Eric Lee / smarc-fsl-linux-kernel

05 Dec, 2019

1 commit

  • 0111438d7   sctp: cache netns in sctp_ep_common ... Browse Code »

    [ Upstream commit 312434617cb16be5166316cf9d08ba760b1042a1 ]

    This patch is to fix a data-race reported by syzbot:

    BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj

    write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1:
    sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091
    sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465
    sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916
    inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734
    __sys_accept4+0x224/0x430 net/socket.c:1754
    __do_sys_accept net/socket.c:1795 [inline]
    __se_sys_accept net/socket.c:1792 [inline]
    __x64_sys_accept+0x4e/0x60 net/socket.c:1792
    do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0:
    sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894
    rht_key_get_hash include/linux/rhashtable.h:133 [inline]
    rht_key_hashfn include/linux/rhashtable.h:159 [inline]
    rht_head_hashfn include/linux/rhashtable.h:174 [inline]
    head_hashfn lib/rhashtable.c:41 [inline]
    rhashtable_rehash_one lib/rhashtable.c:245 [inline]
    rhashtable_rehash_chain lib/rhashtable.c:276 [inline]
    rhashtable_rehash_table lib/rhashtable.c:316 [inline]
    rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420
    process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
    worker_thread+0xa0/0x800 kernel/workqueue.c:2415
    kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

    It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate
    is changing its value. However, what rhashtable wants is netns from asoc
    base.sk, and for an asoc, its netns won't change once set. So we can
    simply fix it by caching netns since created.

    Fixes: d6c0256a60e6 ("sctp: add the rhashtable apis for sctp global transport hashtable")
    Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com
    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: Jakub Kicinski
    Signed-off-by: Greg Kroah-Hartman

    Xin Long
     

20 Aug, 2019

1 commit

09 Jul, 2019

2 commits

24 May, 2019

1 commit

  • 47505b8bc   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104 ... Browse Code »

    Based on 1 normalized pattern(s):

    this sctp implementation is free software you can redistribute it
    and or modify it under the terms of the gnu general public license
    as published by the free software foundation either version 2 or at
    your option any later version this sctp implementation is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details you should have received a copy of the gnu general
    public license along with gnu cc see the file copying if not see
    http www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 42 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Richard Fontana
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190523091649.683323110@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

30 Jan, 2019

2 commits

10 Dec, 2018

1 commit

  • 4cc1feeb6   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    Several conflicts, seemingly all over the place.

    I used Stephen Rothwell's sample resolutions for many of these, if not
    just to double check my own work, so definitely the credit largely
    goes to him.

    The NFP conflict consisted of a bug fix (moving operations
    past the rhashtable operation) while chaning the initial
    argument in the function call in the moved code.

    The net/dsa/master.c conflict had to do with a bug fix intermixing of
    making dsa_master_set_mtu() static with the fixing of the tagging
    attribute location.

    cls_flower had a conflict because the dup reject fix from Or
    overlapped with the addition of port range classifiction.

    __set_phy_supported()'s conflict was relatively easy to resolve
    because Andrew fixed it in both trees, so it was just a matter
    of taking the net-next copy. Or at least I think it was :-)

    Joe Stringer's fix to the handling of netns id 0 in bpf_sk_lookup()
    intermixed with changes on how the sdif and caller_net are calculated
    in these code paths in net-next.

    The remaining BPF conflicts were largely about the addition of the
    __bpf_md_ptr stuff in 'net' overlapping with adjustments and additions
    to the relevant data structure where the MD pointer macros are used.

    Signed-off-by: David S. Miller

    David S. Miller
     

04 Dec, 2018

1 commit

  • fb6df5a62   sctp: kfree_rcu asoc ... Browse Code »

    In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences
    a transport's asoc under rcu_read_lock while asoc is freed not after
    a grace period, which leads to a use-after-free panic.

    This patch fixes it by calling kfree_rcu to make asoc be freed after
    a grace period.

    Note that only the asoc's memory is delayed to free in the patch, it
    won't cause sk to linger longer.

    Thanks Neil and Marcelo to make this clear.

    Fixes: 7fda702f9315 ("sctp: use new rhlist interface on sctp transport rhashtable")
    Fixes: cd2b70875058 ("sctp: check duplicate node before inserting a new transport")
    Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com
    Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com
    Suggested-by: Neil Horman
    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Xin Long
     

01 Dec, 2018

1 commit

  • 4135cce7f   sctp: update frag_point when stream_interleave is set ... Browse Code »

    sctp_assoc_update_frag_point() should be called whenever asoc->pathmtu
    changes, but we missed one place in sctp_association_init(). It would
    cause frag_point is zero when sending data.

    As says in Jakub's reproducer, if sp->pathmtu is set by socketopt, the
    new asoc->pathmtu inherits it in sctp_association_init(). Later when
    transports are added and their pmtu >= asoc->pathmtu, it will never
    call sctp_assoc_update_frag_point() to set frag_point.

    This patch is to fix it by updating frag_point after asoc->pathmtu is
    set as sp->pathmtu in sctp_association_init(). Note that it moved them
    after sctp_stream_init(), as stream->si needs to be set first.

    Frag_point's calculation is also related with datachunk's type, so it
    needs to update frag_point when stream->si may be changed in
    sctp_process_init().

    v1->v2:
    - call sctp_assoc_update_frag_point() separately in sctp_process_init
    and sctp_association_init, per Marcelo's suggestion.

    Fixes: 2f5e3c9df693 ("sctp: introduce sctp_assoc_update_frag_point")
    Reported-by: Jakub Audykowicz
    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Xin Long
     

20 Nov, 2018

1 commit

  • a1e3a0590   sctp: add subscribe per asoc ... Browse Code »

    The member subscribe should be per asoc, so that sockopt SCTP_EVENT
    in the next patch can subscribe a event from one asoc only.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

30 Oct, 2018

1 commit

  • df132eff4   sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer ... Browse Code »

    If a transport is removed by asconf but there still are some chunks with
    this transport queuing on out_chunk_list, later an use-after-free issue
    will be caused when accessing this transport from these chunks in
    sctp_outq_flush().

    This is an old bug, we fix it by clearing the transport of these chunks
    in out_chunk_list when removing a transport in sctp_assoc_rm_peer().

    Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com
    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

16 Oct, 2018

1 commit

  • d805397c3   sctp: use the pmtu from the icmp packet to update transport pathmtu ... Browse Code »

    Other than asoc pmtu sync from all transports, sctp_assoc_sync_pmtu
    is also processing transport pmtu_pending by icmp packets. But it's
    meaningless to use sctp_dst_mtu(t->dst) as new pmtu for a transport.

    The right pmtu value should come from the icmp packet, and it would
    be saved into transport->mtu_info in this patch and used later when
    the pmtu sync happens in sctp_sendmsg_to_asoc or sctp_packet_config.

    Besides, without this patch, as pmtu can only be updated correctly
    when receiving a icmp packet and no place is holding sock lock, it
    will take long time if the sock is busy with sending packets.

    Note that it doesn't process transport->mtu_info in .release_cb(),
    as there is no enough information for pmtu update, like for which
    asoc or transport. It is not worth traversing all asocs to check
    pmtu_pending. So unlike tcp, sctp does this in tx path, for which
    mtu_info needs to be atomic_t.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

04 Jul, 2018

2 commits

  • 4be4139f7   sctp: add support for setting flowlabel when adding a transport ... Browse Code »

    Struct sockaddr_in6 has the member sin6_flowinfo that includes the
    ipv6 flowlabel, it should also support for setting flowlabel when
    adding a transport whose ipaddr is from userspace.

    Note that addrinfo in sctp_sendmsg is using struct in6_addr for
    the secondary addrs, which doesn't contain sin6_flowinfo, and
    it needs to copy sin6_flowinfo from the primary addr.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • 8a9c58d28   sctp: add support for dscp and flowlabel per transport ... Browse Code »

    Like some other per transport params, flowlabel and dscp are added
    in transport, asoc and sctp_sock. By default, transport sets its
    value from asoc's, and asoc does it from sctp_sock. flowlabel
    only works for ipv6 transport.

    Other than that they need to be passed down in sctp_xmit, flow4/6
    also needs to set them before looking up route in get_dst.

    Note that it uses '& 0x100000' to check if flowlabel is set and
    '& 0x1' (tos 1st bit is unused) to check if dscp is set by users,
    so that they could be set to 0 by sockopt in next patch.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

12 May, 2018

1 commit

  • b2d6cee11   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    The bpf syscall and selftests conflicts were trivial
    overlapping changes.

    The r8169 change involved moving the added mdelay from 'net' into a
    different function.

    A TLS close bug fix overlapped with the splitting of the TLS state
    into separate TX and RX parts. I just expanded the tests in the bug
    fix from "ctx->conf == X" into "ctx->tx_conf == X && ctx->rx_conf
    == X".

    Signed-off-by: David S. Miller

    David S. Miller
     

08 May, 2018

1 commit

  • 59d8d4434   sctp: delay the authentication for the duplicated cookie-echo chunk ... Browse Code »

    Now sctp only delays the authentication for the normal cookie-echo
    chunk by setting chunk->auth_chunk in sctp_endpoint_bh_rcv(). But
    for the duplicated one with auth, in sctp_assoc_bh_rcv(), it does
    authentication first based on the old asoc, which will definitely
    fail due to the different auth info in the old asoc.

    The duplicated cookie-echo chunk will create a new asoc with the
    auth info from this chunk, and the authentication should also be
    done with the new asoc's auth info for all of the collision 'A',
    'B' and 'D'. Otherwise, the duplicated cookie-echo chunk with auth
    will never pass the authentication and create the new connection.

    This issue exists since very beginning, and this fix is to make
    sctp_assoc_bh_rcv() follow the way sctp_endpoint_bh_rcv() does
    for the normal cookie-echo chunk to delay the authentication.

    While at it, remove the unused params from sctp_sf_authenticate()
    and define sctp_auth_chunk_verify() used for all the places that
    do the delayed authentication.

    v1->v2:
    fix the typo in changelog as Marcelo noticed.

    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: Xin Long
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Xin Long
     

28 Apr, 2018

5 commits

26 Apr, 2018

1 commit

12 Dec, 2017

1 commit

  • 9162e0ed9   sctp: implement enqueue_event for sctp_stream_interleave ... Browse Code »

    enqueue_event is added as a member of sctp_stream_interleave, used to
    enqueue either data, idata or notification events into user socket rx
    queue.

    It replaces sctp_ulpq_tail_event used in the other places with
    enqueue_event.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Xin Long
     

25 Oct, 2017

1 commit

  • 9c3b57518   net: sctp: Convert timers to use timer_setup() ... Browse Code »

    In preparation for unconditionally passing the struct timer_list pointer to
    all timer callbacks, switch to using the new timer_setup() and from_timer()
    to pass the timer pointer explicitly.

    Cc: Vlad Yasevich
    Cc: Neil Horman
    Cc: "David S. Miller"
    Cc: linux-sctp@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Signed-off-by: Kees Cook
    Signed-off-by: David S. Miller

    Kees Cook
     

07 Aug, 2017

3 commits

  • bfc6f8270   sctp: remove the typedef sctp_subtype_t ... Browse Code »

    This patch is to remove the typedef sctp_subtype_t, and
    replace with union sctp_subtype in the places where it's
    using this typedef.

    Note that it doesn't fix many indents although it should,
    as sctp_disposition_t's removal would mess them up again.
    So better to fix them when removing sctp_disposition_t in
    later patch.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • 0ceaeebe2   sctp: remove the typedef sctp_transport_cmd_t ... Browse Code »

    This patch is to remove the typedef sctp_transport_cmd_t, and
    replace with enum sctp_transport_cmd in the places where it's
    using this typedef.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • 1c662018d   sctp: remove the typedef sctp_scope_t ... Browse Code »

    This patch is to remove the typedef sctp_scope_t, and
    replace with enum sctp_scope in the places where it's
    using this typedef.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

05 Jul, 2017

1 commit

02 Jul, 2017

1 commit

  • 3c9187049   sctp: remove the typedef sctp_paramhdr_t ... Browse Code »

    This patch is to remove the typedef sctp_paramhdr_t, and replace
    with struct sctp_paramhdr in the places where it's using this
    typedef.

    It is also to fix some indents and use sizeof(variable) instead
    of sizeof(type).

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

21 Jun, 2017

1 commit

  • 5ee8aa689   sctp: handle errors when updating asoc ... Browse Code »

    It's a bad thing not to handle errors when updating asoc. The memory
    allocation failure in any of the functions called in sctp_assoc_update()
    would cause sctp to work unexpectedly.

    This patch is to fix it by aborting the asoc and reporting the error when
    any of these functions fails.

    Signed-off-by: Xin Long
    Acked-by: Neil Horman
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

11 Jun, 2017

1 commit

03 Jun, 2017

2 commits

  • ff356414d   sctp: merge sctp_stream_new and sctp_stream_init ... Browse Code »

    Since last patch, sctp doesn't need to alloc memory for asoc->stream any
    more. sctp_stream_new and sctp_stream_init both are used to alloc memory
    for stream.in or stream.out, and their names are also confusing.

    This patch is to merge them into sctp_stream_init, and only pass stream
    and streamcnt parameters into it, instead of the whole asoc.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     
  • cee360ab4   sctp: define the member stream as an object instead of pointer in asoc ... Browse Code »

    As Marcelo's suggestion, stream is a fixed size member of asoc and would
    not grow with more streams. To avoid an allocation for it, this patch is
    to define it as an object instead of pointer and update the places using
    it, also create sctp_stream_update() called in sctp_assoc_update() to
    migrate the stream info from one stream to another.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

25 May, 2017

1 commit

  • 3ab213791   sctp: fix stream update when processing dupcookie ... Browse Code »

    Since commit 3dbcc105d556 ("sctp: alloc stream info when initializing
    asoc"), stream and stream.out info are always alloced when creating
    an asoc.

    So it's not correct to check !asoc->stream before updating stream
    info when processing dupcookie, but would be better to check asoc
    state instead.

    Fixes: 3dbcc105d556 ("sctp: alloc stream info when initializing asoc")
    Signed-off-by: Xin Long
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Xin Long
     

05 Apr, 2017

1 commit

  • 3ebfdf082   sctp: get sock from transport in sctp_transport_update_pmtu ... Browse Code »

    This patch is almost to revert commit 02f3d4ce9e81 ("sctp: Adjust PMTU
    updates to accomodate route invalidation."). As t->asoc can't be NULL
    in sctp_transport_update_pmtu, it could get sk from asoc, and no need
    to pass sk into that function.

    It is also to remove some duplicated codes from that function.

    Signed-off-by: Xin Long
    Acked-by: Marcelo Ricardo Leitner
    Signed-off-by: David S. Miller

    Xin Long
     

31 Mar, 2017

1 commit

  • 3dbcc105d   sctp: alloc stream info when initializing asoc ... Browse Code »

    When sending a msg without asoc established, sctp will send INIT packet
    first and then enqueue chunks.

    Before receiving INIT_ACK, stream info is not yet alloced. But enqueuing
    chunks needs to access stream info, like out stream state and out stream
    cnt.

    This patch is to fix it by allocing out stream info when initializing an
    asoc, allocing in stream and re-allocing out stream when processing init.

    Signed-off-by: Xin Long
    Signed-off-by: David S. Miller

    Xin Long
     

23 Mar, 2017

1 commit

08 Feb, 2017

1 commit

  • c86a773c7   sctp: add dst_pending_confirm flag ... Browse Code »

    Add new transport flag to allow sockets to confirm neighbour.
    When same struct dst_entry can be used for many different
    neighbours we can not use it for pending confirmations.
    The flag is propagated from transport to every packet.
    It is reset when cached dst is reset.

    Reported-by: YueHaibing
    Fixes: 5110effee8fd ("net: Do delayed neigh confirmation.")
    Fixes: f2bb4bedf35d ("ipv4: Cache output routes in fib_info nexthops.")
    Signed-off-by: Julian Anastasov
    Acked-by: Eric Dumazet
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Julian Anastasov
     

19 Jan, 2017

1 commit