[PATCHv2 net-next 7/7] sctp: add reconf chunk event

2017-02-16 Thread Xin Long
This patch is to add reconf chunk event based on the sctp event frame in rx path, it will call sctp_sf_do_reconf to process the reconf chunk. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/constants.h | 3 +++ net/sctp/sm_statetable.c

[PATCHv2 net-next 3/7] sctp: implement receiver-side procedures for the Outgoing SSN Reset Request Parameter

2017-02-16 Thread Xin Long
This patch is to implement Receiver-Side Procedures for the Outgoing SSN Reset Request Parameter described in rfc6525 section 5.2.2. Note that some checks must be after request_seq check, as even those checks fail, strreset_inseq still has to be increase by 1. Signed-off-by: Xin Long <luc

[PATCHv2 net-next 2/7] sctp: add support for generating stream ssn reset event notification

2017-02-16 Thread Xin Long
This patch is to add Stream Reset Event described in rfc6525 section 6.1.1. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/ulpevent.h | 4 include/uapi/linux/sctp.h | 16 net/sctp/ulpevent.c | 29 + 3 files c

[PATCHv2 net-next 1/7] sctp: add support for generating stream reconf resp chunk

2017-02-16 Thread Xin Long
This patch is to define Re-configuration Response Parameter described in rfc6525 section 4.4. As optional fields are only for SSN/TSN Reset Request Parameter, it uses another function to make that. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h

[PATCHv2 net-next 0/7] sctp: add receiver-side procedures for stream reconf ssn reset request chunk

2017-02-16 Thread Xin Long
h network endian to lookup_strreset_param in 3/7. - move str_list endian conversion out of sctp_make_strreset_req, so that sctp_make_strreset_req can be used more conveniently to process inreq in patch 4/7. - remove sctp_merge_reconf_chunk and not support response with multiparam in patch 6/7. Xin Long

[PATCHv2 net-next 6/7] sctp: add reconf chunk process

2017-02-16 Thread Xin Long
This patch is to add a function to process the incoming reconf chunk, in which it verifies the chunk, and traverses the param and process it with the right function one by one. sctp_sf_do_reconf would be the process function of reconf chunk event. Signed-off-by: Xin Long <lucien@gmail.

[PATCHv2 net-next 4/7] sctp: implement receiver-side procedures for the Incoming SSN Reset Request Parameter

2017-02-16 Thread Xin Long
-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/sm.h| 4 +++ net/sctp/sm_make_chunk.c | 8 +- net/sctp/stream.c| 70 3 files changed, 75 insertions(+), 7 deletions(-) diff --git a/include/net/sctp/sm.h b/inclu

Re: [PATCH net] sctp: check duplicate node before inserting a new transport

2017-02-18 Thread Xin Long
On Sat, Feb 18, 2017 at 4:19 AM, David Miller <da...@davemloft.net> wrote: > From: Xin Long <lucien@gmail.com> > Date: Fri, 17 Feb 2017 16:35:24 +0800 > > >> + list = rhltable_lookup(_transport_hashtable, , >> +

Re: [PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-23 Thread Xin Long
On Fri, Feb 24, 2017 at 12:04 AM, David Laight <david.lai...@aculab.com> wrote: > From: Xin Long >> Sent: 23 February 2017 03:46 >> On Tue, Feb 21, 2017 at 10:27 PM, David Laight <david.lai...@aculab.com> >> wrote: >> > From: Xin Long >> >> S

[PATCH net] sctp: set sin_port for addr param when checking duplicate address

2017-02-23 Thread Xin Long
copying duplicate addrs to the assoc's bind address list") Reported-by: Wei Chen <weic...@redhat.com> Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/protocol.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sctp/protocol.c b/net/sctp/protocol.

[PATCH net] ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt

2017-02-24 Thread Xin Long
ix should be done for ipv6 ipmr as well. This patch can fix the panic caused by overwriting the same offset as ipmr_table as in raw_sk(sk) when accessing other type's socket by ip_mroute_setsockopt(). Signed-off-by: Xin Long <lucien@gmail.com> --- net/ipv6/ip6mr.c | 11 --- 1 file chan

Re: [PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-25 Thread Xin Long
On Fri, Feb 24, 2017 at 6:14 PM, David Laight <david.lai...@aculab.com> wrote: > > From: Xin Long > > Sent: 24 February 2017 06:44 > ... > > > IIRC sctp_packet_can_append_data() is called for the first queued > > > data chunk in order to decide whether to

Re: [PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-23 Thread Xin Long
On Fri, Feb 24, 2017 at 1:40 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > On Thu, Feb 23, 2017 at 04:04:10PM +, David Laight wrote: >> From: Xin Long >> > Sent: 23 February 2017 03:46 >> > On Tue, Feb 21, 2017 at 10:27 PM, David Laight <

Re: [PATCH net] sctp: check duplicate node before inserting a new transport

2017-02-17 Thread Xin Long
On Fri, Feb 17, 2017 at 7:19 PM, Neil Horman <nhor...@tuxdriver.com> wrote: > On Fri, Feb 17, 2017 at 04:35:24PM +0800, Xin Long wrote: >> sctp has changed to use rhlist for transport rhashtable since commit >> 7fda702f9315 ("sctp: use new rhlist interface on sc

[PATCH net-next 0/2] sctp: support MSG_MORE flag when sending msg

2017-02-18 Thread Xin Long
This patch is to add support for MSG_MORE on sctp. Patch 1/2 is an improvement ahead of patch 2/2 to solve the close block problem mentioned in https://patchwork.ozlabs.org/patch/372404/. Xin Long (2): sctp: flush out queue once assoc state falls into SHUTDOWN_PENDING sctp: add support

[PATCH net-next 1/2] sctp: flush out queue once assoc state falls into SHUTDOWN_PENDING

2017-02-18 Thread Xin Long
that the chunks with MSG_MORE flag may be stuck in queue when closing an assoc. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/sm_sideeffect.c | 4 1 file changed, 4 insertions(+) diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index 51abcc9..25384fa 100644 --- a/ne

[PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-18 Thread Xin Long
into SHUTDOWN_PENDING, the close block problem mentioned in [1] has been solved as well. [1] https://patchwork.ozlabs.org/patch/372404/ Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 1 + net/sctp/output.c | 9 +++-- net/sctp/socket.c | 1 + 3

Re: [PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-22 Thread Xin Long
On Tue, Feb 21, 2017 at 10:27 PM, David Laight <david.lai...@aculab.com> wrote: > From: Xin Long >> Sent: 18 February 2017 17:53 >> This patch is to add support for MSG_MORE on sctp. >> >> It adds force_delay in sctp_datamsg to save MSG_MORE, and sets it af

[PATCH net-next] sctp: change to use uint_t in uapi sctp.h

2017-02-14 Thread Xin Long
All structures in uapi sctp.h are exported for userspace, their members' types should use uint_t instead of __u. Signed-off-by: Xin Long <lucien@gmail.com> --- include/uapi/linux/sctp.h | 398 +++--- 1 file changed, 199 insertions(+), 199 del

Re: [PATCHv6 net-next 3/6] sctp: add support for generating stream reconf ssn/tsn reset request chunk

2017-02-08 Thread Xin Long
On Thu, Feb 9, 2017 at 5:57 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > On Thu, Feb 09, 2017 at 01:18:17AM +0800, Xin Long wrote: >> This patch is to define SSN/TSN Reset Request Parameter described >> in rfc6525 section 4.3. >> >> It's also

Re: net/sctp: null-ptr-deref in sctp_put_port/sctp_endpoint_destroy

2017-02-09 Thread Xin Long
On Thu, Feb 9, 2017 at 3:00 AM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 926af6273fc683cd98cd0ce7bf0d04a02eed6742. > > A reproducer and .config are attached. > > general protection fault:

Re: [PATCH net-next] sctp: change to use uint_t in uapi sctp.h

2017-02-16 Thread Xin Long
On Wed, Feb 15, 2017 at 12:26 AM, David Miller <da...@davemloft.net> wrote: > From: Xin Long <lucien@gmail.com> > Date: Tue, 14 Feb 2017 16:23:48 +0800 > >> All structures in uapi sctp.h are exported for userspace, their members' >> types should use uint_t ins

Re: [PATCHv6 net-next 4/6] sctp: implement sender-side procedures for SSN/TSN Reset Request Parameter

2017-02-08 Thread Xin Long
On Thu, Feb 9, 2017 at 5:50 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > On Wed, Feb 08, 2017 at 07:48:01PM -0200, Marcelo Ricardo Leitner wrote: >> Hi Xin, >> >> On Thu, Feb 09, 2017 at 01:18:18AM +0800, Xin Long wrote: >> > This patch is

[PATCH net-next] sctp: sctp_transport_dst_check should check if transport pmtu is dst mtu

2017-02-17 Thread Xin Long
to update. This patch is to fix this by also checking if transport pmtu is dst mtu in sctp_transport_dst_check, so that transport->pmtu can be updated on time. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/sctp.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) di

[PATCH net] sctp: check duplicate node before inserting a new transport

2017-02-17 Thread Xin Long
") Reported-by: Fabio M. Di Nitto <fdini...@redhat.com> Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/input.c | 13 + 1 file changed, 13 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index 458e506..f65245b 100644 --- a/net/sctp/input.c +++

[PATCHv4 net-next 3/6] sctp: add stream reconf primitive

2017-01-17 Thread Xin Long
This patch is to add a primitive based on sctp primitive frame for sending stream reconf request. It works as the other primitives, and create a SCTP_CMD_REPLY command to send the request chunk out. sctp_primitive_RECONF would be the api to send a reconf request chunk. Signed-off-by: Xin Long

[PATCHv4 net-next 1/6] sctp: add support for generating stream reconf ssn reset request chunk

2017-01-17 Thread Xin Long
as section rfc6525 3.1-3 describes, it makes them in one function. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h | 27 ++ include/net/sctp/sm.h | 5 +- include/net/sctp/structs.h | 3 ++ net/sctp/associola.c | 1 + net/sctp/sm_make_c

[PATCHv4 net-next 2/6] sctp: add stream reconf timer

2017-01-17 Thread Xin Long
the reconf request chunk, so that it can be retransmitted, and to check if the response is really for this request by comparing the information inside with the response chunk as well. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/constants.h | 1 + include/net/sctp/sm.h

[PATCHv4 net-next 6/6] sctp: implement sender-side procedures for SSN Reset Request Parameter

2017-01-17 Thread Xin Long
sure only one reconf request chunk on the fly as rfc6525 section 5.1.1 demands. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/sctp.h| 6 include/net/sctp/structs.h | 1 + include/uapi/linux/sctp.h | 11 +++ net/sctp/outqueue.c

[PATCHv4 net-next 0/6] sctp: add sender-side procedures for stream reconf ssn reset request chunk

2017-01-17 Thread Xin Long
odes. - rename the titles of the commits and improve some changelogs. v2->v3: - re-split the patchset and make sure it has no dead codes for review. v3->v4: - move sctp_make_reconf() into patch 1/6 to avoid kbuild warning. - drop unused struct sctp_strreset_req. Xin Long (6): sctp: add

[PATCHv4 net-next 5/6] sctp: add sockopt SCTP_ENABLE_STREAM_RESET

2017-01-17 Thread Xin Long
This patch is to add sockopt SCTP_ENABLE_STREAM_RESET to get/set strreset_enable to indicate which reconf request type it supports, which is described in rfc6525 section 6.3.1. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 4 +++ include/uapi/linux/sctp.h

[PATCHv4 net-next 4/6] sctp: add reconf_enable in asoc ep and netns

2017-01-17 Thread Xin Long
to know if peer supports reconf_enable, the value is set if ext params have reconf chunk support when processing init chunk, just as rfc6525 section 5.1.1 demands. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/netns/sctp.h | 3 +++ include/net/sctp/structs.h | 7 +-

Re: [PATCH net-next] sctp: remove unused var from sctp_process_asconf

2017-01-16 Thread Xin Long
On Sat, Jan 14, 2017 at 4:27 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > Assigned but not used. > > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> Reviewed-by: Xin Long <lucien@gmail.com> > --- > net/sctp/sm_make_ch

Re: [PATCH net-next] sctp: remove useless code from sctp_apply_peer_addr_params

2017-01-16 Thread Xin Long
s not necessary. > IOW, no action is needed here and we can remove this call. > > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> Reviewed-by: Xin Long <lucien@gmail.com> > --- > net/sctp/socket.c | 1 - > 1 file changed, 1 deletion(-)

Re: [PATCHv3 net-next 1/7] sctp: add a common helper function to generate stream reconf chunk

2017-01-16 Thread Xin Long
On Tue, Jan 17, 2017 at 2:50 AM, David Miller <da...@davemloft.net> wrote: > From: Xin Long <lucien@gmail.com> > Date: Sat, 14 Jan 2017 03:15:35 +0800 > >> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c >> index a15d824..fd58097 100644

Re: [PATCHv3 net-next 2/7] sctp: add support for generating stream reconf ssn reset request chunk

2017-01-16 Thread Xin Long
On Mon, Jan 16, 2017 at 11:56 AM, Xin Long <lucien@gmail.com> wrote: > On Sun, Jan 15, 2017 at 11:51 PM, Marcelo Ricardo Leitner > <marcelo.leit...@gmail.com> wrote: >> On Sat, Jan 14, 2017 at 03:15:36AM +0800, Xin Long wrote: >>> This patch is to add asoc s

[PATCHv3 net-next 0/4] sctp: add sender-side procedures for stream reconf asoc reset and add streams

2017-01-19 Thread Xin Long
its and improve some changelogs. v2->v3: - re-split the patchset and make sure it has no dead codes for review. - move some codes into stream.c from socket.c. Xin Long (4): sctp: add support for generating stream reconf ssn/tsn reset request chunk sctp: implement sender-side procedures for S

[PATCHv4 net-next 2/5] sctp: add support for generating stream reconf ssn/tsn reset request chunk

2017-01-20 Thread Xin Long
This patch is to define SSN/TSN Reset Request Parameter described in rfc6525 section 4.3. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h | 5 + include/net/sctp/sm.h| 2 ++ net/sctp/sm_make_chunk.c | 29 + 3 files chang

[PATCHv4 net-next 3/5] sctp: implement sender-side procedures for SSN/TSN Reset Request Parameter

2017-01-20 Thread Xin Long
This patch is to implement Sender-Side Procedures for the SSN/TSN Reset Request Parameter descibed in rfc6525 section 5.1.4. It is also to add sockopt SCTP_RESET_ASSOC in rfc6525 section 6.3.3 for users. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/sctp.h

[PATCHv4 net-next 4/5] sctp: add support for generating stream reconf add incoming/outgoing streams request chunk

2017-01-20 Thread Xin Long
This patch is to define Add Incoming/Outgoing Streams Request Parameter described in rfc6525 section 4.5 and 4.6. They can be in one same chunk trunk as rfc6525 section 3.1-7 describes, so make them in one function. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h

[PATCHv4 net-next 5/5] sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter

2017-01-20 Thread Xin Long
This patch is to implement Sender-Side Procedures for the Add Outgoing and Incoming Streams Request Parameter described in rfc6525 section 5.1.5-5.1.6. It is also to add sockopt SCTP_ADD_STREAMS in rfc6525 section 6.3.4 for users. Signed-off-by: Xin Long <lucien@gmail.com> --- inclu

[PATCHv4 net-next 0/5] sctp: add sender-side procedures for stream reconf asoc reset and add streams

2017-01-20 Thread Xin Long
et stream request issue. - doing actual work only when request is sent successfully. - reduce some indents in sctp_send_add_streams. Xin Long (5): sctp: streams should be closed when stream reset request is sent successfully. sctp: add support for generating stream reconf ssn/tsn rese

[PATCHv4 net-next 1/5] sctp: streams should be closed when stream reset request is sent successfully.

2017-01-20 Thread Xin Long
, streams are closed and no packet was even queued. This patch is to fix it by closing streams only when request is sent successfully, it is also to fix a return value. Fixes: 7f9d68ac944e ("sctp: implement sender-side procedures for SSN Reset Request Parameter") Signed-off-by: Xin Lo

[PATCHv3 net-next 4/4] sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter

2017-01-19 Thread Xin Long
This patch is to implement Sender-Side Procedures for the Add Outgoing and Incoming Streams Request Parameter described in rfc6525 section 5.1.5-5.1.6. It is also to add sockopt SCTP_ADD_STREAMS in rfc6525 section 6.3.4 for users. Signed-off-by: Xin Long <lucien@gmail.com> --- inclu

[PATCHv3 net-next 3/4] sctp: add support for generating stream reconf add incoming/outgoing streams request chunk

2017-01-19 Thread Xin Long
This patch is to define Add Incoming/Outgoing Streams Request Parameter described in rfc6525 section 4.5 and 4.6. They can be in one same chunk trunk as rfc6525 section 3.1-7 describes, so make them in one function. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h

[PATCHv3 net-next 2/4] sctp: implement sender-side procedures for SSN/TSN Reset Request Parameter

2017-01-19 Thread Xin Long
This patch is to implement Sender-Side Procedures for the SSN/TSN Reset Request Parameter descibed in rfc6525 section 5.1.4. It is also to add sockopt SCTP_RESET_ASSOC in rfc6525 section 6.3.3 for users. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/sctp.h

[PATCHv3 net-next 1/4] sctp: add support for generating stream reconf ssn/tsn reset request chunk

2017-01-19 Thread Xin Long
This patch is to define SSN/TSN Reset Request Parameter described in rfc6525 section 4.3. Signed-off-by: Xin Long <lucien@gmail.com> --- include/linux/sctp.h | 5 + include/net/sctp/sm.h| 2 ++ net/sctp/sm_make_chunk.c | 29 + 3 files chang

Re: [PATCHv3 net-next 4/4] sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter

2017-01-20 Thread Xin Long
On Fri, Jan 20, 2017 at 5:47 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > On Fri, Jan 20, 2017 at 01:19:14AM +0800, Xin Long wrote: >> This patch is to implement Sender-Side Procedures for the Add >> Outgoing and Incoming Streams Request Parameter de

Re: [PATCHv3 net-next 4/4] sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter

2017-01-20 Thread Xin Long
On Fri, Jan 20, 2017 at 6:15 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > On Fri, Jan 20, 2017 at 01:19:14AM +0800, Xin Long wrote: >> This patch is to implement Sender-Side Procedures for the Add >> Outgoing and Incoming Streams Request Parameter de

[PATCH net 0/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-19 Thread Xin Long
Patch 1/2 is to fix some indent level. Given that we have kernels out there with this issue, patch 2/2 also fix sctp_raw_to_bind_addrs. Xin Long (2): sctp: reduce indent level in sctp_copy_local_addr_list sctp: not copying duplicate addrs to the assoc's bind address list net/sctp

[PATCH net 1/2] sctp: reduce indent level in sctp_copy_local_addr_list

2016-08-19 Thread Xin Long
This patch is to reduce indent level by using continue when the addr is not allowed, and also drop end_copy by using break. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/protocol.c | 37 +++-- 1 file changed, 19 insertions(+), 18 deletions(-)

[PATCH net 2/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-19 Thread Xin Long
From: Xin Long <l...@redhat.com> sctp.local_addr_list is a global address list that is supposed to include all the local addresses. sctp updates this list according to NETDEV_UP/ NETDEV_DOWN notifications. However, if multiple NICs have the same address, the global list will have dup

Re: [PATCH net 2/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-19 Thread Xin Long
> Under what valid use case will multiple interfaces have the same network > address? > Hi, Neil. I'm not sure the specific valid use case. The point is, do we trust the sctp global addr list has no duplicate address ? In one of users' computer, he found hundreds of duplicate addresses in

Re: [PATCH net 2/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-20 Thread Xin Long
> Ah, I see what you're doing. Ok, this makes some sense, at least on the > receive > side, when you get a cookie unpacked and modify the remote peers address list, > it makes sense to check for duplicates. On the local side however, I would, > instead of checking it when the list gets copied,

[PATCH net] sctp: call rcu_read_lock before checking for duplicate transport nodes

2017-02-27 Thread Xin Long
port") Reported-by: Andrey Konovalov <andreyk...@google.com> Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/input.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index fc45896..2a28ab2 100644 --- a/net/sctp/input.c +++ b/net/sctp/i

Re: [PATCH net] sctp: call rcu_read_lock before checking for duplicate transport nodes

2017-02-28 Thread Xin Long
On Tue, Feb 28, 2017 at 10:23 PM, Neil Horman <nhor...@tuxdriver.com> wrote: > On Tue, Feb 28, 2017 at 12:41:29PM +0800, Xin Long wrote: >> Commit cd2b70875058 ("sctp: check duplicate node before inserting a >> new transport") called rhltable_lookup() to check for

Re: net/sctp: use-after-free in sctp_hash_transport

2017-02-28 Thread Xin Long
On Tue, Feb 28, 2017 at 11:35 PM, Dmitry Vyukov <dvyu...@google.com> wrote: > On Mon, Feb 27, 2017 at 5:27 PM, Xin Long <lucien@gmail.com> wrote: >> On Mon, Feb 27, 2017 at 11:45 PM, Andrey Konovalov >> <andreyk...@google.com> wrote: >>> Hi, >>

Re: net/sctp: use-after-free in sctp_association_put

2017-03-02 Thread Xin Long
On Thu, Mar 2, 2017 at 3:18 AM, Dmitry Vyukov wrote: > Hello, > > I've got the following report while running syzkaller fuzzer on > linux-next/8813198236a044b76e251dcae937b180dd527999: > > BUG: KASAN: use-after-free in sctp_association_destroy > net/sctp/associola.c:416

Re: net/sctp: use-after-free in sctp_hash_transport

2017-02-27 Thread Xin Long
On Mon, Feb 27, 2017 at 11:45 PM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit e5d56efc97f8240d0b5d66c03949382b6d7e5570 (Feb 26). > > A reproducer and .config are attached. > >

Re: [PATCH net-next 2/2] sctp: add support for MSG_MORE

2017-02-26 Thread Xin Long
On Sat, Feb 25, 2017 at 4:41 PM, Xin Long <lucien@gmail.com> wrote: > On Fri, Feb 24, 2017 at 6:14 PM, David Laight <david.lai...@aculab.com> wrote: >> >> From: Xin Long >> > Sent: 24 February 2017 06:44 >> ... >> > > IIRC sctp_p

Re: [PATCH net] sctp: fix overrun in sctp_diag_dump_one()

2016-08-23 Thread Xin Long
6; > > paddr.v6.sin6_port = req->id.idiag_dport; > - memcpy(_addr, req->id.idiag_dst, 64); > + memcpy(_addr, req->id.idiag_dst, > + sizeof(paddr.v6.sin6_addr)); > paddr.v6.sin6_family = AF_INET6; > } > > -- > 2.5.5 > Reviewed-by: Xin Long <lucien@gmail.com>

[PATCH net] veth: sctp: add NETIF_F_SCTP_CRC to device features

2016-08-24 Thread Xin Long
Li Shuang <tjlishu...@yeah.net> Signed-off-by: Xin Long <lucien@gmail.com> --- drivers/net/veth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index f37a6e6..4bda502 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -

Re: [PATCH net 2/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-24 Thread Xin Long
> Or add a refcnt to its members. > NETDEV_UP, it gets a ++ if it's already there > NETDEV_DOWN, it gets a -- and cleans it up if it reaches 0 > And the rest probably could stay the same. > Yes, it could also avoid the issue of amounts of duplicate addrs. or add a nic index variable to its

[PATCH net 4/6] sctp: save transmit error to sk_err in sctp_outq_flush

2016-09-08 Thread Xin Long
value. Eventually, sctp_wait_for_* would check for it. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/output.c | 3 ++- net/sctp/outqueue.c | 21 - 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/net/sctp/output.c b/net/sctp/output.c

[PATCH net] sctp: hold the transport before using it in sctp_hash_cmp

2016-09-08 Thread Xin Long
first, holds it if it's not 0. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/input.c | 27 +-- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/net/sctp/input.c b/net/sctp/input.c index 69444d3..1555fb8 100644 --- a/net/sctp/input.c +++

[PATCH net 3/6] sctp: free msg->chunks when sctp_primitive_SEND return err

2016-09-08 Thread Xin Long
ert commit 1cd4d5c4326a ("sctp: remove the unused sctp_datamsg_free()") and commit 8b570dc9f7b6 ("sctp: only drop the reference on the datamsg after sending a msg"), to use sctp_datamsg_free to free the chunks of current msg. Signed-off-by: Xin Long <lucien@gmail.com>

[PATCH net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-08 Thread Xin Long
Data Chunks are only sent by sctp_primitive_SEND, in which sctp checks the asoc's state through statetable before calling sctp_outq_tail. So there's no need to do it again in sctp_outq_tail. This patch is to remove it from sctp_outq_tail. Signed-off-by: Xin Long <lucien@gmail.com> --

[PATCH net 0/6] sctp: fix the transmit err process

2016-09-08 Thread Xin Long
of by retransmit. Xin Long (6): sctp: remove the unnecessary state check in sctp_outq_tail sctp: do not return the transmit err back to sctp_sendmsg sctp: free msg->chunks when sctp_primitive_SEND return err sctp: save transmit error to sk_err in sctp_outq_flush sctp: make sctp_outq_flush/tail/unc

[PATCH net 2/6] sctp: do not return the transmit err back to sctp_sendmsg

2016-09-08 Thread Xin Long
, and not return the transmit err back to sctp_sendmsg Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/sm_sideeffect.c | 16 +--- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index 12d4519..cf6e4f0 100644 --- a/ne

[PATCH net 6/6] sctp: not return ENOMEM err back in sctp_packet_transmit

2016-09-08 Thread Xin Long
, it also cleans up sctp_packet_transmit's err path, and fixes some issues in err path: - It didn't free the head skb in nomem: path. - No need to check nskb in no_route: path. - It should goto err: path if alloc_skb fails for head. - Not all the NOMEMs should free nskb. Signed-off-by: Xin Long

[PATCH net 5/6] sctp: make sctp_outq_flush/tail/uncork return void

2016-09-08 Thread Xin Long
sctp_outq_flush return value is meaningless now, this patch is to make sctp_outq_flush return void, as well as sctp_outq_fail and sctp_outq_uncork. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 4 ++-- net/sctp/outqueue.c| 19 +++---

[PATCH net] sctp: identify chunks that need to be fragmented at IP level

2016-09-08 Thread Xin Long
From: Marcelo Ricardo Leitner Previously, without GSO, it was easy to identify it: if the chunk didn't fit and there was no data chunk in the packet yet, we could fragment at IP level. So if there was an auth chunk and we were bundling a big data chunk, it would

Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp

2016-09-08 Thread Xin Long
>> Now sctp uses the transport without holding it in sctp_hash_cmp, >> it can cause a use-after-free panic. As after it get transport from >> hashtable, another CPU may free it, then the members it accesses >> may be unavailable memory. > > How old is this bug? I think since: $ git describe

Re: [PATCH net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-08 Thread Xin Long
>> Data Chunks are only sent by sctp_primitive_SEND, in which sctp checks >> the asoc's state through statetable before calling sctp_outq_tail. So >> there's no need to do it again in sctp_outq_tail. >> >> This patch is to remove it from sctp_outq_tail. >>

Re: [PATCH net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-09 Thread Xin Long
> I don't know, I still don't feel safe about it. I agree the socket lock keeps > the state from changing during a single transmission, which makes the use case > you are focused on correct. ok, :-) > > That said, have you considered the retransmit case? That is to say, if you > queue and flush

[PATCHv2 net 2/6] sctp: do not return the transmit err back to sctp_sendmsg

2016-09-13 Thread Xin Long
, and not return the transmit err back to sctp_sendmsg Fixes: 8b570dc9f7b6 ("sctp: only drop the reference on the datamsg after sending a msg") Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/sm_sideeffect.c | 16 +--- 1 file changed, 5 insertions(+), 11 deletions(-)

[PATCHv2 net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-13 Thread Xin Long
by timer events, the event's processes still need to acquire lock_sock first. It means no others CMDs can be enqueue into side effect list before CMD_SEND_MSG to change asoc->state, so it's safe to remove it. This patch is to remove redundant asoc->state check from sctp_outq_tail. Signed-off-by: Xi

[PATCHv2 net 0/6] sctp: fix the transmit err process

2016-09-13 Thread Xin Long
of by retransmit. v1->v2: - add more details to the changelog in patch 1/6 - add Fixes: tag in patch 2/6, 3/6 - also revert 69b5777f2e57 in patch 3/6 Xin Long (6): sctp: remove the unnecessary state check in sctp_outq_tail sctp: do not return the transmit err back to sctp_sendmsg sctp: free

[PATCHv2 net 6/6] sctp: not return ENOMEM err back in sctp_packet_transmit

2016-09-13 Thread Xin Long
, it also cleans up sctp_packet_transmit's err path, and fixes some issues in err path: - It didn't free the head skb in nomem: path. - No need to check nskb in no_route: path. - It should goto err: path if alloc_skb fails for head. - Not all the NOMEMs should free nskb. Signed-off-by: Xin Long

[PATCHv2 net 5/6] sctp: make sctp_outq_flush/tail/uncork return void

2016-09-13 Thread Xin Long
sctp_outq_flush return value is meaningless now, this patch is to make sctp_outq_flush return void, as well as sctp_outq_fail and sctp_outq_uncork. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 4 ++-- net/sctp/outqueue.c| 19 +++---

[PATCHv2 net 3/6] sctp: free msg->chunks when sctp_primitive_SEND return err

2016-09-13 Thread Xin Long
g_free to free the chunks of current msg. Fixes: 8b570dc9f7b6 ("sctp: only drop the reference on the datamsg after sending a msg") Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 1 + net/sctp/chunk.c | 13 + net/sctp/o

[PATCHv2 net 4/6] sctp: save transmit error to sk_err in sctp_outq_flush

2016-09-13 Thread Xin Long
value. Eventually, sctp_wait_for_* would check for it. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/output.c | 3 ++- net/sctp/outqueue.c | 21 - 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/net/sctp/output.c b/net/sctp/output.c

Re: [PATCH net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-13 Thread Xin Long
> > I also don't see an issue with this patch, btw. > > Xin, you may want to add more/such details to the changelog, specially > about the timer versus primitive handling. > OK, I will post v2 of this patchset.

Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp

2016-09-10 Thread Xin Long
> > Please add more detail to the commit message and add a proper > "Fixes: " tag right before your signoff. OK, will repost v2

[PATCHv2 net] sctp: hold the transport before using it in sctp_hash_cmp

2016-09-10 Thread Xin Long
ransport_hold, in which it checks the refcnt first, holds it if it's not 0. Fixes: 4f0087812648 ("sctp: apply rhashtable api to send/recv path") Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/input.c | 27 +-- 1 file changed, 17 insertions(+), 10 d

Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp

2016-09-09 Thread Xin Long
>> > What path does this occur in? __sctp_lookup_association takes a hold on the > asoc, and that function is protected by the rcu_read_lock, so I'm not sure how > you get into a situation in which the asoc can be deleted while the lookup is > occuring. > yes that function is protected by the

Re: [PATCH net 1/6] sctp: remove the unnecessary state check in sctp_outq_tail

2016-09-09 Thread Xin Long
>> > Its not enough to just look at the paths where outq_tail is called, because > the outq_tail function is checking a state variable that can update > asynchronously in the side effect processing queue. Look at any one of the > timer functions. Those all fire asynchronous to the outq list, but

[PATCHv3 net 0/3] sctp: a bunch of fixes for prsctp polices

2016-09-28 Thread Xin Long
This patchset is to fix 2 issues for prsctp polices: 1. patch 1 and 2 fix "netperf-Throughput_Mbps -37.2% regression" issue when overloading the CPU. 2. patch 3 fix "prsctp polices should check both sides' prsctp_capable, instead of only local side". Xin Lo

[PATCHv3 net 3/3] sctp: change to check peer prsctp_capable when using prsctp polices

2016-09-28 Thread Xin Long
to check if prsctp is enabled on both side, instead of asoc->prsctp_enable, as asoc's peer.prsctp_capable is set only when local and peer both enable prsctp. Fixes: a6c2f792873a ("sctp: implement prsctp TTL policy") Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/c

[PATCHv3 net 1/3] sctp: move sent_count to the memory hole in sctp_chunk

2016-09-28 Thread Xin Long
73a ("sctp: implement prsctp TTL policy") Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index ce93c4b..4f097f5 100

Re: [PATCHv2 net 0/5] sctp: some fixes of prsctp polices

2016-09-28 Thread Xin Long
> > That doesn't matter. This happens all the time. > > The way you handle this is you submit patch #1 targetting 'net' and > wait for it to get into 'net' and propagate into 'net-next'. When > that happens you can submit patches #2-5 as a second patch series > targetting 'net-next'. Thanks,

[PATCHv3 net 2/3] sctp: remove prsctp_param from sctp_chunk

2016-09-28 Thread Xin Long
xpires_at time. This one also fixes the "netperf-Throughput_Mbps -37.2% regression" issue. Fixes: a6c2f792873a ("sctp: implement prsctp TTL policy") Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 7 --- net/sctp/chunk.c

[PATCH net-next] sctp: reuse sent_count to avoid retransmitted chunks for RTT measurements

2016-10-07 Thread Xin Long
ecking chunk->sent_count is greater than 1. This patch is to remove resent from sctp_chunk and reuse sent_count to avoid retransmitted chunks for RTT measurements. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 2 +- net/sctp/output.c | 3 ++- net/

[PATCH net-next] sctp: remove the old ttl expires policy

2016-10-07 Thread Xin Long
expires_at and check the expires in sctp_check_abandoned. Note that asoc->prsctp_enable is set by default, so users can't feel any difference even if they use the old expires api in userspace. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 1 - net/sct

Re: [PATCH net 2/2] sctp: not copying duplicate addrs to the assoc's bind address list

2016-08-23 Thread Xin Long
>> > Ah, I see what you're doing. Ok, this makes some sense, at least on the >> > receive >> > side, when you get a cookie unpacked and modify the remote peers address >> > list, >> > it makes sense to check for duplicates. On the local side however, I >> > would, >> > instead of checking it

Re: [PATCH net 2/5] sctp: reuse sent_count to avoid retransmitted chunks for RTT measurements

2016-09-27 Thread Xin Long
> > Maybe wrap this in a macro? i.e.: > #define chunk_retransmitted(chunk) (chunk->sent_count > 1) > > For readability? > That's a nice suggestion. chunk->sent_count == 1 is confusing there for reading. will improve it in v2. Thanks.

[PATCH net] sctp: fix the issue sctp_diag uses lock_sock in rcu_read_lock

2016-09-28 Thread Xin Long
ump it. Then it will traverse the list again to get the next one until all sctp socks are dumped. For sctp_diag_dump_one, it fixes this issue by holding asoc and moving cb() out of rcu_read_lock in sctp_transport_lookup_process. Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Xin

[PATCHv2 net 1/5] sctp: move sent_count to the memory hole in sctp_chunk

2016-09-28 Thread Xin Long
73a ("sctp: implement prsctp TTL policy") Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index ce93c4b..4f097f5 100

[PATCHv2 net 4/5] sctp: change to check peer prsctp_capable when using prsctp polices

2016-09-28 Thread Xin Long
to check if prsctp is enabled on both side, instead of asoc->prsctp_enable, as asoc's peer.prsctp_capable is set only when local and peer both enable prsctp. Signed-off-by: Xin Long <lucien@gmail.com> --- net/sctp/chunk.c| 4 ++-- net/sctp/outqueue.c | 8 2 files changed,

[PATCHv2 net 2/5] sctp: reuse sent_count to avoid retransmitted chunks for RTT measurements

2016-09-28 Thread Xin Long
ecking chunk->sent_count is greater than 1. This patch is to remove resent from sctp_chunk and reuse sent_count to avoid retransmitted chunks for RTT measurements. Signed-off-by: Xin Long <lucien@gmail.com> --- include/net/sctp/structs.h | 2 +- net/sctp/output.c | 3 ++- net/

<    1   2   3   4   5   6   7   8   9   10   >