linux-toradex.git/net/sctp, branch v3.0-rc4

sctp: stop pending timers and purge queues when peer restart asoc

2011-05-31T22:29:17+00:00

If the peer restart the asoc, we should not only fail any unsent/unacked
data, but also stop the T3-rtx, SACK, T4-rto timers, and teardown ASCONF
queues.

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

sctp: fix memory leak of the ASCONF queue when free asoc

2011-05-25T21:55:32+00:00

If an ASCONF chunk is outstanding, then the following ASCONF
chunk will be queued for later transmission. But when we free
the asoc, we forget to free the ASCONF queue at the same time,
this will cause memory leak.

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

net: convert %p usage to %pK

2011-05-24T05:13:12+00:00

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

The supporting code for kptr_restrict and %pK are currently in the -mm
tree.  This patch converts users of %p in net/ to %pK.  Cases of printing
pointers to the syslog are not covered, since this would eliminate useful
information for postmortem debugging and the reading of the syslog is
already optionally protected by the dmesg_restrict sysctl.

Signed-off-by: Dan Rosenberg 
Cc: James Morris 
Cc: Eric Dumazet 
Cc: Thomas Graf 
Cc: Eugene Teo 
Cc: Kees Cook 
Cc: Ingo Molnar 
Cc: David S. Miller 
Cc: Peter Zijlstra 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

sctp: Fix build failure.

2011-05-21T06:10:23+00:00

Commit c182f90bc1f22ce5039b8722e45621d5f96862c2 ("SCTP: fix race
between sctp_bind_addr_free() and sctp_bind_addr_conflict()") and
commit 1231f0baa547a541a7481119323b7f964dda4788 ("net,rcu: convert
call_rcu(sctp_local_addr_free) to kfree_rcu()"), happening in
different trees, introduced a build failure.

Simply make the SCTP race fix use kfree_rcu() too.

Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2011-05-20T20:43:21+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1446 commits)
  macvlan: fix panic if lowerdev in a bond
  tg3: Add braces around 5906 workaround.
  tg3: Fix NETIF_F_LOOPBACK error
  macvlan: remove one synchronize_rcu() call
  networking: NET_CLS_ROUTE4 depends on INET
  irda: Fix error propagation in ircomm_lmp_connect_response()
  irda: Kill set but unused variable 'bytes' in irlan_check_command_param()
  irda: Kill set but unused variable 'clen' in ircomm_connect_indication()
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()
  be2net: Kill set but unused variable 'req' in lancer_fw_download()
  irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
  atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
  rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
  pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
  isdn: capi: Use pr_debug() instead of ifdefs.
  tg3: Update version to 3.119
  tg3: Apply rx_discards fix to 5719/5720
  ...

Fix up trivial conflicts in arch/x86/Kconfig and net/mac80211/agg-tx.c
as per Davem.

SCTP: fix race between sctp_bind_addr_free() and sctp_bind_addr_conflict()

2011-05-19T21:13:04+00:00

During the sctp_close() call, we do not use rcu primitives to
destroy the address list attached to the endpoint.  At the same
time, we do the removal of addresses from this list before
attempting to remove the socket from the port hash

As a result, it is possible for another process to find the socket
in the port hash that is in the process of being closed.  It then
proceeds to traverse the address list to find the conflict, only
to have that address list suddenly disappear without rcu() critical
section.

Fix issue by closing address list removal inside RCU critical
section.

Race can result in a kernel crash with general protection fault or
kernel NULL pointer dereference:

kernel: general protection fault: 0000 [#1] SMP
kernel: RIP: 0010:[]  [] sctp_bind_addr_conflict+0x64/0x82 [sctp]
kernel: Call Trace:
kernel:  [] ? sctp_get_port_local+0x17b/0x2a3 [sctp]
kernel:  [] ? sctp_bind_addr_match+0x33/0x68 [sctp]
kernel:  [] ? sctp_do_bind+0xd3/0x141 [sctp]
kernel:  [] ? sctp_bindx_add+0x4d/0x8e [sctp]
kernel:  [] ? sctp_setsockopt_bindx+0x112/0x4a4 [sctp]
kernel:  [] ? generic_file_aio_write+0x7f/0x9b
kernel:  [] ? sctp_setsockopt+0x14f/0xfee [sctp]
kernel:  [] ? do_sync_write+0xab/0xeb
kernel:  [] ? fsnotify+0x239/0x282
kernel:  [] ? alloc_file+0x18/0xb1
kernel:  [] ? compat_sys_setsockopt+0x1a5/0x1d9
kernel:  [] ? compat_sys_socketcall+0x143/0x1a4
kernel:  [] ? sysenter_dispatch+0x7/0x32

Signed-off-by: Jacek Luczak 
Acked-by: Vlad Yasevich 
CC: Eric Dumazet 
Reviewed-by: Eric Dumazet 
Signed-off-by: David S. Miller

sctp: sctp_sendmsg: Don't test known non-null sinfo

2011-05-12T21:30:50+00:00

It's already known non-null above.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

sctp: sctp_sendmsg: Don't initialize default_sinfo

2011-05-12T21:30:49+00:00

This variable only needs initialization when cmsgs.info
is NULL.

Use memset to ensure padding is also zeroed so
kernel doesn't leak any data.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

sctp: Remove rt->rt_src usage in sctp_v4_get_saddr()

2011-05-10T20:32:47+00:00

Flow key is available, so fetch it from there.

Signed-off-by: David S. Miller

sctp: Fix debug message args.

2011-05-09T04:24:07+00:00

I messed things up when I converted over to the transport
flow, I passed the ipv4 address value instead of it's address.

Reported-by: Stephen Rothwell 
Signed-off-by: David S. Miller