netdev - Re: [PATCH] sctp: refactor sctp_outq_teardown to insure proper re-initalization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Jan 2013 17:48:20 -0500
From:	Vlad Yasevich <vyasevich@...il.com>
To:	Neil Horman <nhorman@...driver.com>
CC:	linux-sctp@...r.kernel.org,
	Jamie Parsons <Jamie.Parsons@...aswitch.com>,
	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] sctp: refactor sctp_outq_teardown to insure proper re-initalization

On 01/17/2013 04:15 PM, Neil Horman wrote:
> Jamie Parsons reported a problem recently, in which the re-initalization of an
> association (The duplicate init case), resulted in a loss of receive window
> space.  He tracked down the root cause to sctp_outq_teardown, which discarded
> all the data on an outq during a re-initalization of the corresponding
> association, but never reset the outq->outstanding_data field to zero.  I wrote,
> and he tested this fix, which does a proper full re-initalization of the outq,
> fixing this problem, and hopefully future proofing us from simmilar issues down
> the road.
>

Good find.

Acked-by: Vlad Yasevich <vyasevich@...il.com>

-vlad

> Signed-off-by: Neil Horman <nhorman@...driver.com>
> Reported-by: Jamie Parsons <Jamie.Parsons@...aswitch.com>
> Tested-by: Jamie Parsons <Jamie.Parsons@...aswitch.com>
> CC: Jamie Parsons <Jamie.Parsons@...aswitch.com>
> CC: Vlad Yasevich <vyasevich@...il.com>
> CC: "David S. Miller" <davem@...emloft.net>
> CC: netdev@...r.kernel.org
> ---
>   net/sctp/outqueue.c | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
> index 379c81d..9bcdbd0 100644
> --- a/net/sctp/outqueue.c
> +++ b/net/sctp/outqueue.c
> @@ -224,7 +224,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
>
>   /* Free the outqueue structure and any related pending chunks.
>    */
> -void sctp_outq_teardown(struct sctp_outq *q)
> +static void __sctp_outq_teardown(struct sctp_outq *q)
>   {
>   	struct sctp_transport *transport;
>   	struct list_head *lchunk, *temp;
> @@ -277,8 +277,6 @@ void sctp_outq_teardown(struct sctp_outq *q)
>   		sctp_chunk_free(chunk);
>   	}
>
> -	q->error = 0;
> -
>   	/* Throw away any leftover control chunks. */
>   	list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
>   		list_del_init(&chunk->list);
> @@ -286,11 +284,17 @@ void sctp_outq_teardown(struct sctp_outq *q)
>   	}
>   }
>
> +void sctp_outq_teardown(struct sctp_outq *q)
> +{
> +	__sctp_outq_teardown(q);
> +	sctp_outq_init(q->asoc, q);
> +}
> +
>   /* Free the outqueue structure and any related pending chunks.  */
>   void sctp_outq_free(struct sctp_outq *q)
>   {
>   	/* Throw away leftover chunks. */
> -	sctp_outq_teardown(q);
> +	__sctp_outq_teardown(q);
>
>   	/* If we were kmalloc()'d, free the memory.  */
>   	if (q->malloced)
>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html