linux-stable.git/net/sctp, branch v3.8

net, sctp: remove CONFIG_EXPERIMENTAL

2013-02-13T18:57:27+00:00

This config item has not carried much meaning for a while now and is
almost always enabled by default. As agreed during the Linux kernel
summit, remove it.

Acked-by: Vlad Yasevich 
Acked-by: Steven Whitehouse 
Signed-off-by: Kees Cook 
Signed-off-by: David Rientjes 
Signed-off-by: David S. Miller

net: sctp: sctp_v6_get_dst: fix boolean test in dst cache

2013-02-13T18:42:34+00:00

We walk through the bind address list and try to get the best source
address for a given destination. However, currently, we take the
'continue' path of the loop when an entry is invalid (!laddr->valid)
*and* the entry state does not equal SCTP_ADDR_SRC (laddr->state !=
SCTP_ADDR_SRC).

Thus, still, invalid entries with SCTP_ADDR_SRC might not 'continue'
as well as valid entries with SCTP_ADDR_{NEW, SRC, DEL}, with a possible
false baddr and matchlen as a result, causing in worst case dst route
to be false or possibly NULL.

This test should actually be a '||' instead of '&&'. But lets fix it
and make this a bit easier to read by having the condition the same way
as similarly done in sctp_v4_get_dst.

Signed-off-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

net: sctp: sctp_endpoint_free: zero out secret key data

2013-02-08T19:54:24+00:00

On sctp_endpoint_destroy, previously used sensitive keying material
should be zeroed out before the memory is returned, as we already do
with e.g. auth keys when released.

Signed-off-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree

2013-02-08T19:54:24+00:00

In sctp_setsockopt_auth_key, we create a temporary copy of the user
passed shared auth key for the endpoint or association and after
internal setup, we free it right away. Since it's sensitive data, we
should zero out the key before returning the memory back to the
allocator. Thus, use kzfree instead of kfree, just as we do in
sctp_auth_key_put().

Signed-off-by: Daniel Borkmann 
Signed-off-by: David S. Miller

net: sctp: sctp_auth_key_put: use kzfree instead of kfree

2013-02-08T04:43:42+00:00

For sensitive data like keying material, it is common practice to zero
out keys before returning the memory back to the allocator. Thus, use
kzfree instead of kfree.

Signed-off-by: Daniel Borkmann 
Acked-by: Neil Horman 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

SCTP: Free the per-net sysctl table on net exit. v2

2013-01-28T05:09:32+00:00

Per-net sysctl table needs to be explicitly freed at
net exit.  Otherwise we see the following with kmemleak:

unreferenced object 0xffff880402d08000 (size 2048):
  comm "chrome_sandbox", pid 18437, jiffies 4310887172 (age 9097.630s)
  hex dump (first 32 bytes):
    b2 68 89 81 ff ff ff ff 20 04 04 f8 01 88 ff ff  .h...... .......
    04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x21/0x3e
    [] slab_post_alloc_hook+0x28/0x2a
    [] __kmalloc_track_caller+0xf1/0x104
    [] kmemdup+0x1b/0x30
    [] sctp_sysctl_net_register+0x1f/0x72
    [] sctp_net_init+0x100/0x39f
    [] ops_init+0xc6/0xf5
    [] setup_net+0x4c/0xd0
    [] copy_net_ns+0x6d/0xd6
    [] create_new_namespaces+0xd7/0x147
    [] copy_namespaces+0x63/0x99
    [] copy_process+0xa65/0x1233
    [] do_fork+0x10b/0x271
    [] sys_clone+0x23/0x25
    [] stub_clone+0x13/0x20
    [] 0xffffffffffffffff

I fixed the spelling of sysctl_header so the code actually
compiles. -- EWB.

Reported-by: Martin Mokrejs 
Signed-off-by: Vlad Yasevich 
Acked-by: Neil Horman 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

sctp: set association state to established in dupcook_a handler

2013-01-28T00:32:23+00:00

While sctp handling a duplicate COOKIE-ECHO and the action is
'Association restart', sctp_sf_do_dupcook_a() will processing
the unexpected COOKIE-ECHO for peer restart, but it does not set
the association state to SCTP_STATE_ESTABLISHED, so the association
could stuck in SCTP_STATE_SHUTDOWN_PENDING state forever.
This violates the sctp specification:
  RFC 4960 5.2.4. Handle a COOKIE ECHO when a TCB Exists
  Action
  A) In this case, the peer may have restarted. .....
     After this, the endpoint shall enter the ESTABLISHED state.

To resolve this problem, adding a SCTP_CMD_NEW_STATE cmd to the
command list before SCTP_CMD_REPLY cmd, this will set the restart
association to SCTP_STATE_ESTABLISHED state properly and also avoid
I-bit being set in the DATA chunk header when COOKIE_ACK is bundled
with DATA chunks.

Signed-off-by: Xufeng Zhang 
Acked-by: Neil Horman 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

sctp: refactor sctp_outq_teardown to insure proper re-initalization

2013-01-17T23:39:56+00:00

Jamie Parsons reported a problem recently, in which the re-initalization of an
association (The duplicate init case), resulted in a loss of receive window
space.  He tracked down the root cause to sctp_outq_teardown, which discarded
all the data on an outq during a re-initalization of the corresponding
association, but never reset the outq->outstanding_data field to zero.  I wrote,
and he tested this fix, which does a proper full re-initalization of the outq,
fixing this problem, and hopefully future proofing us from simmilar issues down
the road.

Signed-off-by: Neil Horman 
Reported-by: Jamie Parsons 
Tested-by: Jamie Parsons 
CC: Jamie Parsons 
CC: Vlad Yasevich 
CC: "David S. Miller" 
CC: netdev@vger.kernel.org
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

sctp: fix Kconfig bug in default cookie hmac selection

2013-01-07T17:27:06+00:00

Commit 0d0863b02002 ("sctp: Change defaults on cookie hmac selection")
added a "choice" to the sctp Kconfig file.  It introduced a bug which
led to an infinite loop when while running "make oldconfig".

The problem is that the wrong symbol was defined as the default value
for the choice.  Using the correct value gets rid of the infinite loop.

Note:  if CONFIG_SCTP_COOKIE_HMAC_SHA1=y was present in the input
config file, both that and CONFIG_SCTP_COOKIE_HMAC_MD5=y be present
in the generated config file.

Signed-off-by: Alex Elder 
Signed-off-by: Linus Torvalds

sctp: jsctp_sf_eat_sack: fix jprobes function signature mismatch

2012-12-16T01:14:39+00:00

Commit 24cb81a6a (sctp: Push struct net down into all of the
state machine functions) introduced the net structure into all
state machine functions, but jsctp_sf_eat_sack was not updated,
hence when SCTP association probing is enabled in the kernel,
any simple SCTP client/server program from userspace will panic
the kernel.

Cc: Vlad Yasevich 
Signed-off-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller