24 May, 2019

1 commit

  • Based on 1 normalized pattern(s):

    this sctp implementation is free software you can redistribute it
    and or modify it under the terms of the gnu general public license
    as published by the free software foundation either version 2 or at
    your option any later version this sctp implementation is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details you should have received a copy of the gnu general
    public license along with gnu cc see the file copying if not see
    http www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 42 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Richard Fontana
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190523091649.683323110@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

28 Aug, 2018

2 commits

  • After changing rhashtable_walk_start to return void, start_fail would
    never be set other value than 0, and the checking for start_fail is
    pointless, so remove it.

    Fixes: 97a6ec4ac021 ("rhashtable: Change rhashtable_walk_start to return void")
    Signed-off-by: Xin Long
    Acked-by: Neil Horman
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     
  • As Marcelo noticed, in sctp_transport_get_next, it is iterating over
    transports but then also accessing the association directly, without
    checking any refcnts before that, which can cause an use-after-free
    Read.

    So fix it by holding transport before accessing the association. With
    that, sctp_transport_hold calls can be removed in the later places.

    Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
    Reported-by: syzbot+fe62a0c9aa6a85c6de16@syzkaller.appspotmail.com
    Signed-off-by: Xin Long
    Acked-by: Neil Horman
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

16 May, 2018

2 commits

  • Variant of proc_create_data that directly take a seq_file show
    callback and deals with network namespaces in ->open and ->release.
    All callers of proc_create + single_open_net converted over, and
    single_{open,release}_net are removed entirely.

    Signed-off-by: Christoph Hellwig

    Christoph Hellwig
     
  • Variants of proc_create{,_data} that directly take a struct seq_operations
    and deal with network namespaces in ->open and ->release. All callers of
    proc_create + seq_open_net converted over, and seq_{open,release}_net are
    removed entirely.

    Signed-off-by: Christoph Hellwig

    Christoph Hellwig
     

27 Mar, 2018

1 commit

  • Prefer the direct use of octal for permissions.

    Done with checkpatch -f --types=SYMBOLIC_PERMS --fix-inplace
    and some typing.

    Miscellanea:

    o Whitespace neatening around these conversions.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

18 Mar, 2018

1 commit

  • use proc_remove_subtree() for subtree removal, both on setup failure
    halfway through and on teardown. No need to make simple things
    complex...

    Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     

17 Jan, 2018

1 commit

  • /proc has been ignoring struct file_operations::owner field for 10 years.
    Specifically, it started with commit 786d7e1612f0b0adb6046f19b906609e4fe8b1ba
    ("Fix rmmod/read/write races in /proc entries"). Notice the chunk where
    inode->i_fop is initialized with proxy struct file_operations for
    regular files:

    - if (de->proc_fops)
    - inode->i_fop = de->proc_fops;
    + if (de->proc_fops) {
    + if (S_ISREG(inode->i_mode))
    + inode->i_fop = &proc_reg_file_ops;
    + else
    + inode->i_fop = de->proc_fops;
    + }

    VFS stopped pinning module at this point.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

11 Dec, 2017

1 commit

  • Most callers of rhashtable_walk_start don't care about a resize event
    which is indicated by a return value of -EAGAIN. So calls to
    rhashtable_walk_start are wrapped wih code to ignore -EAGAIN. Something
    like this is common:

    ret = rhashtable_walk_start(rhiter);
    if (ret && ret != -EAGAIN)
    goto out;

    Since zero and -EAGAIN are the only possible return values from the
    function this check is pointless. The condition never evaluates to true.

    This patch changes rhashtable_walk_start to return void. This simplifies
    code for the callers that ignore -EAGAIN. For the few cases where the
    caller cares about the resize event, particularly where the table can be
    walked in mulitple parts for netlink or seq file dump, the function
    rhashtable_walk_start_check has been added that returns -EAGAIN on a
    resize event.

    Signed-off-by: Tom Herbert
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Tom Herbert
     

01 Jul, 2017

1 commit

  • refcount_t type and corresponding API should be
    used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova
    Signed-off-by: Hans Liljestrand
    Signed-off-by: Kees Cook
    Signed-off-by: David Windsor
    Signed-off-by: David S. Miller

    Reshetova, Elena
     

11 Jun, 2017

1 commit


03 Jun, 2017

1 commit

  • As Marcelo's suggestion, stream is a fixed size member of asoc and would
    not grow with more streams. To avoid an allocation for it, this patch is
    to define it as an object instead of pointer and update the places using
    it, also create sctp_stream_update() called in sctp_assoc_update() to
    migrate the stream info from one stream to another.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

02 Apr, 2017

1 commit

  • Since sctp reconf was added in sctp, the real cnt of in/out stream
    have not been c.sinit_max_instreams and c.sinit_num_ostreams any
    more.

    This patch is to replace them with stream->in/outcnt.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

30 Sep, 2016

2 commits


14 Aug, 2016

1 commit

  • sctp_transport_seq_start() does not currently clear iter->start_fail on
    success, but relies on it being zero when it is allocated (by
    seq_open_net()).

    This can be a problem in the following sequence:

    open() // allocates iter (and implicitly sets iter->start_fail = 0)
    read()
    - iter->start() // fails and sets iter->start_fail = 1
    - iter->stop() // doesn't call sctp_transport_walk_stop() (correct)
    read() again
    - iter->start() // succeeds, but doesn't change iter->start_fail
    - iter->stop() // doesn't call sctp_transport_walk_stop() (wrong)

    We should initialize sctp_ht_iter::start_fail to zero if ->start()
    succeeds, otherwise it's possible that we leave an old value of 1 there,
    which will cause ->stop() to not call sctp_transport_walk_stop(), which
    causes all sorts of problems like not calling rcu_read_unlock() (and
    preempt_enable()), eventually leading to more warnings like this:

    BUG: sleeping function called from invalid context at mm/slab.h:388
    in_atomic(): 0, irqs_disabled(): 0, pid: 16551, name: trinity-c2
    Preemption disabled at:[] rhashtable_walk_start+0x46/0x150

    [] preempt_count_add+0x1fb/0x280
    [] _raw_spin_lock+0x12/0x40
    [] rhashtable_walk_start+0x46/0x150
    [] sctp_transport_walk_start+0x2f/0x60
    [] sctp_transport_seq_start+0x4d/0x150
    [] traverse+0x170/0x850
    [] seq_read+0x7cc/0x1180
    [] proc_reg_read+0xbc/0x180
    [] do_loop_readv_writev+0x134/0x210
    [] do_readv_writev+0x565/0x660
    [] vfs_readv+0x67/0xa0
    [] do_preadv+0x126/0x170
    [] SyS_preadv+0xc/0x10
    [] do_syscall_64+0x19c/0x410
    [] return_from_SYSCALL_64+0x0/0x6a
    [] 0xffffffffffffffff

    Notice that this is a subtly different stacktrace from the one in commit
    5fc382d875 ("net/sctp: terminate rhashtable walk correctly").

    Cc: Xin Long
    Cc: Herbert Xu
    Cc: Eric W. Biederman
    Cc: Marcelo Ricardo Leitner
    Signed-off-by: Vegard Nossum
    Acked-By: Neil Horman
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Vegard Nossum
     

16 Apr, 2016

3 commits

  • When rhashtable_walk_init return err, no release function should be
    called, and when rhashtable_walk_start return err, we should only invoke
    rhashtable_walk_exit to release the source.

    But now when sctp_transport_walk_start return err, we just call
    rhashtable_walk_stop/exit, and never care about if rhashtable_walk_init
    or start return err, which is so bad.

    We will fix it by calling rhashtable_walk_exit if rhashtable_walk_start
    return err in sctp_transport_walk_start, and if sctp_transport_walk_start
    return err, we do not need to call sctp_transport_walk_stop any more.

    For sctp proc, we will use 'iter->start_fail' to decide if we will call
    rhashtable_walk_stop/exit.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • In sctp proc, these three functions in remaddrs and assocs are the
    same. we should merge them into one.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • For some main variables in sctp.ko, we couldn't export it to other modules,
    so we have to define some api to access them.

    It will include sctp transport and endpoint's traversal.

    There are some transport traversal functions for sctp_diag, we can also
    use it for sctp_proc. cause they have the similar situation to traversal
    transport.

    v2->v3:
    - rhashtable_walk_init need the parameter gfp, because of recent upstrem
    update

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

05 Apr, 2016

1 commit

  • In certain cases, the 802.11 mesh pathtable code wants to
    iterate over all of the entries in the forwarding table from
    the receive path, which is inside an RCU read-side critical
    section. Enable walks inside atomic sections by allowing
    GFP_ATOMIC allocations for the walker state.

    Change all existing callsites to pass in GFP_KERNEL.

    Acked-by: Thomas Graf
    Signed-off-by: Bob Copeland
    [also adjust gfs2/glock.c and rhashtable tests]
    Signed-off-by: Johannes Berg

    Bob Copeland
     

09 Mar, 2016

1 commit


02 Mar, 2016

1 commit

  • Now in sctp_remaddr_seq_show(), we use variable *tsp to get the param *v.
    but *tsp is also used to traversal transport_addr_list, which will cover
    the previous value, and make sctp_transport_put work on the wrong transport.

    So fix it by adding a new variable to get the param *v.

    Fixes: fba4c330c5b9 ("sctp: hold transport before we access t->asoc in sctp proc")
    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

18 Feb, 2016

1 commit


29 Jan, 2016

2 commits

  • After we use refcnt to check if transport is alive, the dead can be
    removed from sctp_transport.

    The traversal of transport_addr_list in procfs dump is using
    list_for_each_entry_rcu, no need to check if it has been freed.

    sctp_generate_t3_rtx_event and sctp_generate_heartbeat_event is
    protected by sock lock, it's not necessary to check dead, either.
    also, the timers are cancelled when sctp_transport_free() is
    called, that it doesn't wait for refcnt to reach 0 to cancel them.

    Signed-off-by: Xin Long
    Signed-off-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     
  • Previously, before rhashtable, /proc assoc listing was done by
    read-locking the entire hash entry and dumping all assocs at once, so we
    were sure that the assoc wasn't freed because it wouldn't be possible to
    remove it from the hash meanwhile.

    Now we use rhashtable to list transports, and dump entries one by one.
    That is, now we have to check if the assoc is still a good one, as the
    transport we got may be being freed.

    Signed-off-by: Xin Long
    Reviewed-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

16 Jan, 2016

1 commit

  • net/sctp/proc.c: In function ‘sctp_transport_get_idx’:
    net/sctp/proc.c:313: warning: ‘obj’ may be used uninitialized in this function

    This is currently a false positive, as all callers check for a zero
    offset first, and handle this case in the exact same way.

    Move the check and handling into sctp_transport_get_idx() to kill the
    compiler warning, and avoid future bugs.

    Signed-off-by: Geert Uytterhoeven
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Geert Uytterhoeven
     

06 Jan, 2016

1 commit


31 Oct, 2014

2 commits


15 May, 2014

1 commit

  • Fengguang reported the following sparse warning:

    >> net/ipv6/proc.c:198:41: sparse: incorrect type in argument 1 (different address spaces)
    net/ipv6/proc.c:198:41: expected void [noderef] *mib
    net/ipv6/proc.c:198:41: got void [noderef] **pcpumib

    Fixes: commit 698365fa1874aa7635d51667a3 (net: clean up snmp stats code)
    Reported-by: Fengguang Wu
    Cc: David S. Miller
    Signed-off-by: Cong Wang
    Signed-off-by: David S. Miller

    WANG Cong
     

22 Jan, 2014

1 commit


27 Dec, 2013

1 commit


07 Dec, 2013

1 commit

  • Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: Vlad Yasevich
    CC: Neil Horman
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

16 Aug, 2013

1 commit


10 Aug, 2013

1 commit

  • With the restructuring of the lksctp.org site, we only allow bug
    reports through the SCTP mailing list linux-sctp@vger.kernel.org,
    not via SF, as SF is only used for web hosting and nothing more.
    While at it, also remove the obvious statement that bugs will be
    fixed and incooperated into the kernel.

    Signed-off-by: Daniel Borkmann
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

25 Jul, 2013

1 commit

  • The SCTP mailing list address to send patches or questions
    to is linux-sctp@vger.kernel.org and not
    lksctp-developers@lists.sourceforge.net anymore. Therefore,
    update all occurences.

    Signed-off-by: Daniel Borkmann
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

26 Jun, 2013

1 commit


15 Jun, 2013

1 commit

  • This clearly states a BUG somewhere in the SCTP code as e.g. fixed once
    in f28156335 ("sctp: Use correct sideffect command in duplicate cookie
    handling"). If this ever happens, throw a trace in the sideeffect engine
    where assocs clearly must have a primary_path assigned.

    When in sctp_seq_dump_local_addrs() also throw a WARN and bail out since
    we do not need to panic for printing this one asterisk. Also, it will
    avoid the not so obvious case when primary != NULL test passes and at a
    later point in time triggering a NULL ptr dereference caused by primary.
    While at it, also fix up the white space.

    Signed-off-by: Daniel Borkmann
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

17 Apr, 2013

1 commit

  • sctp: Add buffer utilization fields to /proc/net/sctp/assocs

    This patch adds the following fields to /proc/net/sctp/assocs output:

    - sk->sk_wmem_alloc as "wmema" (transmit queue bytes committed)
    - sk->sk_wmem_queued as "wmemq" (persistent queue size)
    - sk->sk_sndbuf as "sndbuf" (size of send buffer in bytes)
    - sk->sk_rcvbuf as "rcvbuf" (size of receive buffer in bytes)

    When small DATA chunks containing 136 bytes data are sent the TX_QUEUE
    (assoc->sndbuf_used) reaches a maximum of 40.9% of sk_sndbuf value when
    peer.rwnd = 0. This was diagnosed from sk_wmem_alloc value reaching maximum
    value of sk_sndbuf.

    TX_QUEUE (assoc->sndbuf_used), sk_wmem_alloc and sk_wmem_queued values are
    incremented in sctp_set_owner_w() for outgoing data chunks. Having access to
    the above values in /proc/net/sctp/assocs will provide a better understanding
    of SCTP buffer management.

    With patch applied, example output when peer.rwnd = 0

    where:
    ASSOC ffff880132298000 is sender
    ffff880125343000 is receiver

    ASSOC SOCK STY SST ST HBKT ASSOC-ID TX_QUEUE RX_QUEUE \
    ffff880132298000 ffff880124a0a0c0 2 1 3 29325 1 214656 0 \
    ffff880125343000 ffff8801237d7700 2 1 3 36210 2 0 524520 \

    UID INODE LPORT RPORT LADDRS RADDRS HBINT INS OUTS \
    0 25108 3455 3456 *10.4.8.3 *10.5.8.3 7500 2 2 \
    0 27819 3456 3455 *10.5.8.3 *10.4.8.3 7500 2 2 \

    MAXRT T1X T2X RTXC wmema wmemq sndbuf rcvbuf
    4 0 0 72 525633 440320 524288 524288
    4 0 0 0 1 0 524288 524288

    Signed-off-by: Dilip Daya
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Dilip Daya
     

28 Feb, 2013

1 commit

  • I'm not sure why, but the hlist for each entry iterators were conceived

    list_for_each_entry(pos, head, member)

    The hlist ones were greedy and wanted an extra parameter:

    hlist_for_each_entry(tpos, pos, head, member)

    Why did they need an extra pos parameter? I'm not quite sure. Not only
    they don't really need it, it also prevents the iterator from looking
    exactly like the list iterator, which is unfortunate.

    Besides the semantic patch, there was some manual work required:

    - Fix up the actual hlist iterators in linux/list.h
    - Fix up the declaration of other iterators based on the hlist ones.
    - A very small amount of places were using the 'node' parameter, this
    was modified to use 'obj->member' instead.
    - Coccinelle didn't handle the hlist_for_each_entry_safe iterator
    properly, so those had to be fixed up manually.

    The semantic patch which is mostly the work of Peter Senna Tschudin is here:

    @@
    iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;

    type T;
    expression a,c,d,e;
    identifier b;
    statement S;
    @@

    -T b;

    [akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
    [akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
    [akpm@linux-foundation.org: checkpatch fixes]
    [akpm@linux-foundation.org: fix warnings]
    [akpm@linux-foudnation.org: redo intrusive kvm changes]
    Tested-by: Peter Senna Tschudin
    Acked-by: Paul E. McKenney
    Signed-off-by: Sasha Levin
    Cc: Wu Fengguang
    Cc: Marcelo Tosatti
    Cc: Gleb Natapov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sasha Levin