Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
From: Xufeng Zhang Date: Thu, 12 Jun 2014 10:53:36 +0800 > Consider the scenario: > For a TCP-style socket, while processing the COOKIE_ECHO chunk in > sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, > a new association would be created in sctp_unpack_cookie(), but afterwards, > some processing maybe failed, and sctp_association_free() will be called to > free the previously allocated association, in sctp_association_free(), > sk_ack_backlog value is decremented for this socket, since the initial > value for sk_ack_backlog is 0, after the decrement, it will be 65535, > a wrap-around problem happens, and if we want to establish new associations > afterward in the same socket, ABORT would be triggered since sctp deem the > accept queue as full. > Fix this issue by only decrementing sk_ack_backlog for associations in > the endpoint's list. > > Fix-suggested-by: Neil Horman > Signed-off-by: Xufeng Zhang > --- > Change for v2: > Drop the redundant test for temp suggested by Vlad Yasevich. Applied and queued up for -stable, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
On 06/11/2014 10:53 PM, Xufeng Zhang wrote:
> Consider the scenario:
> For a TCP-style socket, while processing the COOKIE_ECHO chunk in
> sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
> a new association would be created in sctp_unpack_cookie(), but afterwards,
> some processing maybe failed, and sctp_association_free() will be called to
> free the previously allocated association, in sctp_association_free(),
> sk_ack_backlog value is decremented for this socket, since the initial
> value for sk_ack_backlog is 0, after the decrement, it will be 65535,
> a wrap-around problem happens, and if we want to establish new associations
> afterward in the same socket, ABORT would be triggered since sctp deem the
> accept queue as full.
> Fix this issue by only decrementing sk_ack_backlog for associations in
> the endpoint's list.
>
> Fix-suggested-by: Neil Horman
> Signed-off-by: Xufeng Zhang
Acked-by: Vlad Yasevich
Thanks
-vlad
> ---
> Change for v2:
> Drop the redundant test for temp suggested by Vlad Yasevich.
>
> net/sctp/associola.c |2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/net/sctp/associola.c b/net/sctp/associola.c
> index 39579c3..0b8 100644
> --- a/net/sctp/associola.c
> +++ b/net/sctp/associola.c
> @@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc)
> /* Only real associations count against the endpoint, so
>* don't bother for if this is a temporary association.
>*/
> - if (!asoc->temp) {
> + if (!list_empty(>asocs)) {
> list_del(>asocs);
>
> /* Decrement the backlog value for a TCP-style listening
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
On 06/12/2014 04:53 AM, Xufeng Zhang wrote: Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman Signed-off-by: Xufeng Zhang Looks good to me, thanks. This also needs to go to -stable. Acked-by: Daniel Borkmann -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
On 06/12/2014 04:53 AM, Xufeng Zhang wrote: Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman nhor...@tuxdriver.com Signed-off-by: Xufeng Zhang xufeng.zh...@windriver.com Looks good to me, thanks. This also needs to go to -stable. Acked-by: Daniel Borkmann dbork...@redhat.com -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
On 06/11/2014 10:53 PM, Xufeng Zhang wrote:
Consider the scenario:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
a new association would be created in sctp_unpack_cookie(), but afterwards,
some processing maybe failed, and sctp_association_free() will be called to
free the previously allocated association, in sctp_association_free(),
sk_ack_backlog value is decremented for this socket, since the initial
value for sk_ack_backlog is 0, after the decrement, it will be 65535,
a wrap-around problem happens, and if we want to establish new associations
afterward in the same socket, ABORT would be triggered since sctp deem the
accept queue as full.
Fix this issue by only decrementing sk_ack_backlog for associations in
the endpoint's list.
Fix-suggested-by: Neil Horman nhor...@tuxdriver.com
Signed-off-by: Xufeng Zhang xufeng.zh...@windriver.com
Acked-by: Vlad Yasevich vyasev...@gmail.com
Thanks
-vlad
---
Change for v2:
Drop the redundant test for temp suggested by Vlad Yasevich.
net/sctp/associola.c |2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 39579c3..0b8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc)
/* Only real associations count against the endpoint, so
* don't bother for if this is a temporary association.
*/
- if (!asoc-temp) {
+ if (!list_empty(asoc-asocs)) {
list_del(asoc-asocs);
/* Decrement the backlog value for a TCP-style listening
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v2] sctp: Fix sk_ack_backlog wrap-around problem
From: Xufeng Zhang xufeng.zh...@windriver.com Date: Thu, 12 Jun 2014 10:53:36 +0800 Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman nhor...@tuxdriver.com Signed-off-by: Xufeng Zhang xufeng.zh...@windriver.com --- Change for v2: Drop the redundant test for temp suggested by Vlad Yasevich. Applied and queued up for -stable, thanks. -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
