linux-stable.git/net/sctp/input.c, branch v3.5

sctp: Fix list corruption resulting from freeing an association on a list

2012-07-17T05:32:26+00:00

A few days ago Dave Jones reported this oops:

[22766.294255] general protection fault: 0000 [#1] PREEMPT SMP
[22766.295376] CPU 0
[22766.295384] Modules linked in:
[22766.387137]  ffffffffa169f292 6b6b6b6b6b6b6b6b ffff880147c03a90
ffff880147c03a74
[22766.387135] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000
[22766.387136] Process trinity-watchdo (pid: 10896, threadinfo ffff88013e7d2000,
[22766.387137] Stack:
[22766.387140]  ffff880147c03a10
[22766.387140]  ffffffffa169f2b6
[22766.387140]  ffff88013ed95728
[22766.387143]  0000000000000002
[22766.387143]  0000000000000000
[22766.387143]  ffff880003fad062
[22766.387144]  ffff88013c120000
[22766.387144]
[22766.387145] Call Trace:
[22766.387145]  
[22766.387150]  [] ? __sctp_lookup_association+0x62/0xd0
[sctp]
[22766.387154]  [] __sctp_lookup_association+0x86/0xd0 [sctp]
[22766.387157]  [] sctp_rcv+0x207/0xbb0 [sctp]
[22766.387161]  [] ? trace_hardirqs_off_caller+0x28/0xd0
[22766.387163]  [] ? nf_hook_slow+0x133/0x210
[22766.387166]  [] ? ip_local_deliver_finish+0x4c/0x4c0
[22766.387168]  [] ip_local_deliver_finish+0x18d/0x4c0
[22766.387169]  [] ? ip_local_deliver_finish+0x4c/0x4c0
[22766.387171]  [] ip_local_deliver+0x47/0x80
[22766.387172]  [] ip_rcv_finish+0x150/0x680
[22766.387174]  [] ip_rcv+0x214/0x320
[22766.387176]  [] __netif_receive_skb+0x7b7/0x910
[22766.387178]  [] ? __netif_receive_skb+0x11c/0x910
[22766.387180]  [] ? put_lock_stats.isra.25+0xe/0x40
[22766.387182]  [] netif_receive_skb+0x23/0x1f0
[22766.387183]  [] ? dev_gro_receive+0x139/0x440
[22766.387185]  [] napi_skb_finish+0x70/0xa0
[22766.387187]  [] napi_gro_receive+0xf5/0x130
[22766.387218]  [] e1000_receive_skb+0x59/0x70 [e1000e]
[22766.387242]  [] e1000_clean_rx_irq+0x28b/0x460 [e1000e]
[22766.387266]  [] e1000e_poll+0x78/0x430 [e1000e]
[22766.387268]  [] net_rx_action+0x1aa/0x3d0
[22766.387270]  [] ? account_system_vtime+0x10f/0x130
[22766.387273]  [] __do_softirq+0xe0/0x420
[22766.387275]  [] call_softirq+0x1c/0x30
[22766.387278]  [] do_softirq+0xd5/0x110
[22766.387279]  [] irq_exit+0xd5/0xe0
[22766.387281]  [] do_IRQ+0x63/0xd0
[22766.387283]  [] common_interrupt+0x6f/0x6f
[22766.387283]  
[22766.387284]
[22766.387285]  [] ? retint_swapgs+0x13/0x1b
[22766.387285] Code: c0 90 5d c3 66 0f 1f 44 00 00 4c 89 c8 5d c3 0f 1f 00 55 48
89 e5 48 83
ec 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 <0f> b7 87 98 00 00 00
48 89 fb
49 89 f5 66 c1 c0 08 66 39 46 02
[22766.387307]
[22766.387307] RIP
[22766.387311]  [] sctp_assoc_is_match+0x19/0x90 [sctp]
[22766.387311]  RSP 
[22766.387142]  ffffffffa16ab120
[22766.599537] ---[ end trace 3f6dae82e37b17f5 ]---
[22766.601221] Kernel panic - not syncing: Fatal exception in interrupt

It appears from his analysis and some staring at the code that this is likely
occuring because an association is getting freed while still on the
sctp_assoc_hashtable.  As a result, we get a gpf when traversing the hashtable
while a freed node corrupts part of the list.

Nominally I would think that an mibalanced refcount was responsible for this,
but I can't seem to find any obvious imbalance.  What I did note however was
that the two places where we create an association using
sctp_primitive_ASSOCIATE (__sctp_connect and sctp_sendmsg), have failure paths
which free a newly created association after calling sctp_primitive_ASSOCIATE.
sctp_primitive_ASSOCIATE brings us into the sctp_sf_do_prm_asoc path, which
issues a SCTP_CMD_NEW_ASOC side effect, which in turn adds a new association to
the aforementioned hash table.  the sctp command interpreter that process side
effects has not way to unwind previously processed commands, so freeing the
association from the __sctp_connect or sctp_sendmsg error path would lead to a
freed association remaining on this hash table.

I've fixed this but modifying sctp_[un]hash_established to use hlist_del_init,
which allows us to proerly use hlist_unhashed to check if the node is on a
hashlist safely during a delete.  That in turn alows us to safely call
sctp_unhash_established in the __sctp_connect and sctp_sendmsg error paths
before freeing them, regardles of what the associations state is on the hash
list.

I noted, while I was doing this, that the __sctp_unhash_endpoint was using
hlist_unhsashed in a simmilar fashion, but never nullified any removed nodes
pointers to make that function work properly, so I fixed that up in a simmilar
fashion.

I attempted to test this using a virtual guest running the SCTP_RR test from
netperf in a loop while running the trinity fuzzer, both in a loop.  I wasn't
able to recreate the problem prior to this fix, nor was I able to trigger the
failure after (neither of which I suppose is suprising).  Given the trace above
however, I think its likely that this is what we hit.

Signed-off-by: Neil Horman 
Reported-by: davej@redhat.com
CC: davej@redhat.com
CC: "David S. Miller" 
CC: Vlad Yasevich 
CC: Sridhar Samudrala 
CC: linux-sctp@vger.kernel.org
Signed-off-by: David S. Miller

net: add a limit parameter to sk_add_backlog()

2012-04-24T02:28:28+00:00

sk_add_backlog() & sk_rcvqueues_full() hard coded sk_rcvbuf as the
memory limit. We need to make this limit a parameter for TCP use.

No functional change expected in this patch, all callers still using the
old sk_rcvbuf limit.

Signed-off-by: Eric Dumazet 
Cc: Neal Cardwell 
Cc: Tom Herbert 
Cc: Maciej Żenczykowski 
Cc: Yuchung Cheng 
Cc: Ilpo Järvinen 
Cc: Rick Jones 
Signed-off-by: David S. Miller

net: use IS_ENABLED(CONFIG_IPV6)

2011-12-11T23:25:16+00:00

Instead of testing defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Remove casts of void *

2011-06-17T03:19:27+00:00

Unnecessary casts of void * clutter the code.

These are the remainder casts after several specific
patches to remove netdev_priv and dev_priv.

Done via coccinelle script:

$ cat cast_void_pointer.cocci
@@
type T;
T *pt;
void *pv;
@@

- pt = (T *)pv;
+ pt = pv;

Signed-off-by: Joe Perches 
Acked-by: Paul Moore 
Signed-off-by: David S. Miller

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

sctp: handle ootb packet in chunk order as defined

2011-04-20T08:51:04+00:00

Changed the order of processing SHUTDOWN ACK and COOKIE ACK
refer to section 8.4:Handle "Out of the Blue" Packets.

SHUTDOWN ACK chunk should be processed before processing
"Stale Cookie" ERROR or a COOKIE ACK.

Signed-off-by: Wei Yongjun 
Signed-off-by: Shan Wei 
Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

sctp: use common head of addr parameter to access member in addr-unrelated code

2011-04-20T04:45:19+00:00

The 'p' member of struct sctp_paramhdr is common part for
IPv4 addr parameter and IPv6 addr parameter in union sctp_addr_param.

For addr-related code, use specified addr parameter.
Otherwise, use common header to access type/length member.

Signed-off-by: Shan Wei 
Signed-off-by: Vlad Yasevich 
Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

sctp: several declared/set but unused fixes

2011-03-07T23:51:14+00:00

Signed-off-by: Hagen Paul Pfeifer 
Signed-off-by: David S. Miller

sctp: Fix a race between ICMP protocol unreachable and connect()

2010-05-06T07:56:07+00:00

ICMP protocol unreachable handling completely disregarded
the fact that the user may have locked the socket.  It proceeded
to destroy the association, even though the user may have
held the lock and had a ref on the association.  This resulted
in the following:

Attempt to release alive inet socket f6afcc00

=========================
[ BUG: held lock freed! ]
-------------------------
somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held
there!
 (sk_lock-AF_INET){+.+.+.}, at: [] sctp_connect+0x13/0x4c
1 lock held by somenu/2672:
 #0:  (sk_lock-AF_INET){+.+.+.}, at: [] sctp_connect+0x13/0x4c

stack backtrace:
Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55
Call Trace:
 [] ? printk+0xf/0x11
 [] debug_check_no_locks_freed+0xce/0xff
 [] kmem_cache_free+0x21/0x66
 [] __sk_free+0x9d/0xab
 [] sk_free+0x1c/0x1e
 [] sctp_association_put+0x32/0x89
 [] __sctp_connect+0x36d/0x3f4
 [] ? sctp_connect+0x13/0x4c
 [] ? autoremove_wake_function+0x0/0x33
 [] sctp_connect+0x31/0x4c
 [] inet_dgram_connect+0x4b/0x55
 [] sys_connect+0x54/0x71
 [] ? lock_release_non_nested+0x88/0x239
 [] ? might_fault+0x42/0x7c
 [] ? might_fault+0x42/0x7c
 [] sys_socketcall+0x6d/0x178
 [] ? trace_hardirqs_on_thunk+0xc/0x10
 [] syscall_call+0x7/0xb

This was because the sctp_wait_for_connect() would aqcure the socket
lock and then proceed to release the last reference count on the
association, thus cause the fully destruction path to finish freeing
the socket.

The simplest solution is to start a very short timer in case the socket
is owned by user.  When the timer expires, we can do some verification
and be able to do the release properly.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller