From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jslaby@suse.cz>, b.zolnierkie@samsung.com
Cc: linux-kernel@vger.kernel.org,
Yang Yingliang <yangyingliang@huawei.com>,
Kyungtae Kim <kt0755@gmail.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Greg KH <greg@kroah.com>, Solar Designer <solar@openwall.com>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>,
Anthony Liguori <aliguori@amazon.com>,
Security Officers <security@kernel.org>,
linux-distros@vs.openwall.org, dri-devel@lists.freedesktop.org,
linux-fbdev@vger.kernel.org
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Wed, 29 Jul 2020 15:53:02 +0800 [thread overview]
Message-ID: <55075898-bf95-1805-3358-b0d1438feaa9@nsfocus.com> (raw)
In-Reply-To: <20200729070249.20892-1-jslaby@suse.cz>
Hi All,
This patch dosen't fix the issue, the check should be in the loop.
The change of the VT sze is before vgacon_scrollback_update, not in the
meantime.
Let's consider the following situation:
suppose:
vgacon_scrollback_cur->size is 65440
vgacon_scrollback_cur->tail is 64960
c->vc_size_row is 160
count is 5
Reset c->vc_size_row to 200 by VT_RESIZE, then call
vgacon_scrollback_update.
This will pass the check, since (vgacon_scrollback_cur->tail +
c->vc_size_row)
is 65160 which is less then vgacon_scrollback_cur->size(65440).
However, in the 3rd iteration of the loop, vgacon_scrollback_cur->tail
is update
to 65360, the memcpy will overflow.
To avoid overflow, the check should be
if ((vgacon_scrollback_cur->tail + c->vc_size_row * count) >=
However, this will break the circular of the buffer, since all 5 lines
will be copy at the beginning.
To avoid break circular, we have to detect if wrap occurs, use a loop to
copy lines before
wrap, reset vgacon_scrollback_cur->tail to 0, then use another loop to
copy lines after wrap.
Of course the 2 loop can be combine into 2 memcpy, that will be similar
to Linus's patch.
Thus, I think the check should be in the loop.
The 2 check in the loop seems to be redundancy, Zhang Xiao from
Windriver suggest that the check after the memcpy can be remove.
I think he was right, but not very sure.
Thus, I suggest we discuss that too.
Regards,
Yunhai Zhang / NSFOCUS Security Team
On 2020/7/29 15:02, Jiri Slaby wrote:
> The current vgacon's scroll up implementation uses a circural buffer
> in vgacon_scrollback_cur. It always advances tail to prepare it for the
> next write and caps it to zero if the next ->vc_size_row bytes won't fit.
>
> But when we change the VT size (e.g. by VT_RESIZE) in the meantime, the new
> line might not fit to the end of the scrollback buffer in the next
> attempt to scroll. This leads to various crashes as
> vgacon_scrollback_update writes out of the buffer:
> BUG: unable to handle page fault for address: ffffc900001752a0
> #PF: supervisor write access in kernel mode
> #PF: error_code(0x0002) - not-present page
> RIP: 0010:mutex_unlock+0x13/0x30
> ...
> Call Trace:
> n_tty_write+0x1a0/0x4d0
> tty_write+0x1a0/0x2e0
>
> Or to KASAN reports:
> BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
>
> So check whether the line fits in the buffer and wrap if needed. Do it
> before the loop as console_sem is held and ->vc_size_row cannot change
> during the execution of vgacon_scrollback_cur. If it does change, we
> need to ensure it does not change elsewhere, not here.
>
> Also, we do not split the write of a line into chunks as that would
> break the consumers of the buffer. They expect ->cnt, ->tail and ->size
> to be in harmony and advanced by ->vc_size_row.
>
> I found few reports of this in the past, some with patches included,
> some even 2 years old:
> https://lore.kernel.org/lkml/CAEAjamsJnG-=TSOwgRbbb3B9Z-PA63oWmNPoKYWQ=Z=+X49akg@mail.gmail.com/
> https://lore.kernel.org/lkml/1589336932-35508-1-git-send-email-yangyingliang@huawei.com/
>
> This fixes CVE-2020-14331.
>
> Big thanks to guys mentioned in the Reported-and-debugged-by lines below
> who actually found the root cause.
>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
> Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
> Reported-by: Kyungtae Kim <kt0755@gmail.com>
> Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Greg KH <greg@kroah.com>
> Cc: Solar Designer <solar@openwall.com>
> Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: Security Officers <security@kernel.org>
> Cc: linux-distros@vs.openwall.org
> Cc: Yang Yingliang <yangyingliang@huawei.com>
> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-fbdev@vger.kernel.org
> ---
> drivers/video/console/vgacon.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
> index f0f3d573f848..13194bb246f8 100644
> --- a/drivers/video/console/vgacon.c
> +++ b/drivers/video/console/vgacon.c
> @@ -250,6 +250,11 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
>
> p = (void *) (c->vc_origin + t * c->vc_size_row);
>
> + /* vc_size_row might have changed by VT_RESIZE in the meantime */
> + if ((vgacon_scrollback_cur->tail + c->vc_size_row) >=
> + vgacon_scrollback_cur->size)
> + vgacon_scrollback_cur->tail = 0;
> +
> while (count--) {
> scr_memcpyw(vgacon_scrollback_cur->data +
> vgacon_scrollback_cur->tail,
>
--
张云海
绿盟科技 安全研究部 研究员
地址:北京市海淀区北洼路4号益泰大厦三层
邮编:100089
电话:(010)68438880-8510
传真:(010)68437328
手机:13691192782
邮箱:zhangyunhai@nsfocus.com
网站:http://www.nsfocus.com
WARNING: multiple messages have this Message-ID (diff)
From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jslaby@suse.cz>, b.zolnierkie@samsung.com
Cc: Security Officers <security@kernel.org>,
Kyungtae Kim <kt0755@gmail.com>,
Anthony Liguori <aliguori@amazon.com>, Greg KH <greg@kroah.com>,
linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
linux-fbdev@vger.kernel.org, linux-distros@vs.openwall.org,
Solar Designer <solar@openwall.com>,
Yang Yingliang <yangyingliang@huawei.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Wed, 29 Jul 2020 07:53:02 +0000 [thread overview]
Message-ID: <55075898-bf95-1805-3358-b0d1438feaa9@nsfocus.com> (raw)
In-Reply-To: <20200729070249.20892-1-jslaby@suse.cz>
Hi All,
This patch dosen't fix the issue, the check should be in the loop.
The change of the VT sze is before vgacon_scrollback_update, not in the
meantime.
Let's consider the following situation:
suppose:
vgacon_scrollback_cur->size is 65440
vgacon_scrollback_cur->tail is 64960
c->vc_size_row is 160
count is 5
Reset c->vc_size_row to 200 by VT_RESIZE, then call
vgacon_scrollback_update.
This will pass the check, since (vgacon_scrollback_cur->tail +
c->vc_size_row)
is 65160 which is less then vgacon_scrollback_cur->size(65440).
However, in the 3rd iteration of the loop, vgacon_scrollback_cur->tail
is update
to 65360, the memcpy will overflow.
To avoid overflow, the check should be
if ((vgacon_scrollback_cur->tail + c->vc_size_row * count) >
However, this will break the circular of the buffer, since all 5 lines
will be copy at the beginning.
To avoid break circular, we have to detect if wrap occurs, use a loop to
copy lines before
wrap, reset vgacon_scrollback_cur->tail to 0, then use another loop to
copy lines after wrap.
Of course the 2 loop can be combine into 2 memcpy, that will be similar
to Linus's patch.
Thus, I think the check should be in the loop.
The 2 check in the loop seems to be redundancy, Zhang Xiao from
Windriver suggest that the check after the memcpy can be remove.
I think he was right, but not very sure.
Thus, I suggest we discuss that too.
Regards,
Yunhai Zhang / NSFOCUS Security Team
On 2020/7/29 15:02, Jiri Slaby wrote:
> The current vgacon's scroll up implementation uses a circural buffer
> in vgacon_scrollback_cur. It always advances tail to prepare it for the
> next write and caps it to zero if the next ->vc_size_row bytes won't fit.
>
> But when we change the VT size (e.g. by VT_RESIZE) in the meantime, the new
> line might not fit to the end of the scrollback buffer in the next
> attempt to scroll. This leads to various crashes as
> vgacon_scrollback_update writes out of the buffer:
> BUG: unable to handle page fault for address: ffffc900001752a0
> #PF: supervisor write access in kernel mode
> #PF: error_code(0x0002) - not-present page
> RIP: 0010:mutex_unlock+0x13/0x30
> ...
> Call Trace:
> n_tty_write+0x1a0/0x4d0
> tty_write+0x1a0/0x2e0
>
> Or to KASAN reports:
> BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
>
> So check whether the line fits in the buffer and wrap if needed. Do it
> before the loop as console_sem is held and ->vc_size_row cannot change
> during the execution of vgacon_scrollback_cur. If it does change, we
> need to ensure it does not change elsewhere, not here.
>
> Also, we do not split the write of a line into chunks as that would
> break the consumers of the buffer. They expect ->cnt, ->tail and ->size
> to be in harmony and advanced by ->vc_size_row.
>
> I found few reports of this in the past, some with patches included,
> some even 2 years old:
> https://lore.kernel.org/lkml/CAEAjamsJnG-=TSOwgRbbb3B9Z-PA63oWmNPoKYWQ=Z=+X49akg@mail.gmail.com/
> https://lore.kernel.org/lkml/1589336932-35508-1-git-send-email-yangyingliang@huawei.com/
>
> This fixes CVE-2020-14331.
>
> Big thanks to guys mentioned in the Reported-and-debugged-by lines below
> who actually found the root cause.
>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
> Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
> Reported-by: Kyungtae Kim <kt0755@gmail.com>
> Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Greg KH <greg@kroah.com>
> Cc: Solar Designer <solar@openwall.com>
> Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: Security Officers <security@kernel.org>
> Cc: linux-distros@vs.openwall.org
> Cc: Yang Yingliang <yangyingliang@huawei.com>
> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-fbdev@vger.kernel.org
> ---
> drivers/video/console/vgacon.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
> index f0f3d573f848..13194bb246f8 100644
> --- a/drivers/video/console/vgacon.c
> +++ b/drivers/video/console/vgacon.c
> @@ -250,6 +250,11 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
>
> p = (void *) (c->vc_origin + t * c->vc_size_row);
>
> + /* vc_size_row might have changed by VT_RESIZE in the meantime */
> + if ((vgacon_scrollback_cur->tail + c->vc_size_row) >> + vgacon_scrollback_cur->size)
> + vgacon_scrollback_cur->tail = 0;
> +
> while (count--) {
> scr_memcpyw(vgacon_scrollback_cur->data +
> vgacon_scrollback_cur->tail,
>
--
张云海
绿盟科技 安全研究部 研究员
地址:北京市海淀区北洼路4号益泰大厦三层
邮编:100089
电话:(010)68438880-8510
传真:(010)68437328
手机:13691192782
邮箱:zhangyunhai@nsfocus.com
网站:http://www.nsfocus.com
WARNING: multiple messages have this Message-ID (diff)
From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jslaby@suse.cz>, b.zolnierkie@samsung.com
Cc: Security Officers <security@kernel.org>,
Kyungtae Kim <kt0755@gmail.com>,
Anthony Liguori <aliguori@amazon.com>, Greg KH <greg@kroah.com>,
linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
linux-fbdev@vger.kernel.org, linux-distros@vs.openwall.org,
Solar Designer <solar@openwall.com>,
Yang Yingliang <yangyingliang@huawei.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Wed, 29 Jul 2020 15:53:02 +0800 [thread overview]
Message-ID: <55075898-bf95-1805-3358-b0d1438feaa9@nsfocus.com> (raw)
In-Reply-To: <20200729070249.20892-1-jslaby@suse.cz>
Hi All,
This patch dosen't fix the issue, the check should be in the loop.
The change of the VT sze is before vgacon_scrollback_update, not in the
meantime.
Let's consider the following situation:
suppose:
vgacon_scrollback_cur->size is 65440
vgacon_scrollback_cur->tail is 64960
c->vc_size_row is 160
count is 5
Reset c->vc_size_row to 200 by VT_RESIZE, then call
vgacon_scrollback_update.
This will pass the check, since (vgacon_scrollback_cur->tail +
c->vc_size_row)
is 65160 which is less then vgacon_scrollback_cur->size(65440).
However, in the 3rd iteration of the loop, vgacon_scrollback_cur->tail
is update
to 65360, the memcpy will overflow.
To avoid overflow, the check should be
if ((vgacon_scrollback_cur->tail + c->vc_size_row * count) >=
However, this will break the circular of the buffer, since all 5 lines
will be copy at the beginning.
To avoid break circular, we have to detect if wrap occurs, use a loop to
copy lines before
wrap, reset vgacon_scrollback_cur->tail to 0, then use another loop to
copy lines after wrap.
Of course the 2 loop can be combine into 2 memcpy, that will be similar
to Linus's patch.
Thus, I think the check should be in the loop.
The 2 check in the loop seems to be redundancy, Zhang Xiao from
Windriver suggest that the check after the memcpy can be remove.
I think he was right, but not very sure.
Thus, I suggest we discuss that too.
Regards,
Yunhai Zhang / NSFOCUS Security Team
On 2020/7/29 15:02, Jiri Slaby wrote:
> The current vgacon's scroll up implementation uses a circural buffer
> in vgacon_scrollback_cur. It always advances tail to prepare it for the
> next write and caps it to zero if the next ->vc_size_row bytes won't fit.
>
> But when we change the VT size (e.g. by VT_RESIZE) in the meantime, the new
> line might not fit to the end of the scrollback buffer in the next
> attempt to scroll. This leads to various crashes as
> vgacon_scrollback_update writes out of the buffer:
> BUG: unable to handle page fault for address: ffffc900001752a0
> #PF: supervisor write access in kernel mode
> #PF: error_code(0x0002) - not-present page
> RIP: 0010:mutex_unlock+0x13/0x30
> ...
> Call Trace:
> n_tty_write+0x1a0/0x4d0
> tty_write+0x1a0/0x2e0
>
> Or to KASAN reports:
> BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
>
> So check whether the line fits in the buffer and wrap if needed. Do it
> before the loop as console_sem is held and ->vc_size_row cannot change
> during the execution of vgacon_scrollback_cur. If it does change, we
> need to ensure it does not change elsewhere, not here.
>
> Also, we do not split the write of a line into chunks as that would
> break the consumers of the buffer. They expect ->cnt, ->tail and ->size
> to be in harmony and advanced by ->vc_size_row.
>
> I found few reports of this in the past, some with patches included,
> some even 2 years old:
> https://lore.kernel.org/lkml/CAEAjamsJnG-=TSOwgRbbb3B9Z-PA63oWmNPoKYWQ=Z=+X49akg@mail.gmail.com/
> https://lore.kernel.org/lkml/1589336932-35508-1-git-send-email-yangyingliang@huawei.com/
>
> This fixes CVE-2020-14331.
>
> Big thanks to guys mentioned in the Reported-and-debugged-by lines below
> who actually found the root cause.
>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
> Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
> Reported-by: Kyungtae Kim <kt0755@gmail.com>
> Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Greg KH <greg@kroah.com>
> Cc: Solar Designer <solar@openwall.com>
> Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: Security Officers <security@kernel.org>
> Cc: linux-distros@vs.openwall.org
> Cc: Yang Yingliang <yangyingliang@huawei.com>
> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-fbdev@vger.kernel.org
> ---
> drivers/video/console/vgacon.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
> index f0f3d573f848..13194bb246f8 100644
> --- a/drivers/video/console/vgacon.c
> +++ b/drivers/video/console/vgacon.c
> @@ -250,6 +250,11 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
>
> p = (void *) (c->vc_origin + t * c->vc_size_row);
>
> + /* vc_size_row might have changed by VT_RESIZE in the meantime */
> + if ((vgacon_scrollback_cur->tail + c->vc_size_row) >=
> + vgacon_scrollback_cur->size)
> + vgacon_scrollback_cur->tail = 0;
> +
> while (count--) {
> scr_memcpyw(vgacon_scrollback_cur->data +
> vgacon_scrollback_cur->tail,
>
--
张云海
绿盟科技 安全研究部 研究员
地址:北京市海淀区北洼路4号益泰大厦三层
邮编:100089
电话:(010)68438880-8510
传真:(010)68437328
手机:13691192782
邮箱:zhangyunhai@nsfocus.com
网站:http://www.nsfocus.com
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-07-29 7:59 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20200729070257eucas1p1f5841756104301e67907136e45d6e9f5@eucas1p1.samsung.com>
2020-07-29 7:02 ` [PATCH] vgacon: fix out of bounds write to the scrollback buffer Jiri Slaby
2020-07-29 7:02 ` Jiri Slaby
2020-07-29 7:02 ` Jiri Slaby
2020-07-29 7:53 ` 张云海 [this message]
2020-07-29 7:53 ` 张云海
2020-07-29 7:53 ` 张云海
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:19 ` 张云海
2020-07-29 8:19 ` 张云海
2020-07-29 8:19 ` 张云海
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
[not found] <20200729130710.GA13262@openwall.com>
[not found] ` <b764c575-70be-80dd-6718-e84370a7b2b3@nsfocus.com>
2020-07-30 6:46 ` Jiri Slaby
2020-07-30 6:46 ` Jiri Slaby
2020-07-30 6:46 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 10:39 ` 张云海
2020-07-30 10:39 ` 张云海
2020-07-30 10:39 ` 张云海
2020-07-31 5:22 ` 张云海
2020-07-31 5:22 ` 张云海
2020-07-31 5:22 ` 张云海
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:18 ` Greg KH
2020-08-03 8:18 ` Greg KH
2020-08-03 8:18 ` Greg KH
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 9:47 ` Greg KH
2020-08-03 9:47 ` Greg KH
2020-08-03 9:47 ` Greg KH
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-04 7:37 ` Greg KH
2020-08-04 7:37 ` Greg KH
2020-08-04 7:37 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55075898-bf95-1805-3358-b0d1438feaa9@nsfocus.com \
--to=zhangyunhai@nsfocus.com \
--cc=aliguori@amazon.com \
--cc=b.zolnierkie@samsung.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=greg@kroah.com \
--cc=jslaby@suse.cz \
--cc=kt0755@gmail.com \
--cc=linux-distros@vs.openwall.org \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=security@kernel.org \
--cc=solar@openwall.com \
--cc=srivatsa@csail.mit.edu \
--cc=torvalds@linux-foundation.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.