Eric Lee / smarc-fsl-linux-kernel

09 Oct, 2020

2 commits

  • 9d49aea13   Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... Browse Code »

    Small conflict around locking in rxrpc_process_event() -
    channel_lock moved to bundle in next, while state lock
    needs _bh() from net.

    Signed-off-by: Jakub Kicinski

    Jakub Kicinski
     
  • d42ee76ec   sctp: fix sctp_auth_init_hmacs() error path ... Browse Code »

    After freeing ep->auth_hmacs we have to clear the pointer
    or risk use-after-free as reported by syzbot:

    BUG: KASAN: use-after-free in sctp_auth_destroy_hmacs net/sctp/auth.c:509 [inline]
    BUG: KASAN: use-after-free in sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
    BUG: KASAN: use-after-free in sctp_auth_free+0x17e/0x1d0 net/sctp/auth.c:1070
    Read of size 8 at addr ffff8880a8ff52c0 by task syz-executor941/6874

    CPU: 0 PID: 6874 Comm: syz-executor941 Not tainted 5.9.0-rc8-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x198/0x1fd lib/dump_stack.c:118
    print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
    __kasan_report mm/kasan/report.c:513 [inline]
    kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
    sctp_auth_destroy_hmacs net/sctp/auth.c:509 [inline]
    sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
    sctp_auth_free+0x17e/0x1d0 net/sctp/auth.c:1070
    sctp_endpoint_destroy+0x95/0x240 net/sctp/endpointola.c:203
    sctp_endpoint_put net/sctp/endpointola.c:236 [inline]
    sctp_endpoint_free+0xd6/0x110 net/sctp/endpointola.c:183
    sctp_destroy_sock+0x9c/0x3c0 net/sctp/socket.c:4981
    sctp_v6_destroy_sock+0x11/0x20 net/sctp/socket.c:9415
    sk_common_release+0x64/0x390 net/core/sock.c:3254
    sctp_close+0x4ce/0x8b0 net/sctp/socket.c:1533
    inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
    inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:475
    __sock_release+0xcd/0x280 net/socket.c:596
    sock_close+0x18/0x20 net/socket.c:1277
    __fput+0x285/0x920 fs/file_table.c:281
    task_work_run+0xdd/0x190 kernel/task_work.c:141
    exit_task_work include/linux/task_work.h:25 [inline]
    do_exit+0xb7d/0x29f0 kernel/exit.c:806
    do_group_exit+0x125/0x310 kernel/exit.c:903
    __do_sys_exit_group kernel/exit.c:914 [inline]
    __se_sys_exit_group kernel/exit.c:912 [inline]
    __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x43f278
    Code: Bad RIP value.
    RSP: 002b:00007fffe0995c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f278
    RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
    RBP: 00000000004bf068 R08: 00000000000000e7 R09: ffffffffffffffd0
    R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001
    R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000

    Allocated by task 6874:
    kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
    kasan_set_track mm/kasan/common.c:56 [inline]
    __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
    kmem_cache_alloc_trace+0x174/0x300 mm/slab.c:3554
    kmalloc include/linux/slab.h:554 [inline]
    kmalloc_array include/linux/slab.h:593 [inline]
    kcalloc include/linux/slab.h:605 [inline]
    sctp_auth_init_hmacs+0xdb/0x3b0 net/sctp/auth.c:464
    sctp_auth_init+0x8a/0x4a0 net/sctp/auth.c:1049
    sctp_setsockopt_auth_supported net/sctp/socket.c:4354 [inline]
    sctp_setsockopt+0x477e/0x97f0 net/sctp/socket.c:4631
    __sys_setsockopt+0x2db/0x610 net/socket.c:2132
    __do_sys_setsockopt net/socket.c:2143 [inline]
    __se_sys_setsockopt net/socket.c:2140 [inline]
    __x64_sys_setsockopt+0xba/0x150 net/socket.c:2140
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Freed by task 6874:
    kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
    kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
    kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
    __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422
    __cache_free mm/slab.c:3422 [inline]
    kfree+0x10e/0x2b0 mm/slab.c:3760
    sctp_auth_destroy_hmacs net/sctp/auth.c:511 [inline]
    sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
    sctp_auth_init_hmacs net/sctp/auth.c:496 [inline]
    sctp_auth_init_hmacs+0x2b7/0x3b0 net/sctp/auth.c:454
    sctp_auth_init+0x8a/0x4a0 net/sctp/auth.c:1049
    sctp_setsockopt_auth_supported net/sctp/socket.c:4354 [inline]
    sctp_setsockopt+0x477e/0x97f0 net/sctp/socket.c:4631
    __sys_setsockopt+0x2db/0x610 net/socket.c:2132
    __do_sys_setsockopt net/socket.c:2143 [inline]
    __se_sys_setsockopt net/socket.c:2140 [inline]
    __x64_sys_setsockopt+0xba/0x150 net/socket.c:2140
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
    Signed-off-by: Eric Dumazet
    Cc: Vlad Yasevich
    Cc: Neil Horman
    Cc: Marcelo Ricardo Leitner
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: Jakub Kicinski

    Eric Dumazet
     

25 Aug, 2020

1 commit

08 Aug, 2020

1 commit

  • 453431a54   mm, treewide: rename kzfree() to kfree_sensitive() ... Browse Code »

    As said by Linus:

    A symmetric naming is only helpful if it implies symmetries in use.
    Otherwise it's actively misleading.

    In "kzalloc()", the z is meaningful and an important part of what the
    caller wants.

    In "kzfree()", the z is actively detrimental, because maybe in the
    future we really _might_ want to use that "memfill(0xdeadbeef)" or
    something. The "zero" part of the interface isn't even _relevant_.

    The main reason that kzfree() exists is to clear sensitive information
    that should not be leaked to other future users of the same memory
    objects.

    Rename kzfree() to kfree_sensitive() to follow the example of the recently
    added kvfree_sensitive() and make the intention of the API more explicit.
    In addition, memzero_explicit() is used to clear the memory to make sure
    that it won't get optimized away by the compiler.

    The renaming is done by using the command sequence:

    git grep -w --name-only kzfree |\
    xargs sed -i 's/kzfree/kfree_sensitive/'

    followed by some editing of the kfree_sensitive() kerneldoc and adding
    a kzfree backward compatibility macro in slab.h.

    [akpm@linux-foundation.org: fs/crypto/inline_crypt.c needs linux/slab.h]
    [akpm@linux-foundation.org: fix fs/crypto/inline_crypt.c some more]

    Suggested-by: Joe Perches
    Signed-off-by: Waiman Long
    Signed-off-by: Andrew Morton
    Acked-by: David Howells
    Acked-by: Michal Hocko
    Acked-by: Johannes Weiner
    Cc: Jarkko Sakkinen
    Cc: James Morris
    Cc: "Serge E. Hallyn"
    Cc: Joe Perches
    Cc: Matthew Wilcox
    Cc: David Rientjes
    Cc: Dan Carpenter
    Cc: "Jason A . Donenfeld"
    Link: http://lkml.kernel.org/r/20200616154311.12314-3-longman@redhat.com
    Signed-off-by: Linus Torvalds

    Waiman Long
     

08 May, 2020

1 commit

  • 75b93c635   sctp: use crypto_shash_tfm_digest() ... Browse Code »

    Instead of manually allocating a 'struct shash_desc' on the stack and
    calling crypto_shash_digest(), switch to using the new helper function
    crypto_shash_tfm_digest() which does this for us.

    Cc: linux-sctp@vger.kernel.org
    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

20 Aug, 2019

2 commits

24 May, 2019

1 commit

  • 47505b8bc   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104 ... Browse Code »

    Based on 1 normalized pattern(s):

    this sctp implementation is free software you can redistribute it
    and or modify it under the terms of the gnu general public license
    as published by the free software foundation either version 2 or at
    your option any later version this sctp implementation is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details you should have received a copy of the gnu general
    public license along with gnu cc see the file copying if not see
    http www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 42 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Richard Fontana
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190523091649.683323110@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

25 Apr, 2019

1 commit

  • 877b5691f   crypto: shash - remove shash_desc::flags ... Browse Code »

    The flags field in 'struct shash_desc' never actually does anything.
    The only ostensibly supported flag is CRYPTO_TFM_REQ_MAY_SLEEP.
    However, no shash algorithm ever sleeps, making this flag a no-op.

    With this being the case, inevitably some users who can't sleep wrongly
    pass MAY_SLEEP. These would all need to be fixed if any shash algorithm
    actually started sleeping. For example, the shash_ahash_*() functions,
    which wrap a shash algorithm with the ahash API, pass through MAY_SLEEP
    from the ahash API to the shash API. However, the shash functions are
    called under kmap_atomic(), so actually they're assumed to never sleep.

    Even if it turns out that some users do need preemption points while
    hashing large buffers, we could easily provide a helper function
    crypto_shash_update_large() which divides the data into smaller chunks
    and calls crypto_shash_update() and cond_resched() for each chunk. It's
    not necessary to have a flag in 'struct shash_desc', nor is it necessary
    to make individual shash algorithms aware of this at all.

    Therefore, remove shash_desc::flags, and document that the
    crypto_shash_*() functions can be called from any context.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

09 Mar, 2019

1 commit

13 Jun, 2018

1 commit

  • 6396bb221   treewide: kzalloc() -> kcalloc() ... Browse Code »

    The kzalloc() function has a 2-factor argument form, kcalloc(). This
    patch replaces cases of:

    kzalloc(a * b, gfp)

    with:
    kcalloc(a * b, gfp)

    as well as handling cases of:

    kzalloc(a * b * c, gfp)

    with:

    kzalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kzalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kzalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kzalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kzalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kzalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kzalloc
    + kcalloc
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kzalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kzalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kzalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kzalloc(sizeof(THING) * C2, ...)
    |
    kzalloc(sizeof(TYPE) * C2, ...)
    |
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(C1 * C2, ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

15 Mar, 2018

3 commits

  • ec2e506c6   sctp: add SCTP_AUTH_FREE_KEY type for AUTHENTICATION_EVENT ... Browse Code »

    This patch is to add SCTP_AUTH_FREE_KEY type for AUTHENTICATION_EVENT,
    as described in section 6.1.8 of RFC6458.

    SCTP_AUTH_FREE_KEY: This report indicates that the SCTP
    implementation will no longer use the key identifier specified
    in auth_keynumber.

    After deactivating a key, it would never be used again, which means
    it's refcnt can't be held/increased by new chunks. But there may be
    some chunks in out queue still using it. So only when refcnt is 1,
    which means no chunk in outqueue is using/holding this key either,
    this EVENT would be sent.

    When users receive this notification, they could do DEL_KEY sockopt to
    remove this shkey, and also tell the peer that this key won't be used
    in any chunk thoroughly from now on, then the peer can remove it as
    well safely.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     
  • 601590ec1   sctp: add sockopt SCTP_AUTH_DEACTIVATE_KEY ... Browse Code »

    This patch is to add sockopt SCTP_AUTH_DEACTIVATE_KEY, as described in
    section 8.3.4 of RFC6458.

    This set option indicates that the application will no longer send user
    messages using the indicated key identifier.

    Note that RFC requires that only deactivated keys that are no longer used
    by an association can be deleted, but for the backward compatibility, it
    is not to check deactivated when deleting or replacing one sh_key.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     
  • 1b1e0bc99   sctp: add refcnt support for sh_key ... Browse Code »

    With refcnt support for sh_key, chunks auth sh_keys can be decided
    before enqueuing it. Changing the active key later will not affect
    the chunks already enqueued.

    Furthermore, this is necessary when adding the support for authinfo
    for sendmsg in next patch.

    Note that struct sctp_chunk can't be grown due to that performance
    drop issue on slow cpu, so it just reuses head_skb memory for shkey
    in sctp_chunk.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

17 Jul, 2017

3 commits

05 Jul, 2017

1 commit

02 Jul, 2017

2 commits

  • 3c9187049   sctp: remove the typedef sctp_paramhdr_t ... Browse Code »

    This patch is to remove the typedef sctp_paramhdr_t, and replace
    with struct sctp_paramhdr in the places where it's using this
    typedef.

    It is also to fix some indents and use sizeof(variable) instead
    of sizeof(type).

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • 6d85e68f4   sctp: remove the typedef sctp_cid_t ... Browse Code »

    This patch is to remove the typedef sctp_cid_t, and replace
    with struct sctp_cid in the places where it's using this
    typedef.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

11 Sep, 2016

1 commit

27 Jan, 2016

1 commit

16 Nov, 2015

1 commit

  • ed5a377d8   sctp: translate host order to network order when setting a hmacid ... Browse Code »

    now sctp auth cannot work well when setting a hmacid manually, which
    is caused by that we didn't use the network order for hmacid, so fix
    it by adding the transformation in sctp_auth_ep_set_hmacs.

    even we set hmacid with the network order in userspace, it still
    can't work, because of this condition in sctp_auth_ep_set_hmacs():

    if (id > SCTP_AUTH_HMAC_ID_MAX)
    return -EOPNOTSUPP;

    so this wasn't working before and thus it won't break compatibility.

    Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
    Signed-off-by: Xin Long
    Signed-off-by: Marcelo Ricardo Leitner
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    lucien
     

13 Jun, 2015

1 commit

  • ae36806a6   sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO ... Browse Code »

    Currently, we can ask to authenticate DATA chunks and we can send DATA
    chunks on the same packet as COOKIE_ECHO, but if you try to combine
    both, the DATA chunk will be sent unauthenticated and peer won't accept
    it, leading to a communication failure.

    This happens because even though the data was queued after it was
    requested to authenticate DATA chunks, it was also queued before we
    could know that remote peer can handle authenticating, so
    sctp_auth_send_cid() returns false.

    The fix is whenever we set up an active key, re-check send queue for
    chunks that now should be authenticated. As a result, such packet will
    now contain COOKIE_ECHO + AUTH + DATA chunks, in that order.

    Reported-by: Liu Wei
    Signed-off-by: Marcelo Ricardo Leitner
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Marcelo Ricardo Leitner
     

12 Nov, 2014

1 commit

  • 4184b2a79   net: sctp: fix memory leak in auth key management ... Browse Code »

    A very minimal and simple user space application allocating an SCTP
    socket, setting SCTP_AUTH_KEY setsockopt(2) on it and then closing
    the socket again will leak the memory containing the authentication
    key from user space:

    unreferenced object 0xffff8800837047c0 (size 16):
    comm "a.out", pid 2789, jiffies 4296954322 (age 192.258s)
    hex dump (first 16 bytes):
    01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] __kmalloc+0xe8/0x270
    [] sctp_auth_create_key+0x23/0x50 [sctp]
    [] sctp_auth_set_key+0xa1/0x140 [sctp]
    [] sctp_setsockopt+0xd03/0x1180 [sctp]
    [] sock_common_setsockopt+0x14/0x20
    [] SyS_setsockopt+0x71/0xd0
    [] system_call_fastpath+0x12/0x17
    [] 0xffffffffffffffff

    This is bad because of two things, we can bring down a machine from
    user space when auth_enable=1, but also we would leave security sensitive
    keying material in memory without clearing it after use. The issue is
    that sctp_auth_create_key() already sets the refcount to 1, but after
    allocation sctp_auth_set_key() does an additional refcount on it, and
    thus leaving it around when we free the socket.

    Fixes: 65b07e5d0d0 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
    Signed-off-by: Daniel Borkmann
    Cc: Vlad Yasevich
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

19 Apr, 2014

1 commit

  • b14878ccb   net: sctp: cache auth_enable per endpoint ... Browse Code »

    Currently, it is possible to create an SCTP socket, then switch
    auth_enable via sysctl setting to 1 and crash the system on connect:

    Oops[#1]:
    CPU: 0 PID: 0 Comm: swapper Not tainted 3.14.1-mipsgit-20140415 #1
    task: ffffffff8056ce80 ti: ffffffff8055c000 task.ti: ffffffff8055c000
    [...]
    Call Trace:
    [] sctp_auth_asoc_set_default_hmac+0x68/0x80
    [] sctp_process_init+0x5e0/0x8a4
    [] sctp_sf_do_5_1B_init+0x234/0x34c
    [] sctp_do_sm+0xb4/0x1e8
    [] sctp_endpoint_bh_rcv+0x1c4/0x214
    [] sctp_rcv+0x588/0x630
    [] sctp6_rcv+0x10/0x24
    [] ip6_input+0x2c0/0x440
    [] __netif_receive_skb_core+0x4a8/0x564
    [] process_backlog+0xb4/0x18c
    [] net_rx_action+0x12c/0x210
    [] __do_softirq+0x17c/0x2ac
    [] irq_exit+0x54/0xb0
    [] ret_from_irq+0x0/0x4
    [] rm7k_wait_irqoff+0x24/0x48
    [] cpu_startup_entry+0xc0/0x148
    [] start_kernel+0x37c/0x398
    Code: dd0900b8 000330f8 0126302d 50c0fff1 0047182a a48306a0
    03e00008 00000000
    ---[ end trace b530b0551467f2fd ]---
    Kernel panic - not syncing: Fatal exception in interrupt

    What happens while auth_enable=0 in that case is, that
    ep->auth_hmacs is initialized to NULL in sctp_auth_init_hmacs()
    when endpoint is being created.

    After that point, if an admin switches over to auth_enable=1,
    the machine can crash due to NULL pointer dereference during
    reception of an INIT chunk. When we enter sctp_process_init()
    via sctp_sf_do_5_1B_init() in order to respond to an INIT chunk,
    the INIT verification succeeds and while we walk and process
    all INIT params via sctp_process_param() we find that
    net->sctp.auth_enable is set, therefore do not fall through,
    but invoke sctp_auth_asoc_set_default_hmac() instead, and thus,
    dereference what we have set to NULL during endpoint
    initialization phase.

    The fix is to make auth_enable immutable by caching its value
    during endpoint initialization, so that its original value is
    being carried along until destruction. The bug seems to originate
    from the very first days.

    Fix in joint work with Daniel Borkmann.

    Reported-by: Joshua Kinard
    Signed-off-by: Vlad Yasevich
    Signed-off-by: Daniel Borkmann
    Acked-by: Neil Horman
    Tested-by: Joshua Kinard
    Signed-off-by: David S. Miller

    Vlad Yasevich
     

27 Dec, 2013

4 commits

07 Dec, 2013

1 commit

  • 4b2f13a25   sctp: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: Vlad Yasevich
    CC: Neil Horman
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

28 Oct, 2013

1 commit

10 Aug, 2013

1 commit

  • 477143e3f   net: sctp: trivial: update bug report in header comment ... Browse Code »

    With the restructuring of the lksctp.org site, we only allow bug
    reports through the SCTP mailing list linux-sctp@vger.kernel.org,
    not via SF, as SF is only used for web hosting and nothing more.
    While at it, also remove the obvious statement that bugs will be
    fixed and incooperated into the kernel.

    Signed-off-by: Daniel Borkmann
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

25 Jul, 2013

1 commit

  • 91705c61b   net: sctp: trivial: update mailing list address ... Browse Code »

    The SCTP mailing list address to send patches or questions
    to is linux-sctp@vger.kernel.org and not
    lksctp-developers@lists.sourceforge.net anymore. Therefore,
    update all occurences.

    Signed-off-by: Daniel Borkmann
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

09 Feb, 2013

2 commits

  • fd5023111   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    Synchronize with 'net' in order to sort out some l2tp, wireless, and
    ipv6 GRE fixes that will be built on top of in 'net-next'.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • 03536e23a   net: sctp: sctp_auth_make_key_vector: use sctp_auth_create_key ... Browse Code »

    In sctp_auth_make_key_vector, we allocate a temporary sctp_auth_bytes
    structure with kmalloc instead of the sctp_auth_create_key allocator.
    Change this to sctp_auth_create_key as it is the case everywhere else,
    so that we also can properly free it via sctp_auth_key_put. This makes
    it easier for future code changes in the structure and allocator itself,
    since a single API is consistently used for this purpose. Also, by
    using sctp_auth_create_key we're doing sanity checks over the arguments.

    Signed-off-by: Daniel Borkmann
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

08 Feb, 2013

2 commits

17 Aug, 2012

1 commit

15 Aug, 2012

1 commit