWXNQnxk9v34mIWQGtaXCEgrFdStY+pT/DrpQsUeoUpk= X-Gm-Gg: AR+sD13Ekh/olZW4hPHCxVGFIcAUiLRDsBh/oiK1vGeVXALHmTYCCVnr6bX9BG/bPUT 01jdC4adSIj9d73SKNPpQSHrrXlega3VgNIJLFglvqGKeqUJaO6YHOXVxgY53IbIljQPr8KVfOg m+haewuJ6+oILTPkuy58lZ14yAf6G5NqNpK2WIqdddsshOt5CyhVvJZ/9m4htDzXxlBPdhspOy1 PP+cWBmPFob9rOisRe9MyU55cNpkAgPQvDG3mhBq5EyDVvZyKqQObPCSCob8RnuWQLYB3jXHEGE Jw+KlGJXoIGkiOoFstpUKflS/EqyCvv8pR9WyNQKYs1E2OXHkDYuywsXmUTm59iVQPnOzmwFRbf yih+YemMnfiydLXz1IvBMyaB2ufYBXBr278Fzl2NPxpowMb38dyOJ1B9V0rwKGi3fe4onLyZ/e+ MyYDEALOGPvpHpN6oP+PcJtzMXnlpZlm4lnd/mzNDId8WYNzFqXQS78ZLav3dVXtl0gyXC X-Received: by 2002:a05:6a00:1705:b0:84a:2dcb:5ace with SMTP id d2e1a72fcca58-84ed6f1ef31mr739210b3a.62.1785481541624; Fri, 31 Jul 2026 00:05:41 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84edc2d4473sm39233b3a.40.2026.07.31.00.05.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 00:05:41 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee Subject: [PATCH net v4 3/3] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Date: Fri, 31 Jul 2026 16:05:09 +0900 Message-ID: <20260731070509.1818665-4-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> References: <20260731070509.1818665-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" An LLC message longer than the 44-byte union smc_llc_msg arrives either whole in the receive buffer or split into the link group's shared v2 buffer, and both consumers of the tail rebuild that layout themselves. Copy the tail into the queue entry instead, so its length and its lifetime are those of the message that arrived, and declare the rkeys that do fit inline as a member of the union rather than reaching them through a cast of a shorter type. The bound the previous patch placed on links without a shared v2 receive buffer is no longer needed here: the extension is read from the qentry, whose length is the length of the message that arrived. A DELETE_RKEY_V2 is now bounded by what arrived rather than by the buffer it landed in: a 44-byte message declaring 255 rkeys processed 255 of them before, and processes the 9 that fit now. Suggested-by: D. Wythe Signed-off-by: Yehyeong Lee --- Measured over rxe with KASAN: a DELETE_RKEY_V2 carrying 12 rkeys over a link with a shared v2 receive buffer round-trips all 12 values, the last three coming from the copied tail; 8, 9 and 10 rkeys and a 44-byte message declar= ing 10 give 8, 9, 10 and 9 processed rkeys respectively. kmemleak reports noth= ing over the link-addition path, and does report the queue entry when the free added by patch 1 is removed again. net/smc/smc_llc.c | 109 +++++++++++++++++++++++++++++----------------- 1 file changed, 69 insertions(+), 40 deletions(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 606d2dc8c7ec..1b153173dd51 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -157,6 +157,7 @@ struct smc_llc_msg_confirm_rkey { /* type 0x06 */ }; =20 #define SMC_LLC_DEL_RKEY_MAX 8 +#define SMC_LLC_DEL_RKEY_V2_INLINE 9 #define SMC_LLC_FLAG_RKEY_RETRY 0x10 #define SMC_LLC_FLAG_RKEY_NEG 0x20 =20 @@ -177,6 +178,15 @@ struct smc_llc_msg_delete_rkey_v2 { /* type 0x29 */ __be32 rkey[]; }; =20 +/* the leading rkeys of a DELETE_RKEY_V2 fit into union smc_llc_msg */ +struct smc_llc_msg_delete_rkey_v2_inline { /* type 0x29 */ + struct smc_llc_hdr hd; + u8 num_rkeys; + u8 num_inval_rkeys; + u8 reserved[2]; + __be32 rkey[SMC_LLC_DEL_RKEY_V2_INLINE]; +}; + union smc_llc_msg { struct smc_llc_msg_confirm_link confirm_link; struct smc_llc_msg_add_link add_link; @@ -186,6 +196,7 @@ union smc_llc_msg { =20 struct smc_llc_msg_confirm_rkey confirm_rkey; struct smc_llc_msg_delete_rkey delete_rkey; + struct smc_llc_msg_delete_rkey_v2_inline delete_rkey_v2; =20 struct smc_llc_msg_test_link test_link; struct { @@ -194,15 +205,23 @@ union smc_llc_msg { } raw; }; =20 +static_assert(SMC_LLC_DEL_RKEY_V2_INLINE =3D=3D + (sizeof(union smc_llc_msg) - + offsetof(struct smc_llc_msg_delete_rkey_v2, rkey)) / + sizeof(__be32)); + #define SMC_LLC_FLAG_RESP 0x80 =20 struct smc_llc_qentry { struct list_head list; struct smc_link *link; + u16 body_len; union smc_llc_msg msg; + u8 body[] __counted_by(body_len); }; =20 -static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc); +static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc, + u32 byte_len); =20 struct smc_llc_qentry *smc_llc_flow_qentry_clr(struct smc_llc_flow *flow) { @@ -998,23 +1017,19 @@ static int smc_llc_cli_conf_link(struct smc_link *li= nk, =20 static void smc_llc_save_add_link_rkeys(struct smc_link *link, struct smc_link *link_new, - u8 *llc_msg) + struct smc_llc_qentry *qentry) { const u32 rt_off =3D offsetof(struct smc_llc_msg_add_link_v2_ext, rt); struct smc_llc_msg_add_link_v2_ext *ext; struct smc_link_group *lgr =3D link->lgr; int max, i; =20 - /* The extension follows the 44 bytes of the LLC message. Without a - * shared v2 receive buffer nothing beyond those 44 bytes was received, - * so not even ext->num_rkeys is there to be read. - */ - if (!smc_link_shared_v2_rxbuf(link)) + /* the rkey count itself is only there if enough bytes arrived */ + if (qentry->body_len < rt_off) return; - ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + - SMC_WR_TX_SIZE); + ext =3D (struct smc_llc_msg_add_link_v2_ext *)qentry->body; max =3D min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); - max =3D min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) / + max =3D min_t(u32, max, (qentry->body_len - rt_off) / sizeof(ext->rt[0])); down_write(&lgr->rmbs_lock); for (i =3D 0; i < max; i++) { @@ -1108,9 +1123,7 @@ int smc_llc_cli_add_link(struct smc_link *link, struc= t smc_llc_qentry *qentry) if (rc) goto out_clear_lnk; if (lgr->smc_version =3D=3D SMC_V2) { - u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? - (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc; - smc_llc_save_add_link_rkeys(link, lnk_new, llc_msg); + smc_llc_save_add_link_rkeys(link, lnk_new, qentry); } else { rc =3D smc_llc_cli_rkey_exchange(link, lnk_new); if (rc) { @@ -1511,9 +1524,7 @@ int smc_llc_srv_add_link(struct smc_link *link, if (rc) goto out_err; if (lgr->smc_version =3D=3D SMC_V2) { - u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? - (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; - smc_llc_save_add_link_rkeys(link, link_new, llc_msg); + smc_llc_save_add_link_rkeys(link, link_new, qentry); } else { rc =3D smc_llc_srv_rkey_exchange(link, link_new); if (rc) @@ -1564,7 +1575,8 @@ void smc_llc_add_link_local(struct smc_link *link) add_llc.hd.common.llc_type =3D SMC_LLC_ADD_LINK; smc_llc_init_msg_hdr(&add_llc.hd, link->lgr, sizeof(add_llc)); /* no dev and port needed */ - smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc); + smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc, + sizeof(union smc_llc_msg)); } =20 /* worker to process an add link message */ @@ -1600,7 +1612,8 @@ void smc_llc_srv_delete_link_local(struct smc_link *l= ink, u8 del_link_id) del_llc.link_num =3D del_link_id; del_llc.reason =3D htonl(SMC_LLC_DEL_LOST_PATH); del_llc.hd.flags |=3D SMC_LLC_FLAG_DEL_LINK_ORDERLY; - smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc); + smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc, + sizeof(union smc_llc_msg)); } =20 static void smc_llc_process_cli_delete_link(struct smc_link_group *lgr) @@ -1822,29 +1835,28 @@ static void smc_llc_rmt_delete_rkey(struct smc_link= _group *lgr) link =3D qentry->link; =20 if (lgr->smc_version =3D=3D SMC_V2) { - const u32 rkey_off =3D - offsetof(struct smc_llc_msg_delete_rkey_v2, rkey); - struct smc_llc_msg_delete_rkey_v2 *llcv2; - u32 buf_len; - - if (smc_link_shared_v2_rxbuf(link)) { - memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc)); - llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2; - buf_len =3D SMC_WR_BUF_V2_SIZE; - } else { - llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)llc; - buf_len =3D sizeof(qentry->msg); - } + struct smc_llc_msg_delete_rkey_v2_inline *llcv2; + + /* The leading SMC_LLC_DEL_RKEY_V2_INLINE rkeys are declared in + * the message itself, any further ones were received into + * qentry->body. + */ + llcv2 =3D &qentry->msg.delete_rkey_v2; llcv2->num_inval_rkeys =3D 0; =20 max =3D min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); - /* the rkeys live in the buffer llcv2 points at, and nothing - * beyond it was received - */ - max =3D min_t(u32, max, (buf_len - rkey_off) / - sizeof(llcv2->rkey[0])); + max =3D min_t(u32, max, SMC_LLC_DEL_RKEY_V2_INLINE + + qentry->body_len / sizeof(__be32)); for (i =3D 0; i < max; i++) { - if (smc_rtoken_delete(link, llcv2->rkey[i])) + __be32 rkey; + + if (i < SMC_LLC_DEL_RKEY_V2_INLINE) + rkey =3D llcv2->rkey[i]; + else + memcpy(&rkey, qentry->body + + (i - SMC_LLC_DEL_RKEY_V2_INLINE) * + sizeof(rkey), sizeof(rkey)); + if (smc_rtoken_delete(link, rkey)) llcv2->num_inval_rkeys++; } memset(&llc->rkey[0], 0, sizeof(llc->rkey)); @@ -2085,18 +2097,35 @@ static void smc_llc_rx_response(struct smc_link *li= nk, wake_up(&link->lgr->llc_msg_waiter); } =20 -static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc) +static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc, + u32 byte_len) { struct smc_link_group *lgr =3D link->lgr; struct smc_llc_qentry *qentry; unsigned long flags; + u16 body_len =3D 0; =20 - qentry =3D kmalloc_obj(*qentry, GFP_ATOMIC); + /* V2 messages can be longer than the inline union smc_llc_msg. Carry + * the remainder in the qentry itself, so that its lifetime and its + * length match the message the peer actually sent. + */ + if (lgr->smc_version =3D=3D SMC_V2 && byte_len > SMC_WR_TX_SIZE) + body_len =3D min_t(u32, byte_len, SMC_WR_BUF_V2_SIZE) - + SMC_WR_TX_SIZE; + + qentry =3D kmalloc_flex(*qentry, body, body_len, GFP_ATOMIC); if (!qentry) return; + qentry->body_len =3D body_len; qentry->link =3D link; INIT_LIST_HEAD(&qentry->list); memcpy(&qentry->msg, llc, sizeof(union smc_llc_msg)); + if (body_len) { + u8 *src =3D smc_link_shared_v2_rxbuf(link) ? + (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc; + + memcpy(qentry->body, src + SMC_WR_TX_SIZE, body_len); + } =20 /* process responses immediately */ if ((llc->raw.hdr.flags & SMC_LLC_FLAG_RESP) && @@ -2128,7 +2157,7 @@ static void smc_llc_rx_handler(struct ib_wc *wc, void= *buf) return; /* invalid message */ } =20 - smc_llc_enqueue(link, llc); + smc_llc_enqueue(link, llc, wc->byte_len); } =20 /***************************** worker, utils *****************************= ****/ --=20 2.43.0