kernel.git/net/sctp/ipv6.c, branch linux-3.8.y

net: sctp: sctp_v6_get_dst: fix boolean test in dst cache

2013-02-13T18:42:34Z

We walk through the bind address list and try to get the best source address for a given destination. However, currently, we take the 'continue' path of the loop when an entry is invalid (!laddr->valid) *and* the entry state does not equal SCTP_ADDR_SRC (laddr->state != SCTP_ADDR_SRC). Thus, still, invalid entries with SCTP_ADDR_SRC might not 'continue' as well as valid entries with SCTP_ADDR_{NEW, SRC, DEL}, with a possible false baddr and matchlen as a result, causing in worst case dst route to be false or possibly NULL. This test should actually be a '||' instead of '&&'. But lets fix it and make this a bit easier to read by having the condition the same way as similarly done in sctp_v4_get_dst. Signed-off-by: Daniel Borkmann Acked-by: Vlad Yasevich Acked-by: Neil Horman Signed-off-by: David S. Miller

sctp: fix CONFIG_SCTP_DBG_MSG=y null pointer dereference in sctp_v6_get_dst()

2012-11-30T17:21:27Z

Trinity (the syscall fuzzer) triggered the following BUG, reproducible only when the kernel is configured with CONFIG_SCTP_DBG_MSG=y. When CONFIG_SCTP_DBG_MSG is not set, the null pointer is never dereferenced. ---[ end trace a4de0bfcb38a3642 ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000100 IP: [] ip6_string+0x1e/0xa0 PGD 4eead067 PUD 4e472067 PMD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: CPU 3 Pid: 21324, comm: trinity-child11 Tainted: G W 3.7.0-rc7+ #61 ASUSTeK Computer INC. EB1012/EB1012 RIP: 0010:[] [] ip6_string+0x1e/0xa0 RSP: 0018:ffff88004e4637a0 EFLAGS: 00010046 RAX: ffff88004e4637da RBX: ffff88004e4637da RCX: 0000000000000000 RDX: ffffffff8246e92a RSI: 0000000000000100 RDI: ffff88004e4637da RBP: ffff88004e4637a8 R08: 000000000000ffff R09: 000000000000ffff R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8289d600 R13: ffffffff8289d230 R14: ffffffff8246e928 R15: ffffffff8289d600 FS: 00007fed95153700(0000) GS:ffff88005fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000100 CR3: 000000004eeac000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process trinity-child11 (pid: 21324, threadinfo ffff88004e462000, task ffff8800524b0000) Stack: ffff88004e4637da ffff88004e463828 ffffffff81368eee 000000004e4637d8 ffffffff0000ffff ffff88000000ffff 0000000000000000 000000004e4637f8 ffffffff826285d8 ffff88004e4637f8 0000000000000000 ffff8800524b06b0 Call Trace: [] ip6_addr_string.isra.11+0x3e/0xa0 [] pointer.isra.12+0x233/0x2d0 [] ? vprintk_emit+0x1ba/0x450 [] ? trace_hardirqs_on_caller+0x10d/0x1a0 [] vsnprintf+0x187/0x5d0 [] vscnprintf+0x12/0x30 [] vprintk_emit+0xa8/0x450 [] printk+0x49/0x4b [] sctp_v6_get_dst+0x731/0x780 [] ? sctp_v6_get_dst+0x325/0x780 [] sctp_transport_route+0x46/0x120 [] sctp_assoc_add_peer+0x161/0x350 [] sctp_sendmsg+0x6cd/0xcb0 [] ? inet_create+0x670/0x670 [] inet_sendmsg+0x10b/0x220 [] ? inet_create+0x670/0x670 [] ? sock_update_classid+0xa4/0x2b0 [] ? sock_update_classid+0xf0/0x2b0 [] sock_sendmsg+0xdc/0xf0 [] ? might_fault+0x85/0x90 [] ? might_fault+0x3c/0x90 [] sys_sendto+0xfa/0x130 [] ? do_setitimer+0x197/0x380 [] ? sysret_check+0x22/0x5d [] system_call_fastpath+0x16/0x1b Code: 01 eb 89 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 f8 31 c9 48 89 e5 53 eb 12 0f 1f 40 00 48 83 c1 01 48 83 c0 04 48 83 f9 08 74 70 <0f> b6 3c 4e 89 fb 83 e7 0f c0 eb 04 41 89 d8 41 83 e0 0f 0f b6 RIP [] ip6_string+0x1e/0xa0 RSP CR2: 0000000000000100 ---[ end trace a4de0bfcb38a3643 ]--- Signed-off-by: Tommi Rantala Acked-by: Vlad Yasevich Signed-off-by: David S. Miller

sctp: Make the mib per network namespace

2012-08-15T06:30:36Z

Signed-off-by: "Eric W. Biederman" Acked-by: Vlad Yasevich Signed-off-by: David S. Miller

sctp: Enable sctp in all network namespaces

2012-08-15T06:29:59Z

- Fix the sctp_af operations to work in all namespaces - Enable sctp socket creation in all network namespaces. Signed-off-by: "Eric W. Biederman" Acked-by: Vlad Yasevich Signed-off-by: David S. Miller

sctp: Make the address lists per network namespace

2012-08-15T06:12:17Z

- Move the address lists into struct net - Add per network namespace initialization and cleanup - Pass around struct net so it is everywhere I need it. - Rename all of the global variable references into references to the variables moved into struct net Signed-off-by: "Eric W. Biederman" Acked-by: Vlad Yasevich Signed-off-by: David S. Miller

sctp: Make the association hashtable handle multiple network namespaces

2012-08-15T05:44:12Z

- Use struct net in the hash calculation - Use sock_net(association.base.sk) in the association lookups. - On receive calculate the network namespace from skb->dev. - Pass struct net from receive down to the functions that actually do the association lookup. Signed-off-by: "Eric W. Biederman" Acked-by: Vlad Yasevich Signed-off-by: David S. Miller

ipv6: Add redirect support to all protocol icmp error handlers.

2012-07-12T07:25:15Z

Signed-off-by: David S. Miller

net: remove ipv6_addr_copy()

2011-11-22T21:43:32Z

C assignment can handle struct in6_addr copying. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller

ipv6: tcp: fix TCLASS value in ACK messages sent from TIME_WAIT

2011-10-27T04:44:35Z

commit 66b13d99d96a (ipv4: tcp: fix TOS value in ACK messages sent from TIME_WAIT) fixed IPv4 only. This part is for the IPv6 side, adding a tclass param to ip6_xmit() We alias tw_tclass and tw_tos, if socket family is INET6. [ if sockets is ipv4-mapped, only IP_TOS socket option is used to fill TOS field, TCLASS is not taken into account ] Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

sctp: Add Auto-ASCONF support (core).

2011-06-02T09:04:53Z

SCTP reconfigure the IP addresses in the association by using ASCONF chunks as mentioned in RFC5061. For example, we can start to use the newly configured IP address in the existing association. This patch implements automatic ASCONF operation in the SCTP stack with address events in the host computer, which is called auto_asconf. Signed-off-by: Michio Honda Signed-off-by: YOSHIFUJI Hideaki Acked-by: Wei Yongjun Signed-off-by: David S. Miller