On Sat, Aug 22, 2020 at 12:49:02PM -0700, David Miller wrote:
>
> From: Neil Horman
>
> Neil, you might want to fix this so people can reply to you :-)
Crap, thanks, new computer.
Neil
>
On Sat, Aug 22, 2020 at 08:23:29AM +1000, Herbert Xu wrote:
> The function consume_skb is only meaningful when tracing is enabled.
> This patch makes it conditional on CONFIG_TRACEPOINTS.
>
> Signed-off-by: Herbert Xu
>
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index 46881
On Tue, Aug 04, 2020 at 04:14:14PM -0700, David Miller wrote:
> From: izabela.bakoll...@gmail.com
> Date: Tue, 4 Aug 2020 18:09:08 +0200
>
> > @@ -1315,6 +1334,53 @@ static int net_dm_cmd_trace(struct sk_buff *skb,
> > return -EOPNOTSUPP;
> > }
> >
> > +static int net_dm_interface_start(st
On Tue, Aug 04, 2020 at 02:28:28PM -0700, Cong Wang wrote:
> On Tue, Aug 4, 2020 at 9:14 AM wrote:
> >
> > From: Izabela Bakollari
> >
> > Dropwatch is a utility that monitors dropped frames by having userspace
> > record them over the dropwatch protocol over a file. This augument
> > allows live
On Sat, Jun 13, 2020 at 08:39:25PM +0800, Xiyu Yang wrote:
> In sctp_skb_recv_datagram(), the function fetch a sk_buff object from
> the receiving queue to "skb" by calling skb_peek() or __skb_dequeue()
> and return its reference to the caller.
>
> However, when calling __skb_dequeue() successfull
On Sun, Apr 19, 2020 at 12:25:36PM +0200, Harald Welte wrote:
> Dear Linux SCTP developers,
>
> this patchset (merged back in Q4/2019) has broken ABI compatibility, more
> or less exactly as it was discussed/predicted in Message-Id
> <20190206201430.18830-1-jul...@arista.com>
> "[PATCH net] sctp:
e has only
occured in production environments where test kernels are enjoined from being
installed. It appears to be a sane fix to me though. Also, recentely,
Jere found a reproducer posted on list to confirm that this resolves the
issues
Signed-off-by: Neil Horman
CC: Vlad Yasevich
CC: "
gt; *location)
>*/
> __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
> nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
> - memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
> - msg->points[msg->entries].count = 1;
> + memcpy(point->pc, &location, sizeof(void *));
> + point->count = 1;
> msg->entries++;
>
> if (!timer_pending(&data->send_timer)) {
Acked-by: Neil Horman
tl.c | 19 ++
> 9 files changed, 226 insertions(+), 34 deletions(-)
>
> --
> 2.1.0
>
>
Series
Acked-by: Neil Horman
On Mon, Oct 14, 2019 at 04:36:34PM +0800, Xin Long wrote:
> On Thu, Oct 10, 2019 at 12:18 AM Neil Horman wrote:
> >
> > On Tue, Oct 08, 2019 at 11:28:32PM +0800, Xin Long wrote:
> > > On Tue, Oct 8, 2019 at 9:02 PM David Laight
> > > wrote:
> > > &
On Sat, Oct 12, 2019 at 12:25:27AM +0800, Xin Long wrote:
> On Fri, Oct 11, 2019 at 11:57 PM Xin Long wrote:
> >
> > On Thu, Oct 10, 2019 at 8:40 PM Neil Horman wrote:
> > >
> > > On Thu, Oct 10, 2019 at 05:28:34PM +0800, Xin Long wrote:
> > > >
On Thu, Oct 10, 2019 at 05:28:34PM +0800, Xin Long wrote:
> On Thu, Oct 10, 2019 at 12:18 AM Neil Horman wrote:
> >
> > On Tue, Oct 08, 2019 at 11:28:32PM +0800, Xin Long wrote:
> > > On Tue, Oct 8, 2019 at 9:02 PM David Laight
> > > wrote:
> > > &
| 22 +++--
> net/sctp/chunk.c| 40 +++
> net/sctp/ulpevent.c | 57
> -
> 5 files changed, 108 insertions(+), 43 deletions(-)
>
> --
> 2.1.0
>
>
Series
Acked-by: Neil Horman
On Tue, Oct 08, 2019 at 11:28:32PM +0800, Xin Long wrote:
> On Tue, Oct 8, 2019 at 9:02 PM David Laight wrote:
> >
> > From: Xin Long
> > > Sent: 08 October 2019 12:25
> > >
> > > This is a sockopt defined in section 7.3 of rfc7829: "Exposing
> > > the Potentially Failed Path State", by which user
backloged)
> return 0;
> } else {
> - sctp_inq_push(inqueue, chunk);
> + if (!sctp_newsk_ready(sk)) {
> + if (!sk_add_backlog(sk, skb, sk->sk_rcvbuf))
> + return 0;
> + sctp_chunk_free(chunk);
> + } else {
> + sctp_inq_push(inqueue, chunk);
> + }
> }
>
> done:
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Wed, Oct 02, 2019 at 04:23:52PM +0800, Xin Long wrote:
> On Wed, Oct 2, 2019 at 9:04 AM Marcelo Ricardo Leitner
> wrote:
> >
> > On Mon, Sep 30, 2019 at 09:10:18PM +0800, Xin Long wrote:
> > > This patch is to fix a NULL-ptr deref crash in selinux_sctp_bind_connect:
> > >
> > > [...] kasan: G
if (put_user(len, optlen) || copy_to_user(optval, &val, len))
> return -EFAULT;
>
> --
> 2.1.0
>
>
Acked-by: Neil Horman
transport->pathmaxrxt) &&
> -(transport->error_count > asoc->pf_retrans)) {
> +(transport->error_count > transport->pf_retrans)) {
>
> sctp_assoc_control_transport(asoc, transport,
>SCTP_TRANSPORT_PF,
> --
> 2.1.0
>
>
Acked-by: Neil Horman
3 ++
> net/sctp/sm_make_chunk.c | 16 +++---
> net/sctp/socket.c | 73
> ++
> net/sctp/sysctl.c | 7 +
> 8 files changed, 102 insertions(+), 5 deletions(-)
>
> --
> 2.1.0
>
>
Series
Acked-by: Neil Horman
e;
> }
>
> - if (ktime_to_timespec_cond(skb->tstamp, &ts) &&
> - nla_put(msg, NET_DM_ATTR_TIMESTAMP, sizeof(ts), &ts))
> + if (nla_put_u64_64bit(msg, NET_DM_ATTR_TIMESTAMP,
> + ktime_to_ns(skb->tstamp), NET_DM_ATTR_PAD))
> goto nla_put_failure;
>
> if (nla_put_u32(msg, NET_DM_ATTR_ORIG_LEN, skb->len))
> --
> 2.21.0
>
>
Acked-by: Neil Horman
association *asoc,
> nstr_list[i] = htons(str_list[i]);
>
> if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
> + kfree(nstr_list);
> retval = -EAGAIN;
> goto out;
> }
> --
> 2.7.4
>
>
Acked-by: Neil Horman
On Wed, Jul 31, 2019 at 04:32:43AM -0700, Joe Perches wrote:
> On Wed, 2019-07-31 at 07:19 -0400, Neil Horman wrote:
> > On Tue, Jul 30, 2019 at 10:04:37PM -0700, Joe Perches wrote:
> > > fallthrough may become a pseudo reserved keyword so this only use of
> > > fallt
> +F: include/uapi/linux/net_dropmon.h
>
> NETWORKING DRIVERS
> M: "David S. Miller"
> --
> 2.21.0
>
>
Acked-by: Neil Horman
On Wed, Jul 24, 2019 at 04:12:43PM -0300, Marcelo Ricardo Leitner wrote:
> On Wed, Jul 24, 2019 at 04:05:43PM -0300, Marcelo Ricardo Leitner wrote:
> > On Wed, Jul 24, 2019 at 02:44:56PM -0400, Neil Horman wrote:
> > > On Wed, Jul 24, 2019 at 09:49:07AM -0300, Marcelo Ric
On Wed, Jul 24, 2019 at 04:05:43PM -0300, Marcelo Ricardo Leitner wrote:
> On Wed, Jul 24, 2019 at 02:44:56PM -0400, Neil Horman wrote:
> > On Wed, Jul 24, 2019 at 09:49:07AM -0300, Marcelo Ricardo Leitner wrote:
> > > On Wed, Jul 24, 2019 at 09:36:50AM -0300, Marcelo Ric
On Wed, Jul 24, 2019 at 11:25:12AM -0300, Marcelo Ricardo Leitner wrote:
> On Tue, Jul 23, 2019 at 01:37:56AM +0800, Xin Long wrote:
> > This patchset is to factor out some common code for
> > sctp_sendmsg_new_asoc() and __sctp_connect() into 2
> > new functioins.
> >
> > Xin Long (4):
> > sctp:
On Wed, Jul 24, 2019 at 09:49:07AM -0300, Marcelo Ricardo Leitner wrote:
> On Wed, Jul 24, 2019 at 09:36:50AM -0300, Marcelo Ricardo Leitner wrote:
> > On Wed, Jul 24, 2019 at 07:22:35AM -0400, Neil Horman wrote:
> > > On Wed, Jul 24, 2019 at 03:21:12PM +0800, Xin Long wrote:
&
On Wed, Jul 24, 2019 at 03:21:12PM +0800, Xin Long wrote:
> On Tue, Jul 23, 2019 at 11:25 PM Neil Horman wrote:
> >
> > On Tue, Jul 23, 2019 at 01:37:57AM +0800, Xin Long wrote:
> > > Now __sctp_connect() is called by __sctp_setsockopt_connectx() and
> > > sctp_in
On Tue, Jul 23, 2019 at 01:37:57AM +0800, Xin Long wrote:
> Now __sctp_connect() is called by __sctp_setsockopt_connectx() and
> sctp_inet_connect(), the latter has done addr_size check with size
> of sa_family_t.
>
> In the next patch to clean up __sctp_connect(), we will remove
> addr_size check
On Tue, Jul 23, 2019 at 05:16:25PM +0300, Ido Schimmel wrote:
> On Tue, Jul 23, 2019 at 08:43:40AM -0400, Neil Horman wrote:
> > On Mon, Jul 22, 2019 at 09:31:32PM +0300, Ido Schimmel wrote:
> > > +static void net_dm_packet_work(struct work_struct *work)
> > > +{
>
On Mon, Jul 22, 2019 at 09:31:32PM +0300, Ido Schimmel wrote:
> From: Ido Schimmel
>
> So far drop monitor supported only one alert mode in which a summary of
> locations in which packets were recently dropped was sent to user space.
>
> This alert mode is sufficient in order to understand that
On Tue, Jul 16, 2019 at 11:47:40PM +0200, Marek Majkowski wrote:
> Morning,
>
> My poor man's fuzzer found something interesting in SCTP. It seems
> like creating large number of SCTP sockets + some magic dance, upsets
> a memory subsystem related to SCTP. The sequence:
>
> - create SCTP socket
On Fri, Jul 12, 2019 at 04:52:30PM +0300, Ido Schimmel wrote:
> On Thu, Jul 11, 2019 at 07:53:54PM -0400, Neil Horman wrote:
> > A few things here:
> > IIRC we don't announce individual hardware drops, drivers record them in
> > internal structures, and they are retri
On Fri, Jul 12, 2019 at 02:33:29PM +0200, Toke Høiland-Jørgensen wrote:
> Neil Horman writes:
>
> > On Fri, Jul 12, 2019 at 11:27:55AM +0200, Toke Høiland-Jørgensen wrote:
> >> Neil Horman writes:
> >>
> >> > On Thu, Jul 11, 2019 at 03:39:09PM +0300,
On Fri, Jul 12, 2019 at 11:27:55AM +0200, Toke Høiland-Jørgensen wrote:
> Neil Horman writes:
>
> > On Thu, Jul 11, 2019 at 03:39:09PM +0300, Ido Schimmel wrote:
> >> On Sun, Jul 07, 2019 at 12:45:41PM -0700, David Miller wrote:
> >> > From: Ido Schimmel
>
On Thu, Jul 11, 2019 at 08:40:34PM -0700, Florian Fainelli wrote:
>
>
> On 7/11/2019 4:53 PM, Neil Horman wrote:
> >> I would like to emphasize that the configuration of whether these
> >> dropped packets are even sent to the CPU from the device still needs to
> &
On Thu, Jul 11, 2019 at 03:39:09PM +0300, Ido Schimmel wrote:
> On Sun, Jul 07, 2019 at 12:45:41PM -0700, David Miller wrote:
> > From: Ido Schimmel
> > Date: Sun, 7 Jul 2019 10:58:17 +0300
> >
> > > Users have several ways to debug the kernel and understand why a packet
> > > was dropped. For e
(sock_net(asoc->base.sk),
> +SCTP_MIB_OUTCTRLCHUNKS);
> + asoc->stats.octrlchunks++;
> asoc->peer.sack_needed = 0;
> if (del_timer(timer))
> sctp_association_put(asoc);
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Fri, Jun 28, 2019 at 11:15:09AM -0400, Willem de Bruijn wrote:
> On Fri, Jun 28, 2019 at 10:53 AM Neil Horman wrote:
> >
> > The AF_PACKET protocol, when running as a memory mapped socket uses a
> > pending frame counter to track the number of skbs in flight during
>
the
run time of packet_read_pending, as we only need to read a single
variable, instead of having to loop over every available cpu variable
instance.
Tested by myself by running a small program which sends frames via
AF_PACKET on multiple cpus in parallel, with good results.
Signed-off-by: Neil
ret = sctp_sched_init_sid(stream, sid, GFP_KERNEL);
> + if (ret) {
> + kfree(SCTP_SO(stream, sid)->ext);
> + SCTP_SO(stream, sid)->ext = NULL;
> + }
> +
> + return ret;
> }
>
> void sctp_stream_free(struct sctp_stream *stream)
> --
> 2.21.0
>
>
Acked-by: Neil Horman
On Wed, Jun 26, 2019 at 11:05:39AM -0400, Willem de Bruijn wrote:
> On Wed, Jun 26, 2019 at 6:54 AM Neil Horman wrote:
> >
> > On Tue, Jun 25, 2019 at 06:30:08PM -0400, Willem de Bruijn wrote:
> > > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
On Tue, Jun 25, 2019 at 06:30:08PM -0400, Willem de Bruijn wrote:
> > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> > index a29d66da7394..a7ca6a003ebe 100644
> > --- a/net/packet/af_packet.c
> > +++ b/net/packet/af_packet.c
> > @@ -2401,6 +2401,9 @@ static void tpacket_destruct_skb
.
Tested by myself and the reporter, with good results
Appies to the net tree
Signed-off-by: Neil Horman
Reported-by: Matteo Croce
CC: "David S. Miller"
CC: Willem de Bruijn
Change Notes:
V1->V2:
Enhance the sleep logic to support being interruptible and
allowing fo
On Tue, Jun 25, 2019 at 09:37:17AM -0400, Willem de Bruijn wrote:
> On Tue, Jun 25, 2019 at 7:03 AM Neil Horman wrote:
> >
> > On Mon, Jun 24, 2019 at 06:15:29PM -0400, Willem de Bruijn wrote:
> > > > > > + if (need_wait && !packet
rsctp_enable;
> ep->reconf_enable = net->sctp.reconf_enable;
>
> + /* Remember who we are attached to. */
> + ep->base.sk = sk;
> + sock_hold(ep->base.sk);
> +
> return ep;
>
> nomem_shkey:
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Mon, Jun 24, 2019 at 06:15:29PM -0400, Willem de Bruijn wrote:
> > > > + if (need_wait && !packet_next_frame(po, &po->tx_ring,
> > > > TP_STATUS_SEND_REQUEST)) {
> > > > + po->wait_on_complete = 1;
> > > > + timeo = sock_sndtimeo(&po->sk
On Mon, Jun 24, 2019 at 02:08:43PM -0400, Willem de Bruijn wrote:
> On Sun, Jun 23, 2019 at 8:46 PM Neil Horman wrote:
> >
> > When an application is run that:
> > a) Sets its scheduler to be SCHED_FIFO
> > and
> > b) Opens a memory mapped AF_PACKET
.
Tested by myself and the reporter, with good results
Appies to the net tree
Signed-off-by: Neil Horman
Reported-by: Matteo Croce
CC: "David S. Miller"
CC: Willem de Bruijn
Change Notes:
V1->V2:
Enhance the sleep logic to support being interruptible and
allowing fo
On Sun, Jun 23, 2019 at 10:39:12AM -0400, Willem de Bruijn wrote:
> On Sun, Jun 23, 2019 at 7:40 AM Neil Horman wrote:
> >
> > On Sat, Jun 22, 2019 at 10:21:31PM -0400, Willem de Bruijn wrote:
> > > > > -static void __packet_set_status(struct packet_sock *po, void
On Sat, Jun 22, 2019 at 10:21:31PM -0400, Willem de Bruijn wrote:
> > > -static void __packet_set_status(struct packet_sock *po, void *frame, int
> > > status)
> > > +static void __packet_set_status(struct packet_sock *po, void *frame, int
> > > status,
> > > + bool
On Sat, Jun 22, 2019 at 10:12:46PM -0400, Willem de Bruijn wrote:
> On Sat, Jun 22, 2019 at 1:42 PM Neil Horman wrote:
> >
> > When an application is run that:
> > a) Sets its scheduler to be SCHED_FIFO
> > and
> > b) Opens a memory mapped AF_PACKET
.
Tested by myself and the reporter, with good results
Appies to the net tree
Signed-off-by: Neil Horman
Reported-by: Matteo Croce
CC: "David S. Miller"
CC: Willem de Bruijn
Change Notes:
V1->V2:
Enhance the sleep logic to support being interruptible and
allowing fo
On Fri, Jun 21, 2019 at 04:06:09PM -0400, Willem de Bruijn wrote:
> On Fri, Jun 21, 2019 at 3:18 PM Neil Horman wrote:
> >
> > On Fri, Jun 21, 2019 at 02:31:17PM -0400, Willem de Bruijn wrote:
> > > On Fri, Jun 21, 2019 at 12:42 PM Neil Horman
> > > wrote:
>
On Fri, Jun 21, 2019 at 02:31:17PM -0400, Willem de Bruijn wrote:
> On Fri, Jun 21, 2019 at 12:42 PM Neil Horman wrote:
> >
> > On Thu, Jun 20, 2019 at 11:16:13AM -0400, Willem de Bruijn wrote:
> > > On Thu, Jun 20, 2019 at 10:24 AM Neil Horman
> > > wrote:
>
On Thu, Jun 20, 2019 at 11:16:13AM -0400, Willem de Bruijn wrote:
> On Thu, Jun 20, 2019 at 10:24 AM Neil Horman wrote:
> >
> > On Thu, Jun 20, 2019 at 09:41:30AM -0400, Willem de Bruijn wrote:
> > > On Wed, Jun 19, 2019 at 4:26 PM Neil Horman wrote:
> > > >
On Thu, Jun 20, 2019 at 12:18:41PM -0400, Willem de Bruijn wrote:
> On Thu, Jun 20, 2019 at 12:14 PM Neil Horman wrote:
> >
> > On Thu, Jun 20, 2019 at 11:16:13AM -0400, Willem de Bruijn wrote:
> > > On Thu, Jun 20, 2019 at 10:24 AM Neil Horman
> > > wrote:
>
On Thu, Jun 20, 2019 at 11:16:13AM -0400, Willem de Bruijn wrote:
> On Thu, Jun 20, 2019 at 10:24 AM Neil Horman wrote:
> >
> > On Thu, Jun 20, 2019 at 09:41:30AM -0400, Willem de Bruijn wrote:
> > > On Wed, Jun 19, 2019 at 4:26 PM Neil Horman wrote:
> > > >
On Thu, Jun 20, 2019 at 09:41:30AM -0400, Willem de Bruijn wrote:
> On Wed, Jun 19, 2019 at 4:26 PM Neil Horman wrote:
> >
> > When an application is run that:
> > a) Sets its scheduler to be SCHED_FIFO
> > and
> > b) Opens a memory mapped AF_PACKET
.
Tested by myself and the reporter, with good results
Appies to the net tree
Signed-off-by: Neil Horman
Reported-by: Matteo Croce
CC: "David S. Miller"
---
net/packet/af_packet.c | 42 +++---
net/packet/internal.h | 2 ++
2 files changed, 33
es
v1->v2
update subsystem tag in subject (davem)
repeat kfree check for peer_random and peer_hmacs (xin)
v2->v3
net->sctp
also free peer_chunks
v3->v4
fix subject tags
v4->v5
remove cut line
Signed-off-by: Neil Horman
Reported-by: syzbot+f7e9153b037eac9b1...@syzkaller.appspot
On Wed, Jun 12, 2019 at 03:07:15PM -0300, Marcelo Ricardo Leitner wrote:
> On Tue, Jun 11, 2019 at 08:38:14PM -0400, Neil Horman wrote:
> > Based on comments from Xin, even after fixes for our recent syzbot
> > report of cookie memory leaks, its possible to get a resend of an INIT
notes
v1->v2
update subsystem tag in subject (davem)
repeat kfree check for peer_random and peer_hmacs (xin)
v2->v3
net->sctp
also free peer_chunks
v3->v4
fix subject tags
Signed-off-by: Neil Horman
Reported-by: syzbot+f7e9153b037eac9b1...@syzkaller.appspotmail.com
CC: Marcelo Ricardo
On Tue, Jun 11, 2019 at 01:08:56PM -0700, David Miller wrote:
> From: Neil Horman
> Date: Tue, 11 Jun 2019 15:22:45 -0400
>
> > v2->v3
> > net->sctp
> > also free peer_chunks
>
> Neil this isn't the first time you're submitting sctp patches ri
notes
v1->v2
update subsystem tag in subject (davem)
repeat kfree check for peer_random and peer_hmacs (xin)
v2->v3
net->sctp
also free peer_chunks
Signed-off-by: Neil Horman
Reported-by: syzbot+f7e9153b037eac9b1...@syzkaller.appspotmail.com
CC: Marcelo Ricardo Leitner
CC: Xin Long
notes
v1->v2
update subsystem tag in subject (davem)
repeat kfree check for peer_random and peer_hmacs (xin)
Signed-off-by: Neil Horman
CC: Marcelo Ricardo Leitner
CC: Xin Long
CC: "David S. Miller"
CC: netdev@vger.kernel.org
---
net/sctp/sm_make_chunk.c | 6 ++
1 file cha
ff-by: Neil Horman
CC: Marcelo Ricardo Leitner
CC: Xin Long
CC: "David S. Miller"
CC: netdev@vger.kernel.org
---
net/sctp/sm_make_chunk.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f17908f5c4f3..21f7faf032e5 100644
On Thu, Jun 06, 2019 at 12:47:55PM -0300, Marcelo Ricardo Leitner wrote:
> On Wed, Jun 05, 2019 at 07:20:10AM -0400, Neil Horman wrote:
> > On Wed, Jun 05, 2019 at 04:16:24AM +0800, Xin Long wrote:
> > > On Tue, Jun 4, 2019 at 4:34 AM Neil Horman wrote:
> > > >
>
On Wed, Jun 05, 2019 at 04:16:24AM +0800, Xin Long wrote:
> On Tue, Jun 4, 2019 at 4:34 AM Neil Horman wrote:
> >
> > syzbot found the following leak in sctp_process_init
> > BUG: memory leak
> > unreferenced object 0x88810ef68400 (size 1024):
> > comm &qu
ough this function, at which point it is
overwritten with a heap allocated value, but in certain cases, where a
COOKIE_ECHO chunk is included in the packet, a second pass through
sctp_process_init is made, where the cookie value is re-allocated,
leaking the first allocation.
Fix is to always allocate the co
On Mon, Jun 03, 2019 at 11:31:13AM -0300, Marcelo Ricardo Leitner wrote:
> On Mon, Jun 03, 2019 at 10:21:12AM -0400, Neil Horman wrote:
> > syzbot found the following leak in sctp_process_init
> > BUG: memory leak
> > unreferenced object 0x88810ef68400 (size 1024):
> &
ough this function, at which point it is
overwritten with a heap allocated value, but in certain cases, where a
COOKIE_ECHO chunk is included in the packet, a second pass through
sctp_process_init is made, where the cookie value is re-allocated,
leaking the first allocation.
Fix is to always allocate the co
On Sun, May 12, 2019 at 01:52:48PM +0800, Xin Long wrote:
> On Fri, May 10, 2019 at 7:27 PM Neil Horman wrote:
> >
> > On Thu, May 09, 2019 at 09:39:13AM -0700, David Miller wrote:
> > > From: Neil Horman
> > > Date: Thu, 9 May 2019 07:32:35 -0400
> > >
On Thu, May 09, 2019 at 09:39:13AM -0700, David Miller wrote:
> From: Neil Horman
> Date: Thu, 9 May 2019 07:32:35 -0400
>
> > This is definately a valid cleanup, but I wonder if it wouldn't be better
> > to,
> > instead of removing it, to use it. We ha
On Thu, May 09, 2019 at 02:28:00PM +0800, Xin Long wrote:
> SCTP_CMD_GEN_INIT_ACK was introduced since very beginning, but never
> got used. So remove it.
>
> Signed-off-by: Xin Long
> ---
> include/net/sctp/command.h | 1 -
> net/sctp/sm_sideeffect.c | 11 ---
> 2 files changed, 12 d
sconf() in the 1st
> sctp_do_sm() directly.
>
> Reported-by: Ying Xu
> Signed-off-by: Xin Long
> ---
> include/net/sctp/command.h | 1 -
> net/sctp/sm_sideeffect.c | 29 -
> net/sctp/sm_statefuns.c| 35 +++
> 3 files changed, 27 insertions(+), 38 deletions(-)
>
Acked-by: Neil Horman
On Fri, Apr 12, 2019 at 08:21:26PM +0900, Tetsuo Handa wrote:
> On 2019/04/12 20:12, Neil Horman wrote:
> > On Fri, Apr 12, 2019 at 07:53:10PM +0900, Tetsuo Handa wrote:
> >> KMSAN will complain if valid address length passed to connect() is shorter
> >> than sizeof(&
On Fri, Apr 12, 2019 at 07:53:10PM +0900, Tetsuo Handa wrote:
> KMSAN will complain if valid address length passed to connect() is shorter
> than sizeof("struct sockaddr"->sa_family) bytes.
>
> Signed-off-by: Tetsuo Handa
> ---
> net/sctp/socket.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 de
ass a non-empty skb list around instead of an
> event skb object which may or may not be on a list.
>
> I'd like to thank Marcelo Leitner, Xin Long, and Neil Horman for
> reviewing previous versions of this series.
>
> Testing would be very much appreciated, in addition to th
On Tue, Apr 02, 2019 at 12:36:10AM -0300, Marcelo Ricardo Leitner wrote:
> On Mon, Apr 01, 2019 at 07:31:10AM -0400, Neil Horman wrote:
> > On Sun, Mar 31, 2019 at 04:53:45PM +0800, Xin Long wrote:
> > > sctp memory accounting is added in this patchset by using
> > > the
*sp, union sctp_addr *addr)
> {
> /* No address mapping for V4 sockets */
> + memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
> return sizeof(struct sockaddr_in);
> }
>
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Sun, Mar 31, 2019 at 04:53:45PM +0800, Xin Long wrote:
> sctp memory accounting is added in this patchset by using
> these kernel APIs on send side:
>
> - sk_mem_charge()
> - sk_mem_uncharge()
> - sk_wmem_schedule()
> - sk_under_memory_pressure()
> - sk_mem_reclaim()
>
> and these on
vmemdup_user(addrs, addrs_size);
> + kaddrs = memdup_user(addrs, addrs_size);
> if (unlikely(IS_ERR(kaddrs)))
> return PTR_ERR(kaddrs);
>
> @@ -1349,7 +1349,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
> err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id);
>
> out_free:
> - kvfree(kaddrs);
> + kfree(kaddrs);
>
> return err;
> }
> --
> 2.1.0
>
>
Acked-by: Neil Horman
n new pd_lobby.
>* 3) Peeling off non-partial delivery; move pd_lobby to receive_queue.
>*/
> - skb_queue_head_init(&newsp->pd_lobby);
> atomic_set(&sctp_sk(newsk)->pd_mode, assoc->ulpq.pd_mode);
>
> if (atomic_read(&sctp_sk(oldsk)->pd_mode)) {
> --
> 2.1.0
>
>
Acked-by: Neil Horman
struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
> const struct skb_checksum_ops ops = {
> .update = sctp_csum_update,
> .combine = sctp_csum_combine,
> --
> 2.1.0
>
>
Acked-by: Neil Horman
ich may or may not be on a list.
>
> I'd like to thank Marcelo Leitner, Xin Long, and Neil Horman for
> reviewing previous versions of this series.
>
> Testing would be very much appreciated, in addition to the review of
> course.
>
> v3 --> v4:
/net/sctp/stream.c
> @@ -230,8 +230,6 @@ int sctp_stream_init(struct sctp_stream *stream, __u16
> outcnt, __u16 incnt,
> for (i = 0; i < stream->outcnt; i++)
> SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
>
> - sched->init(stream);
> -
> in:
> sctp_stream_interleave_init(stream);
> if (!incnt)
> --
> 2.1.0
>
>
Acked-by: Neil Horman
p/auth.c| 6 --
> net/sctp/endpointola.c | 18 ++
> net/sctp/socket.c | 44 ++--
> 3 files changed, 44 insertions(+), 24 deletions(-)
>
> --
> 2.1.0
>
>
Series
Acked-by: Neil Horman
On Thu, Mar 07, 2019 at 06:06:21PM +0800, Xin Long wrote:
> On Thu, Mar 7, 2019 at 2:21 AM Neil Horman wrote:
> >
> > On Sun, Mar 03, 2019 at 05:54:53PM +0800, Xin Long wrote:
> > > It should fail to create the new sk if sctp_bind_addr_dup() fails
> > > when ac
err = sctp_auth_init_hmacs(newsp->ep, GFP_KERNEL);
> + if (err)
> + return err;
> + }
> +
> /* Move any messages in the old socket's receive queue that are for the
>* peeled off association to the new socket's receive queue.
>*/
> --
> 2.1.0
>
>
Acked-by: Neil Horman
uct
> sctp_endpoint *ep,
>
> return ep;
>
> -nomem_hmacs:
> - sctp_auth_destroy_keys(&ep->endpoint_shared_keys);
> +nomem_shkey:
> + sctp_auth_destroy_hmacs(ep->auth_hmacs);
> nomem:
> /* Free all allocations */
> kfree(auth_hmacs);
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Sun, Mar 03, 2019 at 05:54:53PM +0800, Xin Long wrote:
> It should fail to create the new sk if sctp_bind_addr_dup() fails
> when accepting or peeloff an association.
>
> Signed-off-by: Xin Long
> ---
> net/sctp/socket.c | 34 --
> 1 file changed, 24 insertions
On Wed, Mar 06, 2019 at 06:43:48PM +0800, Xin Long wrote:
> On Wed, Mar 6, 2019 at 9:42 AM syzbot
> wrote:
> >
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit:63bdf4284c38 Merge branch 'linus' of git://git.kernel.org/..
> > git tree: upstream
> > console outpu
>
> pr_debug("%s: aborting association:%p\n", __func__, asoc);
> sctp_primitive_ABORT(net, asoc, chunk);
> + iov_iter_revert(&msg->msg_iter, msg_len);
>
> return 0;
> }
> --
> 2.1.0
>
>
Acked-by: Neil Horman
On Wed, Feb 27, 2019 at 11:19:58PM -0300, Marcelo Ricardo Leitner wrote:
> On Wed, Feb 27, 2019 at 05:00:24PM -0800, David Miller wrote:
> >
> > Pass this, instead of an event. Then everything trickles down and we
> > always have events a non-empty list.
> >
> > Then we needs a list creating stu
On Wed, Feb 27, 2019 at 08:53:26PM +0800, Xin Long wrote:
> On Tue, Feb 26, 2019 at 8:29 PM Neil Horman wrote:
> >
> > On Tue, Feb 26, 2019 at 12:15:54AM +0800, Xin Long wrote:
> > > On Mon, Feb 25, 2019 at 10:08 PM Neil Horman
> > > wrote:
> > > &g
On Tue, Feb 26, 2019 at 12:15:54AM +0800, Xin Long wrote:
> On Mon, Feb 25, 2019 at 10:08 PM Neil Horman wrote:
> >
> > On Mon, Feb 25, 2019 at 09:20:44PM +0800, Xin Long wrote:
> > > On Mon, Feb 25, 2019 at 8:47 PM Neil Horman wrote:
> > > >
> > > &g
On Mon, Feb 25, 2019 at 09:20:44PM +0800, Xin Long wrote:
> On Mon, Feb 25, 2019 at 8:47 PM Neil Horman wrote:
> >
> > On Mon, Feb 25, 2019 at 07:25:37PM +0800, Xin Long wrote:
> > > sctp_hdr(skb) only works when skb->transport_header is set properly.
>
On Mon, Feb 25, 2019 at 07:25:37PM +0800, Xin Long wrote:
> sctp_hdr(skb) only works when skb->transport_header is set properly.
>
> But in the path of nf_conntrack_in: sctp_packet() -> sctp_error()
>
> skb->transport_header is not guaranteed to be right value for sctp.
> It will cause to fail to
*stream,
> }
> }
>
> - for (i = outcnt; i < stream->outcnt; i++)
> + for (i = outcnt; i < stream->outcnt; i++) {
> kfree(SCTP_SO(stream, i)->ext);
> + SCTP_SO(stream, i)->ext = NULL;
> + }
> }
>
> static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
> --
> 2.1.0
>
>
Acked-by: Neil Horman
1 - 100 of 594 matches
Mail list logo
