2019-05-23 09:14:41 +00:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
2008-01-11 14:57:09 +00:00
|
|
|
/* SCTP kernel implementation
|
2005-04-16 22:20:36 +00:00
|
|
|
* (C) Copyright IBM Corp. 2001, 2004
|
|
|
|
* Copyright (c) 1999-2000 Cisco, Inc.
|
|
|
|
* Copyright (c) 1999-2001 Motorola, Inc.
|
|
|
|
* Copyright (c) 2001-2003 Intel Corp.
|
|
|
|
*
|
2008-01-11 14:57:09 +00:00
|
|
|
* This file is part of the SCTP kernel implementation
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* The base lksctp header.
|
|
|
|
*
|
|
|
|
* Please send any bug reports or fixes you make to the
|
|
|
|
* email address(es):
|
2013-07-23 12:51:47 +00:00
|
|
|
* lksctp developers <linux-sctp@vger.kernel.org>
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* Written or modified by:
|
|
|
|
* La Monte H.P. Yarroll <piggy@acm.org>
|
|
|
|
* Xingang Guo <xingang.guo@intel.com>
|
|
|
|
* Jon Grimm <jgrimm@us.ibm.com>
|
|
|
|
* Daisy Chang <daisyc@us.ibm.com>
|
|
|
|
* Sridhar Samudrala <sri@us.ibm.com>
|
|
|
|
* Ardelle Fan <ardelle.fan@intel.com>
|
|
|
|
* Ryan Layer <rmlayer@us.ibm.com>
|
|
|
|
* Kevin Gao <kevin.gao@intel.com>
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __net_sctp_h__
|
|
|
|
#define __net_sctp_h__
|
|
|
|
|
|
|
|
/* Header Strategy.
|
|
|
|
* Start getting some control over the header file depencies:
|
|
|
|
* includes
|
|
|
|
* constants
|
|
|
|
* structs
|
|
|
|
* prototypes
|
|
|
|
* macros, externs, and inlines
|
|
|
|
*
|
|
|
|
* Move test_frame specific items out of the kernel headers
|
|
|
|
* and into the test frame headers. This is not perfect in any sense
|
|
|
|
* and will continue to evolve.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/in.h>
|
|
|
|
#include <linux/tty.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/jiffies.h>
|
|
|
|
#include <linux/idr.h>
|
|
|
|
|
2011-12-10 09:48:31 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <net/ipv6.h>
|
|
|
|
#include <net/ip6_route.h>
|
|
|
|
#endif
|
|
|
|
|
2016-12-24 19:46:01 +00:00
|
|
|
#include <linux/uaccess.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <asm/page.h>
|
|
|
|
#include <net/sock.h>
|
|
|
|
#include <net/snmp.h>
|
|
|
|
#include <net/sctp/structs.h>
|
|
|
|
#include <net/sctp/constants.h>
|
|
|
|
|
|
|
|
#ifdef CONFIG_IP_SCTP_MODULE
|
|
|
|
#define SCTP_PROTOSW_FLAG 0
|
|
|
|
#else /* static! */
|
|
|
|
#define SCTP_PROTOSW_FLAG INET_PROTOSW_PERMANENT
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Function declarations.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* sctp/protocol.c
|
|
|
|
*/
|
2017-08-05 11:59:54 +00:00
|
|
|
int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *addr,
|
|
|
|
enum sctp_scope, gfp_t gfp, int flags);
|
2013-09-23 18:37:59 +00:00
|
|
|
struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
|
|
|
|
int sctp_register_pf(struct sctp_pf *, sa_family_t);
|
|
|
|
void sctp_addr_wq_mgmt(struct net *, struct sctp_sockaddr_entry *, int);
|
2020-10-29 07:04:58 +00:00
|
|
|
int sctp_udp_sock_start(struct net *net);
|
|
|
|
void sctp_udp_sock_stop(struct net *net);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* sctp/socket.c
|
|
|
|
*/
|
sctp: fix the issue that flags are ignored when using kernel_connect
Now sctp uses inet_dgram_connect as its proto_ops .connect, and the flags
param can't be passed into its proto .connect where this flags is really
needed.
sctp works around it by getting flags from socket file in __sctp_connect.
It works for connecting from userspace, as inherently the user sock has
socket file and it passes f_flags as the flags param into the proto_ops
.connect.
However, the sock created by sock_create_kern doesn't have a socket file,
and it passes the flags (like O_NONBLOCK) by using the flags param in
kernel_connect, which calls proto_ops .connect later.
So to fix it, this patch defines a new proto_ops .connect for sctp,
sctp_inet_connect, which calls __sctp_connect() directly with this
flags param. After this, the sctp's proto .connect can be removed.
Note that sctp_inet_connect doesn't need to do some checks that are not
needed for sctp, which makes thing better than with inet_dgram_connect.
Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-20 08:39:10 +00:00
|
|
|
int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr,
|
|
|
|
int addr_len, int flags);
|
2005-04-16 22:20:36 +00:00
|
|
|
int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
|
|
|
|
int sctp_inet_listen(struct socket *sock, int backlog);
|
|
|
|
void sctp_write_space(struct sock *sk);
|
2014-04-11 20:15:36 +00:00
|
|
|
void sctp_data_ready(struct sock *sk);
|
2018-06-28 16:43:44 +00:00
|
|
|
__poll_t sctp_poll(struct file *file, struct socket *sock,
|
|
|
|
poll_table *wait);
|
2006-10-10 04:34:04 +00:00
|
|
|
void sctp_sock_rfree(struct sk_buff *skb);
|
2009-02-13 08:33:44 +00:00
|
|
|
void sctp_copy_sock(struct sock *newsk, struct sock *sk,
|
|
|
|
struct sctp_association *asoc);
|
2008-11-26 05:16:35 +00:00
|
|
|
extern struct percpu_counter sctp_sockets_allocated;
|
2013-09-23 18:37:59 +00:00
|
|
|
int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *);
|
net: remove noblock parameter from recvmsg() entities
The internal recvmsg() functions have two parameters 'flags' and 'noblock'
that were merged inside skb_recv_datagram(). As a follow up patch to commit
f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()")
this patch removes the separate 'noblock' parameter for recvmsg().
Analogue to the referenced patch for skb_recv_datagram() the 'flags' and
'noblock' parameters are unnecessarily split up with e.g.
err = sk->sk_prot->recvmsg(sk, msg, size, flags & MSG_DONTWAIT,
flags & ~MSG_DONTWAIT, &addr_len);
or in
err = INDIRECT_CALL_2(sk->sk_prot->recvmsg, tcp_recvmsg, udp_recvmsg,
sk, msg, size, flags & MSG_DONTWAIT,
flags & ~MSG_DONTWAIT, &addr_len);
instead of simply using only flags all the time and check for MSG_DONTWAIT
where needed (to preserve for the formerly separated no(n)block condition).
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20220411124955.154876-1-socketcan@hartkopp.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-04-11 12:49:55 +00:00
|
|
|
struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int *);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
sctp: use call_rcu to free endpoint
This patch is to delay the endpoint free by calling call_rcu() to fix
another use-after-free issue in sctp_sock_dump():
BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20
Call Trace:
__lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:334 [inline]
__lock_sock+0x203/0x350 net/core/sock.c:2253
lock_sock_nested+0xfe/0x120 net/core/sock.c:2774
lock_sock include/net/sock.h:1492 [inline]
sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324
sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091
sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527
__inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049
inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065
netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244
__netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352
netlink_dump_start include/linux/netlink.h:216 [inline]
inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170
__sock_diag_cmd net/core/sock_diag.c:232 [inline]
sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263
netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274
This issue occurs when asoc is peeled off and the old sk is freed after
getting it by asoc->base.sk and before calling lock_sock(sk).
To prevent the sk free, as a holder of the sk, ep should be alive when
calling lock_sock(). This patch uses call_rcu() and moves sock_put and
ep free into sctp_endpoint_destroy_rcu(), so that it's safe to try to
hold the ep under rcu_read_lock in sctp_transport_traverse_process().
If sctp_endpoint_hold() returns true, it means this ep is still alive
and we have held it and can continue to dump it; If it returns false,
it means this ep is dead and can be freed after rcu_read_unlock, and
we should skip it.
In sctp_sock_dump(), after locking the sk, if this ep is different from
tsp->asoc->ep, it means during this dumping, this asoc was peeled off
before calling lock_sock(), and the sk should be skipped; If this ep is
the same with tsp->asoc->ep, it means no peeloff happens on this asoc,
and due to lock_sock, no peeloff will happen either until release_sock.
Note that delaying endpoint free won't delay the port release, as the
port release happens in sctp_endpoint_destroy() before calling call_rcu().
Also, freeing endpoint by call_rcu() makes it safe to access the sk by
asoc->base.sk in sctp_assocs_seq_show() and sctp_rcv().
Thanks Jones to bring this issue up.
v1->v2:
- improve the changelog.
- add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed.
Reported-by: syzbot+9276d76e83e3bcde6c99@syzkaller.appspotmail.com
Reported-by: Lee Jones <lee.jones@linaro.org>
Fixes: d25adbeb0cdb ("sctp: fix an use-after-free issue in sctp_sock_dump")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-23 18:04:30 +00:00
|
|
|
typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *);
|
2017-12-04 18:31:41 +00:00
|
|
|
void sctp_transport_walk_start(struct rhashtable_iter *iter);
|
2016-04-14 07:35:31 +00:00
|
|
|
void sctp_transport_walk_stop(struct rhashtable_iter *iter);
|
|
|
|
struct sctp_transport *sctp_transport_get_next(struct net *net,
|
|
|
|
struct rhashtable_iter *iter);
|
|
|
|
struct sctp_transport *sctp_transport_get_idx(struct net *net,
|
|
|
|
struct rhashtable_iter *iter, int pos);
|
2021-12-31 23:37:37 +00:00
|
|
|
int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
|
2016-04-14 07:35:31 +00:00
|
|
|
const union sctp_addr *laddr,
|
2022-11-16 20:01:20 +00:00
|
|
|
const union sctp_addr *paddr, void *p, int dif);
|
sctp: use call_rcu to free endpoint
This patch is to delay the endpoint free by calling call_rcu() to fix
another use-after-free issue in sctp_sock_dump():
BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20
Call Trace:
__lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218
lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:334 [inline]
__lock_sock+0x203/0x350 net/core/sock.c:2253
lock_sock_nested+0xfe/0x120 net/core/sock.c:2774
lock_sock include/net/sock.h:1492 [inline]
sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324
sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091
sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527
__inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049
inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065
netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244
__netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352
netlink_dump_start include/linux/netlink.h:216 [inline]
inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170
__sock_diag_cmd net/core/sock_diag.c:232 [inline]
sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263
netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274
This issue occurs when asoc is peeled off and the old sk is freed after
getting it by asoc->base.sk and before calling lock_sock(sk).
To prevent the sk free, as a holder of the sk, ep should be alive when
calling lock_sock(). This patch uses call_rcu() and moves sock_put and
ep free into sctp_endpoint_destroy_rcu(), so that it's safe to try to
hold the ep under rcu_read_lock in sctp_transport_traverse_process().
If sctp_endpoint_hold() returns true, it means this ep is still alive
and we have held it and can continue to dump it; If it returns false,
it means this ep is dead and can be freed after rcu_read_unlock, and
we should skip it.
In sctp_sock_dump(), after locking the sk, if this ep is different from
tsp->asoc->ep, it means during this dumping, this asoc was peeled off
before calling lock_sock(), and the sk should be skipped; If this ep is
the same with tsp->asoc->ep, it means no peeloff happens on this asoc,
and due to lock_sock, no peeloff will happen either until release_sock.
Note that delaying endpoint free won't delay the port release, as the
port release happens in sctp_endpoint_destroy() before calling call_rcu().
Also, freeing endpoint by call_rcu() makes it safe to access the sk by
asoc->base.sk in sctp_assocs_seq_show() and sctp_rcv().
Thanks Jones to bring this issue up.
v1->v2:
- improve the changelog.
- add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed.
Reported-by: syzbot+9276d76e83e3bcde6c99@syzkaller.appspotmail.com
Reported-by: Lee Jones <lee.jones@linaro.org>
Fixes: d25adbeb0cdb ("sctp: fix an use-after-free issue in sctp_sock_dump")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-23 18:04:30 +00:00
|
|
|
int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
|
|
|
|
struct net *net, int *pos, void *p);
|
2016-04-14 07:35:31 +00:00
|
|
|
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p);
|
2016-04-14 07:35:30 +00:00
|
|
|
int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
|
|
|
|
struct sctp_info *info);
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* sctp/primitive.c
|
|
|
|
*/
|
2012-08-07 07:25:24 +00:00
|
|
|
int sctp_primitive_ASSOCIATE(struct net *, struct sctp_association *, void *arg);
|
|
|
|
int sctp_primitive_SHUTDOWN(struct net *, struct sctp_association *, void *arg);
|
|
|
|
int sctp_primitive_ABORT(struct net *, struct sctp_association *, void *arg);
|
|
|
|
int sctp_primitive_SEND(struct net *, struct sctp_association *, void *arg);
|
|
|
|
int sctp_primitive_REQUESTHEARTBEAT(struct net *, struct sctp_association *, void *arg);
|
|
|
|
int sctp_primitive_ASCONF(struct net *, struct sctp_association *, void *arg);
|
2017-01-17 16:44:44 +00:00
|
|
|
int sctp_primitive_RECONF(struct net *net, struct sctp_association *asoc,
|
|
|
|
void *arg);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* sctp/input.c
|
|
|
|
*/
|
|
|
|
int sctp_rcv(struct sk_buff *skb);
|
2018-11-08 11:19:21 +00:00
|
|
|
int sctp_v4_err(struct sk_buff *skb, u32 info);
|
2018-11-12 10:27:16 +00:00
|
|
|
int sctp_hash_endpoint(struct sctp_endpoint *ep);
|
2005-04-16 22:20:36 +00:00
|
|
|
void sctp_unhash_endpoint(struct sctp_endpoint *);
|
2012-08-06 08:41:13 +00:00
|
|
|
struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *,
|
2005-07-18 20:44:10 +00:00
|
|
|
struct sctphdr *, struct sctp_association **,
|
2005-04-16 22:20:36 +00:00
|
|
|
struct sctp_transport **);
|
sctp: hold transport instead of assoc when lookup assoc in rx path
Prior to this patch, in rx path, before calling lock_sock, it needed to
hold assoc when got it by __sctp_lookup_association, in case other place
would free/put assoc.
But in __sctp_lookup_association, it lookup and hold transport, then got
assoc by transport->assoc, then hold assoc and put transport. It means
it didn't hold transport, yet it was returned and later on directly
assigned to chunk->transport.
Without the protection of sock lock, the transport may be freed/put by
other places, which would cause a use-after-free issue.
This patch is to fix this issue by holding transport instead of assoc.
As holding transport can make sure to access assoc is also safe, and
actually it looks up assoc by searching transport rhashtable, to hold
transport here makes more sense.
Note that the function will be renamed later on on another patch.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-10-31 12:32:33 +00:00
|
|
|
void sctp_err_finish(struct sock *, struct sctp_transport *);
|
2021-06-22 18:05:00 +00:00
|
|
|
int sctp_udp_v4_err(struct sock *sk, struct sk_buff *skb);
|
|
|
|
int sctp_udp_v6_err(struct sock *sk, struct sk_buff *skb);
|
2005-04-16 22:20:36 +00:00
|
|
|
void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
|
|
|
|
struct sctp_transport *t, __u32 pmtu);
|
2012-07-12 07:25:15 +00:00
|
|
|
void sctp_icmp_redirect(struct sock *, struct sctp_transport *,
|
|
|
|
struct sk_buff *);
|
2005-04-16 22:20:36 +00:00
|
|
|
void sctp_icmp_proto_unreachable(struct sock *sk,
|
|
|
|
struct sctp_association *asoc,
|
|
|
|
struct sctp_transport *t);
|
2015-12-30 15:50:46 +00:00
|
|
|
int sctp_transport_hashtable_init(void);
|
|
|
|
void sctp_transport_hashtable_destroy(void);
|
2016-11-15 15:23:11 +00:00
|
|
|
int sctp_hash_transport(struct sctp_transport *t);
|
2015-12-30 15:50:46 +00:00
|
|
|
void sctp_unhash_transport(struct sctp_transport *t);
|
|
|
|
struct sctp_transport *sctp_addrs_lookup_transport(
|
|
|
|
struct net *net,
|
|
|
|
const union sctp_addr *laddr,
|
2022-11-16 20:01:20 +00:00
|
|
|
const union sctp_addr *paddr,
|
|
|
|
int dif, int sdif);
|
2015-12-30 15:50:46 +00:00
|
|
|
struct sctp_transport *sctp_epaddr_lookup_transport(
|
|
|
|
const struct sctp_endpoint *ep,
|
|
|
|
const union sctp_addr *paddr);
|
2022-11-16 20:01:20 +00:00
|
|
|
bool sctp_sk_bound_dev_eq(struct net *net, int bound_dev_if, int dif, int sdif);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2006-09-18 07:40:38 +00:00
|
|
|
/*
|
|
|
|
* sctp/proc.c
|
|
|
|
*/
|
2018-03-16 23:32:51 +00:00
|
|
|
int __net_init sctp_proc_init(struct net *net);
|
2006-09-18 07:40:38 +00:00
|
|
|
|
2016-06-02 18:05:43 +00:00
|
|
|
/*
|
|
|
|
* sctp/offload.c
|
|
|
|
*/
|
|
|
|
int sctp_offload_init(void);
|
2006-09-18 07:40:38 +00:00
|
|
|
|
2017-11-26 12:16:08 +00:00
|
|
|
/*
|
|
|
|
* sctp/stream_sched.c
|
|
|
|
*/
|
|
|
|
void sctp_sched_ops_init(void);
|
|
|
|
|
2017-01-17 16:44:47 +00:00
|
|
|
/*
|
|
|
|
* sctp/stream.c
|
|
|
|
*/
|
|
|
|
int sctp_send_reset_streams(struct sctp_association *asoc,
|
|
|
|
struct sctp_reset_streams *params);
|
2017-02-08 17:18:18 +00:00
|
|
|
int sctp_send_reset_assoc(struct sctp_association *asoc);
|
2017-02-08 17:18:20 +00:00
|
|
|
int sctp_send_add_streams(struct sctp_association *asoc,
|
|
|
|
struct sctp_add_streams *params);
|
2017-01-17 16:44:47 +00:00
|
|
|
|
2007-07-26 21:21:32 +00:00
|
|
|
/*
|
|
|
|
* Module global variables
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* sctp/protocol.c
|
|
|
|
*/
|
|
|
|
extern struct kmem_cache *sctp_chunk_cachep __read_mostly;
|
|
|
|
extern struct kmem_cache *sctp_bucket_cachep __read_mostly;
|
2015-03-25 06:13:01 +00:00
|
|
|
extern long sysctl_sctp_mem[3];
|
|
|
|
extern int sysctl_sctp_rmem[3];
|
|
|
|
extern int sysctl_sctp_wmem[3];
|
2007-07-26 21:21:32 +00:00
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* Section: Macros, externs, and inlines
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* SCTP SNMP MIB stats handlers */
|
2016-04-27 23:44:43 +00:00
|
|
|
#define SCTP_INC_STATS(net, field) SNMP_INC_STATS((net)->sctp.sctp_statistics, field)
|
|
|
|
#define __SCTP_INC_STATS(net, field) __SNMP_INC_STATS((net)->sctp.sctp_statistics, field)
|
|
|
|
#define SCTP_DEC_STATS(net, field) SNMP_DEC_STATS((net)->sctp.sctp_statistics, field)
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2006-08-22 07:15:33 +00:00
|
|
|
/* sctp mib definitions */
|
2009-11-03 03:26:03 +00:00
|
|
|
enum {
|
2006-08-22 07:15:33 +00:00
|
|
|
SCTP_MIB_NUM = 0,
|
|
|
|
SCTP_MIB_CURRESTAB, /* CurrEstab */
|
|
|
|
SCTP_MIB_ACTIVEESTABS, /* ActiveEstabs */
|
|
|
|
SCTP_MIB_PASSIVEESTABS, /* PassiveEstabs */
|
|
|
|
SCTP_MIB_ABORTEDS, /* Aborteds */
|
|
|
|
SCTP_MIB_SHUTDOWNS, /* Shutdowns */
|
|
|
|
SCTP_MIB_OUTOFBLUES, /* OutOfBlues */
|
|
|
|
SCTP_MIB_CHECKSUMERRORS, /* ChecksumErrors */
|
|
|
|
SCTP_MIB_OUTCTRLCHUNKS, /* OutCtrlChunks */
|
|
|
|
SCTP_MIB_OUTORDERCHUNKS, /* OutOrderChunks */
|
|
|
|
SCTP_MIB_OUTUNORDERCHUNKS, /* OutUnorderChunks */
|
|
|
|
SCTP_MIB_INCTRLCHUNKS, /* InCtrlChunks */
|
|
|
|
SCTP_MIB_INORDERCHUNKS, /* InOrderChunks */
|
|
|
|
SCTP_MIB_INUNORDERCHUNKS, /* InUnorderChunks */
|
|
|
|
SCTP_MIB_FRAGUSRMSGS, /* FragUsrMsgs */
|
|
|
|
SCTP_MIB_REASMUSRMSGS, /* ReasmUsrMsgs */
|
|
|
|
SCTP_MIB_OUTSCTPPACKS, /* OutSCTPPacks */
|
|
|
|
SCTP_MIB_INSCTPPACKS, /* InSCTPPacks */
|
|
|
|
SCTP_MIB_T1_INIT_EXPIREDS,
|
|
|
|
SCTP_MIB_T1_COOKIE_EXPIREDS,
|
|
|
|
SCTP_MIB_T2_SHUTDOWN_EXPIREDS,
|
|
|
|
SCTP_MIB_T3_RTX_EXPIREDS,
|
|
|
|
SCTP_MIB_T4_RTO_EXPIREDS,
|
|
|
|
SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS,
|
|
|
|
SCTP_MIB_DELAY_SACK_EXPIREDS,
|
|
|
|
SCTP_MIB_AUTOCLOSE_EXPIREDS,
|
2007-10-24 19:59:16 +00:00
|
|
|
SCTP_MIB_T1_RETRANSMITS,
|
2006-08-22 07:15:33 +00:00
|
|
|
SCTP_MIB_T3_RETRANSMITS,
|
|
|
|
SCTP_MIB_PMTUD_RETRANSMITS,
|
|
|
|
SCTP_MIB_FAST_RETRANSMITS,
|
|
|
|
SCTP_MIB_IN_PKT_SOFTIRQ,
|
|
|
|
SCTP_MIB_IN_PKT_BACKLOG,
|
|
|
|
SCTP_MIB_IN_PKT_DISCARDS,
|
|
|
|
SCTP_MIB_IN_DATA_CHUNK_DISCARDS,
|
|
|
|
__SCTP_MIB_MAX
|
|
|
|
};
|
|
|
|
|
|
|
|
#define SCTP_MIB_MAX __SCTP_MIB_MAX
|
|
|
|
struct sctp_mib {
|
|
|
|
unsigned long mibs[SCTP_MIB_MAX];
|
2010-03-18 20:36:06 +00:00
|
|
|
};
|
2006-08-22 07:15:33 +00:00
|
|
|
|
2012-12-01 04:49:42 +00:00
|
|
|
/* helper function to track stats about max rto and related transport */
|
|
|
|
static inline void sctp_max_rto(struct sctp_association *asoc,
|
|
|
|
struct sctp_transport *trans)
|
|
|
|
{
|
|
|
|
if (asoc->stats.max_obs_rto < (__u64)trans->rto) {
|
|
|
|
asoc->stats.max_obs_rto = trans->rto;
|
|
|
|
memset(&asoc->stats.obs_rto_ipaddr, 0,
|
|
|
|
sizeof(struct sockaddr_storage));
|
|
|
|
memcpy(&asoc->stats.obs_rto_ipaddr, &trans->ipaddr,
|
|
|
|
trans->af_specific->sockaddr_len);
|
|
|
|
}
|
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Macros for keeping a global reference of object allocations.
|
|
|
|
*/
|
|
|
|
#ifdef CONFIG_SCTP_DBG_OBJCNT
|
|
|
|
|
|
|
|
extern atomic_t sctp_dbg_objcnt_sock;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_ep;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_assoc;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_transport;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_chunk;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_bind_addr;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_bind_bucket;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_addr;
|
|
|
|
extern atomic_t sctp_dbg_objcnt_datamsg;
|
2007-10-09 08:15:59 +00:00
|
|
|
extern atomic_t sctp_dbg_objcnt_keys;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/* Macros to atomically increment/decrement objcnt counters. */
|
|
|
|
#define SCTP_DBG_OBJCNT_INC(name) \
|
|
|
|
atomic_inc(&sctp_dbg_objcnt_## name)
|
|
|
|
#define SCTP_DBG_OBJCNT_DEC(name) \
|
|
|
|
atomic_dec(&sctp_dbg_objcnt_## name)
|
|
|
|
#define SCTP_DBG_OBJCNT(name) \
|
|
|
|
atomic_t sctp_dbg_objcnt_## name = ATOMIC_INIT(0)
|
|
|
|
|
2020-07-15 16:42:45 +00:00
|
|
|
/* Macro to help create new entries in the global array of
|
2005-04-16 22:20:36 +00:00
|
|
|
* objcnt counters.
|
|
|
|
*/
|
|
|
|
#define SCTP_DBG_OBJCNT_ENTRY(name) \
|
|
|
|
{.label= #name, .counter= &sctp_dbg_objcnt_## name}
|
|
|
|
|
2012-08-06 08:45:15 +00:00
|
|
|
void sctp_dbg_objcnt_init(struct net *);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
#define SCTP_DBG_OBJCNT_INC(name)
|
|
|
|
#define SCTP_DBG_OBJCNT_DEC(name)
|
|
|
|
|
2012-08-15 10:18:11 +00:00
|
|
|
static inline void sctp_dbg_objcnt_init(struct net *net) { return; }
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#endif /* CONFIG_SCTP_DBG_OBJCOUNT */
|
|
|
|
|
|
|
|
#if defined CONFIG_SYSCTL
|
|
|
|
void sctp_sysctl_register(void);
|
|
|
|
void sctp_sysctl_unregister(void);
|
2012-08-07 07:23:59 +00:00
|
|
|
int sctp_sysctl_net_register(struct net *net);
|
|
|
|
void sctp_sysctl_net_unregister(struct net *net);
|
2005-04-16 22:20:36 +00:00
|
|
|
#else
|
|
|
|
static inline void sctp_sysctl_register(void) { return; }
|
|
|
|
static inline void sctp_sysctl_unregister(void) { return; }
|
2012-08-07 07:23:59 +00:00
|
|
|
static inline int sctp_sysctl_net_register(struct net *net) { return 0; }
|
|
|
|
static inline void sctp_sysctl_net_unregister(struct net *net) { return; }
|
2005-04-16 22:20:36 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* Size of Supported Address Parameter for 'x' address types. */
|
|
|
|
#define SCTP_SAT_LEN(x) (sizeof(struct sctp_paramhdr) + (x) * sizeof(__u16))
|
|
|
|
|
2011-12-10 09:48:31 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2008-03-20 22:17:14 +00:00
|
|
|
void sctp_v6_pf_init(void);
|
|
|
|
void sctp_v6_pf_exit(void);
|
|
|
|
int sctp_v6_protosw_init(void);
|
|
|
|
void sctp_v6_protosw_exit(void);
|
2007-05-04 20:36:30 +00:00
|
|
|
int sctp_v6_add_protocol(void);
|
|
|
|
void sctp_v6_del_protocol(void);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#else /* #ifdef defined(CONFIG_IPV6) */
|
|
|
|
|
2008-03-21 22:40:47 +00:00
|
|
|
static inline void sctp_v6_pf_init(void) { return; }
|
2008-03-20 22:17:14 +00:00
|
|
|
static inline void sctp_v6_pf_exit(void) { return; }
|
|
|
|
static inline int sctp_v6_protosw_init(void) { return 0; }
|
|
|
|
static inline void sctp_v6_protosw_exit(void) { return; }
|
2007-05-04 20:36:30 +00:00
|
|
|
static inline int sctp_v6_add_protocol(void) { return 0; }
|
|
|
|
static inline void sctp_v6_del_protocol(void) { return; }
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#endif /* #if defined(CONFIG_IPV6) */
|
|
|
|
|
|
|
|
|
|
|
|
/* Map an association to an assoc_id. */
|
|
|
|
static inline sctp_assoc_t sctp_assoc2id(const struct sctp_association *asoc)
|
|
|
|
{
|
2010-09-22 20:43:57 +00:00
|
|
|
return asoc ? asoc->assoc_id : 0;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
net: sctp: fix ABI mismatch through sctp_assoc_to_state helper
Since SCTP day 1, that is, 19b55a2af145 ("Initial commit") from lksctp
tree, the official <netinet/sctp.h> header carries a copy of enum
sctp_sstat_state that looks like (compared to the current in-kernel
enumeration):
User definition: Kernel definition:
enum sctp_sstat_state { typedef enum {
SCTP_EMPTY = 0, <removed>
SCTP_CLOSED = 1, SCTP_STATE_CLOSED = 0,
SCTP_COOKIE_WAIT = 2, SCTP_STATE_COOKIE_WAIT = 1,
SCTP_COOKIE_ECHOED = 3, SCTP_STATE_COOKIE_ECHOED = 2,
SCTP_ESTABLISHED = 4, SCTP_STATE_ESTABLISHED = 3,
SCTP_SHUTDOWN_PENDING = 5, SCTP_STATE_SHUTDOWN_PENDING = 4,
SCTP_SHUTDOWN_SENT = 6, SCTP_STATE_SHUTDOWN_SENT = 5,
SCTP_SHUTDOWN_RECEIVED = 7, SCTP_STATE_SHUTDOWN_RECEIVED = 6,
SCTP_SHUTDOWN_ACK_SENT = 8, SCTP_STATE_SHUTDOWN_ACK_SENT = 7,
}; } sctp_state_t;
This header was later on also placed into the uapi, so that user space
programs can compile without having <netinet/sctp.h>, but the shipped
with <linux/sctp.h> instead.
While RFC6458 under 8.2.1.Association Status (SCTP_STATUS) says that
sstat_state can range from SCTP_CLOSED to SCTP_SHUTDOWN_ACK_SENT, we
nevertheless have a what it appears to be dummy SCTP_EMPTY state from
the very early days.
While it seems to do just nothing, commit 0b8f9e25b0aa ("sctp: remove
completely unsed EMPTY state") did the right thing and removed this dead
code. That however, causes an off-by-one when the user asks the SCTP
stack via SCTP_STATUS API and checks for the current socket state thus
yielding possibly undefined behaviour in applications as they expect
the kernel to tell the right thing.
The enumeration had to be changed however as based on the current socket
state, we access a function pointer lookup-table through this. Therefore,
I think the best way to deal with this is just to add a helper function
sctp_assoc_to_state() to encapsulate the off-by-one quirk.
Reported-by: Tristan Su <sooqing@gmail.com>
Fixes: 0b8f9e25b0aa ("sctp: remove completely unsed EMPTY state")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-08-28 13:28:26 +00:00
|
|
|
static inline enum sctp_sstat_state
|
|
|
|
sctp_assoc_to_state(const struct sctp_association *asoc)
|
|
|
|
{
|
|
|
|
/* SCTP's uapi always had SCTP_EMPTY(=0) as a dummy state, but we
|
|
|
|
* got rid of it in kernel space. Therefore SCTP_CLOSED et al
|
|
|
|
* start at =1 in user space, but actually as =0 in kernel space.
|
|
|
|
* Now that we can not break user space and SCTP_EMPTY is exposed
|
|
|
|
* there, we need to fix it up with an ugly offset not to break
|
|
|
|
* applications. :(
|
|
|
|
*/
|
|
|
|
return asoc->state + 1;
|
|
|
|
}
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* Look up the association by its id. */
|
|
|
|
struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id);
|
|
|
|
|
2012-03-08 05:55:58 +00:00
|
|
|
int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/* A macro to walk a list of skbs. */
|
|
|
|
#define sctp_skb_for_each(pos, head, tmp) \
|
2008-09-23 05:14:36 +00:00
|
|
|
skb_queue_walk_safe(head, pos, tmp)
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* sctp_list_dequeue - remove from the head of the queue
|
|
|
|
* @list: list to dequeue from
|
|
|
|
*
|
|
|
|
* Remove the head of the list. The head item is
|
|
|
|
* returned or %NULL if the list is empty.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static inline struct list_head *sctp_list_dequeue(struct list_head *list)
|
|
|
|
{
|
|
|
|
struct list_head *result = NULL;
|
|
|
|
|
2016-04-01 17:30:32 +00:00
|
|
|
if (!list_empty(list)) {
|
2005-04-16 22:20:36 +00:00
|
|
|
result = list->next;
|
2016-04-01 17:30:32 +00:00
|
|
|
list_del_init(result);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
2006-10-10 04:34:04 +00:00
|
|
|
/* SCTP version of skb_set_owner_r. We need this one because
|
|
|
|
* of the way we have to do receive buffer accounting on bundled
|
|
|
|
* chunks.
|
|
|
|
*/
|
|
|
|
static inline void sctp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
|
|
|
|
{
|
|
|
|
struct sctp_ulpevent *event = sctp_skb2event(skb);
|
|
|
|
|
2009-06-22 02:25:25 +00:00
|
|
|
skb_orphan(skb);
|
2006-10-10 04:34:04 +00:00
|
|
|
skb->sk = sk;
|
|
|
|
skb->destructor = sctp_sock_rfree;
|
|
|
|
atomic_add(event->rmem_len, &sk->sk_rmem_alloc);
|
2007-08-15 23:07:44 +00:00
|
|
|
/*
|
2007-12-31 08:11:19 +00:00
|
|
|
* This mimics the behavior of skb_set_owner_r
|
2007-08-15 23:07:44 +00:00
|
|
|
*/
|
2019-04-15 09:15:07 +00:00
|
|
|
sk_mem_charge(sk, event->rmem_len);
|
2006-10-10 04:34:04 +00:00
|
|
|
}
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* Tests if the list has one and only one entry. */
|
|
|
|
static inline int sctp_list_single_entry(struct list_head *head)
|
|
|
|
{
|
2020-06-28 09:32:25 +00:00
|
|
|
return list_is_singular(head);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
net: sctp: fix panic on duplicate ASCONF chunks
When receiving a e.g. semi-good formed connection scan in the
form of ...
-------------- INIT[ASCONF; ASCONF_ACK] ------------->
<----------- INIT-ACK[ASCONF; ASCONF_ACK] ------------
-------------------- COOKIE-ECHO -------------------->
<-------------------- COOKIE-ACK ---------------------
---------------- ASCONF_a; ASCONF_b ----------------->
... where ASCONF_a equals ASCONF_b chunk (at least both serials
need to be equal), we panic an SCTP server!
The problem is that good-formed ASCONF chunks that we reply with
ASCONF_ACK chunks are cached per serial. Thus, when we receive a
same ASCONF chunk twice (e.g. through a lost ASCONF_ACK), we do
not need to process them again on the server side (that was the
idea, also proposed in the RFC). Instead, we know it was cached
and we just resend the cached chunk instead. So far, so good.
Where things get nasty is in SCTP's side effect interpreter, that
is, sctp_cmd_interpreter():
While incoming ASCONF_a (chunk = event_arg) is being marked
!end_of_packet and !singleton, and we have an association context,
we do not flush the outqueue the first time after processing the
ASCONF_ACK singleton chunk via SCTP_CMD_REPLY. Instead, we keep it
queued up, although we set local_cork to 1. Commit 2e3216cd54b1
changed the precedence, so that as long as we get bundled, incoming
chunks we try possible bundling on outgoing queue as well. Before
this commit, we would just flush the output queue.
Now, while ASCONF_a's ASCONF_ACK sits in the corked outq, we
continue to process the same ASCONF_b chunk from the packet. As
we have cached the previous ASCONF_ACK, we find it, grab it and
do another SCTP_CMD_REPLY command on it. So, effectively, we rip
the chunk->list pointers and requeue the same ASCONF_ACK chunk
another time. Since we process ASCONF_b, it's correctly marked
with end_of_packet and we enforce an uncork, and thus flush, thus
crashing the kernel.
Fix it by testing if the ASCONF_ACK is currently pending and if
that is the case, do not requeue it. When flushing the output
queue we may relink the chunk for preparing an outgoing packet,
but eventually unlink it when it's copied into the skb right
before transmission.
Joint work with Vlad Yasevich.
Fixes: 2e3216cd54b1 ("sctp: Follow security requirement of responding with 1 packet")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-09 20:55:32 +00:00
|
|
|
static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
|
|
|
|
{
|
|
|
|
return !list_empty(&chunk->list);
|
|
|
|
}
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* Walk through a list of TLV parameters. Don't trust the
|
|
|
|
* individual parameter lengths and instead depend on
|
|
|
|
* the chunk length to indicate when to stop. Make sure
|
|
|
|
* there is room for a param header too.
|
|
|
|
*/
|
2023-04-19 15:16:28 +00:00
|
|
|
#define sctp_walk_params(pos, chunk)\
|
|
|
|
_sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length))
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2023-04-19 15:16:28 +00:00
|
|
|
#define _sctp_walk_params(pos, chunk, end)\
|
|
|
|
for (pos.v = (u8 *)(chunk + 1);\
|
2017-07-26 08:24:59 +00:00
|
|
|
(pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
|
sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
If the length field of the iterator (|pos.p| or |err|) is past the end
of the chunk, we shouldn't access it.
This bug has been detected by KMSAN. For the following pair of system
calls:
socket(PF_INET6, SOCK_STREAM, 0x84 /* IPPROTO_??? */) = 3
sendto(3, "A", 1, MSG_OOB, {sa_family=AF_INET6, sin6_port=htons(0),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, 28) = 1
the tool has reported a use of uninitialized memory:
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_rcv+0x17b8/0x43b0
CPU: 1 PID: 2940 Comm: probe Not tainted 4.11.0-rc5+ #2926
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
__sctp_rcv_init_lookup net/sctp/input.c:1074
__sctp_rcv_lookup_harder net/sctp/input.c:1233
__sctp_rcv_lookup net/sctp/input.c:1255
sctp_rcv+0x17b8/0x43b0 net/sctp/input.c:170
sctp6_rcv+0x32/0x70 net/sctp/ipv6.c:984
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902
</IRQ>
do_softirq kernel/softirq.c:328
__local_bh_enable_ip+0x25b/0x290 kernel/softirq.c:181
local_bh_enable+0x37/0x40 ./include/linux/bottom_half.h:31
rcu_read_unlock_bh ./include/linux/rcupdate.h:931
ip6_finish_output2+0x19b2/0x1cf0 net/ipv6/ip6_output.c:124
ip6_finish_output+0x764/0x970 net/ipv6/ip6_output.c:149
NF_HOOK_COND ./include/linux/netfilter.h:246
ip6_output+0x456/0x520 net/ipv6/ip6_output.c:163
dst_output ./include/net/dst.h:486
NF_HOOK ./include/linux/netfilter.h:257
ip6_xmit+0x1841/0x1c00 net/ipv6/ip6_output.c:261
sctp_v6_xmit+0x3b7/0x470 net/sctp/ipv6.c:225
sctp_packet_transmit+0x38cb/0x3a20 net/sctp/output.c:632
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246
RIP: 0033:0x401133
RSP: 002b:00007fff6d99cd38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401133
RDX: 0000000000000001 RSI: 0000000000494088 RDI: 0000000000000003
RBP: 00007fff6d99cd90 R08: 00007fff6d99cd50 R09: 000000000000001c
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000004063d0 R14: 0000000000406460 R15: 0000000000000000
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:211
slab_alloc_node mm/slub.c:2743
__kmalloc_node_track_caller+0x200/0x360 mm/slub.c:4351
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x26b/0x840 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:933
sctp_packet_transmit+0x31e/0x3a20 net/sctp/output.c:570
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246
==================================================================
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-14 16:32:45 +00:00
|
|
|
(void *)chunk + end) &&\
|
2006-05-19 18:52:20 +00:00
|
|
|
pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
|
2017-06-30 03:52:16 +00:00
|
|
|
ntohs(pos.p->length) >= sizeof(struct sctp_paramhdr);\
|
2016-09-21 11:45:55 +00:00
|
|
|
pos.v += SCTP_PAD4(ntohs(pos.p->length)))
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#define sctp_walk_errors(err, chunk_hdr)\
|
|
|
|
_sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
|
|
|
|
|
|
|
|
#define _sctp_walk_errors(err, chunk_hdr, end)\
|
2017-08-03 07:42:11 +00:00
|
|
|
for (err = (struct sctp_errhdr *)((void *)chunk_hdr + \
|
2017-06-30 03:52:13 +00:00
|
|
|
sizeof(struct sctp_chunkhdr));\
|
2017-08-03 07:42:11 +00:00
|
|
|
((void *)err + offsetof(struct sctp_errhdr, length) + sizeof(err->length) <=\
|
sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
If the length field of the iterator (|pos.p| or |err|) is past the end
of the chunk, we shouldn't access it.
This bug has been detected by KMSAN. For the following pair of system
calls:
socket(PF_INET6, SOCK_STREAM, 0x84 /* IPPROTO_??? */) = 3
sendto(3, "A", 1, MSG_OOB, {sa_family=AF_INET6, sin6_port=htons(0),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, 28) = 1
the tool has reported a use of uninitialized memory:
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_rcv+0x17b8/0x43b0
CPU: 1 PID: 2940 Comm: probe Not tainted 4.11.0-rc5+ #2926
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
__sctp_rcv_init_lookup net/sctp/input.c:1074
__sctp_rcv_lookup_harder net/sctp/input.c:1233
__sctp_rcv_lookup net/sctp/input.c:1255
sctp_rcv+0x17b8/0x43b0 net/sctp/input.c:170
sctp6_rcv+0x32/0x70 net/sctp/ipv6.c:984
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902
</IRQ>
do_softirq kernel/softirq.c:328
__local_bh_enable_ip+0x25b/0x290 kernel/softirq.c:181
local_bh_enable+0x37/0x40 ./include/linux/bottom_half.h:31
rcu_read_unlock_bh ./include/linux/rcupdate.h:931
ip6_finish_output2+0x19b2/0x1cf0 net/ipv6/ip6_output.c:124
ip6_finish_output+0x764/0x970 net/ipv6/ip6_output.c:149
NF_HOOK_COND ./include/linux/netfilter.h:246
ip6_output+0x456/0x520 net/ipv6/ip6_output.c:163
dst_output ./include/net/dst.h:486
NF_HOOK ./include/linux/netfilter.h:257
ip6_xmit+0x1841/0x1c00 net/ipv6/ip6_output.c:261
sctp_v6_xmit+0x3b7/0x470 net/sctp/ipv6.c:225
sctp_packet_transmit+0x38cb/0x3a20 net/sctp/output.c:632
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246
RIP: 0033:0x401133
RSP: 002b:00007fff6d99cd38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401133
RDX: 0000000000000001 RSI: 0000000000494088 RDI: 0000000000000003
RBP: 00007fff6d99cd90 R08: 00007fff6d99cd50 R09: 000000000000001c
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000004063d0 R14: 0000000000406460 R15: 0000000000000000
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:211
slab_alloc_node mm/slub.c:2743
__kmalloc_node_track_caller+0x200/0x360 mm/slub.c:4351
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x26b/0x840 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:933
sctp_packet_transmit+0x31e/0x3a20 net/sctp/output.c:570
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246
==================================================================
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-14 16:32:45 +00:00
|
|
|
(void *)chunk_hdr + end) &&\
|
2006-05-19 18:52:20 +00:00
|
|
|
(void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
|
2017-08-03 07:42:11 +00:00
|
|
|
ntohs(err->length) >= sizeof(struct sctp_errhdr); \
|
|
|
|
err = (struct sctp_errhdr *)((void *)err + SCTP_PAD4(ntohs(err->length))))
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#define sctp_walk_fwdtsn(pos, chunk)\
|
|
|
|
_sctp_walk_fwdtsn((pos), (chunk), ntohs((chunk)->chunk_hdr->length) - sizeof(struct sctp_fwdtsn_chunk))
|
|
|
|
|
|
|
|
#define _sctp_walk_fwdtsn(pos, chunk, end)\
|
2023-04-19 15:16:29 +00:00
|
|
|
for (pos = (void *)(chunk->subh.fwdtsn_hdr + 1);\
|
|
|
|
(void *)pos <= (void *)(chunk->subh.fwdtsn_hdr + 1) + end - sizeof(struct sctp_fwdtsn_skip);\
|
2005-04-16 22:20:36 +00:00
|
|
|
pos++)
|
|
|
|
|
|
|
|
/* External references. */
|
|
|
|
|
|
|
|
extern struct proto sctp_prot;
|
|
|
|
extern struct proto sctpv6_prot;
|
|
|
|
void sctp_put_port(struct sock *sk);
|
|
|
|
|
|
|
|
extern struct idr sctp_assocs_id;
|
|
|
|
extern spinlock_t sctp_assocs_id_lock;
|
|
|
|
|
|
|
|
/* Static inline functions. */
|
|
|
|
|
|
|
|
/* Convert from an IP version number to an Address Family symbol. */
|
|
|
|
static inline int ipver2af(__u8 ipver)
|
|
|
|
{
|
|
|
|
switch (ipver) {
|
|
|
|
case 4:
|
|
|
|
return AF_INET;
|
|
|
|
case 6:
|
|
|
|
return AF_INET6;
|
|
|
|
default:
|
|
|
|
return 0;
|
2011-06-03 11:51:21 +00:00
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Convert from an address parameter type to an address family. */
|
2006-11-21 01:01:42 +00:00
|
|
|
static inline int param_type2af(__be16 type)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
switch (type) {
|
|
|
|
case SCTP_PARAM_IPV4_ADDRESS:
|
|
|
|
return AF_INET;
|
|
|
|
case SCTP_PARAM_IPV6_ADDRESS:
|
|
|
|
return AF_INET6;
|
|
|
|
default:
|
|
|
|
return 0;
|
2011-06-03 11:51:21 +00:00
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Warning: The following hash functions assume a power of two 'size'. */
|
|
|
|
/* This is the hash function for the SCTP port hash table. */
|
2012-08-06 08:39:38 +00:00
|
|
|
static inline int sctp_phashfn(struct net *net, __u16 lport)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2012-08-06 08:39:38 +00:00
|
|
|
return (net_hash_mix(net) + lport) & (sctp_port_hashsize - 1);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* This is the hash function for the endpoint hash table. */
|
2012-08-06 08:40:21 +00:00
|
|
|
static inline int sctp_ep_hashfn(struct net *net, __u16 lport)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2012-08-06 08:40:21 +00:00
|
|
|
return (net_hash_mix(net) + lport) & (sctp_ep_hashsize - 1);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2021-12-21 21:40:30 +00:00
|
|
|
#define sctp_for_each_hentry(ep, head) \
|
|
|
|
hlist_for_each_entry(ep, head, node)
|
2007-11-09 16:43:40 +00:00
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* Is a socket of this style? */
|
|
|
|
#define sctp_style(sk, style) __sctp_style((sk), (SCTP_SOCKET_##style))
|
2017-08-11 02:23:50 +00:00
|
|
|
static inline int __sctp_style(const struct sock *sk,
|
|
|
|
enum sctp_socket_type style)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
return sctp_sk(sk)->type == style;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Is the association in this state? */
|
|
|
|
#define sctp_state(asoc, state) __sctp_state((asoc), (SCTP_STATE_##state))
|
|
|
|
static inline int __sctp_state(const struct sctp_association *asoc,
|
2017-08-05 11:59:59 +00:00
|
|
|
enum sctp_state state)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
return asoc->state == state;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Is the socket in this state? */
|
|
|
|
#define sctp_sstate(sk, state) __sctp_sstate((sk), (SCTP_SS_##state))
|
2017-08-05 11:59:56 +00:00
|
|
|
static inline int __sctp_sstate(const struct sock *sk,
|
|
|
|
enum sctp_sock_state state)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
return sk->sk_state == state;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Map v4-mapped v6 address back to v4 address */
|
|
|
|
static inline void sctp_v6_map_v4(union sctp_addr *addr)
|
|
|
|
{
|
|
|
|
addr->v4.sin_family = AF_INET;
|
|
|
|
addr->v4.sin_port = addr->v6.sin6_port;
|
|
|
|
addr->v4.sin_addr.s_addr = addr->v6.sin6_addr.s6_addr32[3];
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Map v4 address to v4-mapped v6 address */
|
|
|
|
static inline void sctp_v4_map_v6(union sctp_addr *addr)
|
|
|
|
{
|
2015-05-26 23:30:17 +00:00
|
|
|
__be16 port;
|
|
|
|
|
|
|
|
port = addr->v4.sin_port;
|
|
|
|
addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
|
|
|
|
addr->v6.sin6_port = port;
|
2005-04-16 22:20:36 +00:00
|
|
|
addr->v6.sin6_family = AF_INET6;
|
2014-07-30 18:40:53 +00:00
|
|
|
addr->v6.sin6_flowinfo = 0;
|
|
|
|
addr->v6.sin6_scope_id = 0;
|
2005-04-16 22:20:36 +00:00
|
|
|
addr->v6.sin6_addr.s6_addr32[0] = 0;
|
|
|
|
addr->v6.sin6_addr.s6_addr32[1] = 0;
|
|
|
|
addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
|
|
|
|
}
|
|
|
|
|
2012-05-04 05:24:54 +00:00
|
|
|
/* The cookie is always 0 since this is how it's used in the
|
|
|
|
* pmtu code.
|
|
|
|
*/
|
|
|
|
static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
|
|
|
|
{
|
2017-04-01 09:15:59 +00:00
|
|
|
if (t->dst && !dst_check(t->dst, t->dst_cookie))
|
2017-02-06 21:14:13 +00:00
|
|
|
sctp_transport_dst_release(t);
|
2012-05-04 05:24:54 +00:00
|
|
|
|
|
|
|
return t->dst;
|
|
|
|
}
|
|
|
|
|
2018-04-26 19:58:54 +00:00
|
|
|
/* Calculate max payload size given a MTU, or the total overhead if
|
|
|
|
* given MTU is zero
|
|
|
|
*/
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
static inline __u32 __sctp_mtu_payload(const struct sctp_sock *sp,
|
|
|
|
const struct sctp_transport *t,
|
|
|
|
__u32 mtu, __u32 extra)
|
2017-04-01 09:15:59 +00:00
|
|
|
{
|
2018-04-26 19:58:54 +00:00
|
|
|
__u32 overhead = sizeof(struct sctphdr) + extra;
|
2017-04-01 09:15:59 +00:00
|
|
|
|
2020-10-29 07:05:04 +00:00
|
|
|
if (sp) {
|
2018-04-26 19:58:54 +00:00
|
|
|
overhead += sp->pf->af->net_header_len;
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
if (sp->udp_port && (!t || t->encap_port))
|
2020-10-29 07:05:04 +00:00
|
|
|
overhead += sizeof(struct udphdr);
|
|
|
|
} else {
|
2018-04-26 19:58:54 +00:00
|
|
|
overhead += sizeof(struct ipv6hdr);
|
2020-10-29 07:05:04 +00:00
|
|
|
}
|
2017-04-01 09:15:59 +00:00
|
|
|
|
2018-04-26 19:58:54 +00:00
|
|
|
if (WARN_ON_ONCE(mtu && mtu <= overhead))
|
|
|
|
mtu = overhead;
|
2017-04-01 09:15:59 +00:00
|
|
|
|
2018-04-26 19:58:54 +00:00
|
|
|
return mtu ? mtu - overhead : overhead;
|
|
|
|
}
|
|
|
|
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
static inline __u32 sctp_mtu_payload(const struct sctp_sock *sp,
|
|
|
|
__u32 mtu, __u32 extra)
|
|
|
|
{
|
|
|
|
return __sctp_mtu_payload(sp, NULL, mtu, extra);
|
|
|
|
}
|
|
|
|
|
2018-04-26 19:58:57 +00:00
|
|
|
static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
|
|
|
|
{
|
|
|
|
return SCTP_TRUNC4(max_t(__u32, dst_mtu(dst),
|
|
|
|
SCTP_DEFAULT_MINSEGMENT));
|
2017-04-01 09:15:59 +00:00
|
|
|
}
|
|
|
|
|
2018-11-18 08:14:47 +00:00
|
|
|
static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
|
|
|
|
{
|
|
|
|
__u32 pmtu = sctp_dst_mtu(t->dst);
|
|
|
|
|
|
|
|
if (t->pathmtu == pmtu)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
t->pathmtu = pmtu;
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2018-12-04 19:27:41 +00:00
|
|
|
static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
|
|
|
|
{
|
|
|
|
return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
|
|
|
|
}
|
|
|
|
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
static inline int sctp_transport_pl_hlen(struct sctp_transport *t)
|
|
|
|
{
|
2021-10-28 09:36:03 +00:00
|
|
|
return __sctp_mtu_payload(sctp_sk(t->asoc->base.sk), t, 0, 0) -
|
|
|
|
sizeof(struct sctphdr);
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void sctp_transport_pl_reset(struct sctp_transport *t)
|
|
|
|
{
|
|
|
|
if (t->probe_interval && (t->param_flags & SPP_PMTUD_ENABLE) &&
|
|
|
|
(t->state == SCTP_ACTIVE || t->state == SCTP_UNKNOWN)) {
|
|
|
|
if (t->pl.state == SCTP_PL_DISABLED) {
|
|
|
|
t->pl.state = SCTP_PL_BASE;
|
|
|
|
t->pl.pmtu = SCTP_BASE_PLPMTU;
|
|
|
|
t->pl.probe_size = SCTP_BASE_PLPMTU;
|
2021-06-22 18:04:51 +00:00
|
|
|
sctp_transport_reset_probe_timer(t);
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
}
|
|
|
|
} else {
|
2021-06-22 18:04:51 +00:00
|
|
|
if (t->pl.state != SCTP_PL_DISABLED) {
|
|
|
|
if (del_timer(&t->probe_timer))
|
|
|
|
sctp_transport_put(t);
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
t->pl.state = SCTP_PL_DISABLED;
|
2021-06-22 18:04:51 +00:00
|
|
|
}
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void sctp_transport_pl_update(struct sctp_transport *t)
|
|
|
|
{
|
|
|
|
if (t->pl.state == SCTP_PL_DISABLED)
|
|
|
|
return;
|
|
|
|
|
|
|
|
t->pl.state = SCTP_PL_BASE;
|
|
|
|
t->pl.pmtu = SCTP_BASE_PLPMTU;
|
|
|
|
t->pl.probe_size = SCTP_BASE_PLPMTU;
|
2021-10-28 09:36:02 +00:00
|
|
|
sctp_transport_reset_probe_timer(t);
|
sctp: add the constants/variables and states and some APIs for transport
These are 4 constants described in rfc8899#section-5.1.2:
MAX_PROBES, MIN_PLPMTU, MAX_PLPMTU, BASE_PLPMTU;
And 2 variables described in rfc8899#section-5.1.3:
PROBED_SIZE, PROBE_COUNT;
And 5 states described in rfc8899#section-5.2:
DISABLED, BASE, SEARCH, SEARCH_COMPLETE, ERROR;
And these 4 APIs are used to reset/update PLPMTUD, check if PLPMTUD is
enabled, and calculate the additional headers length for a transport.
Note the member 'probe_high' in transport will be set to the probe
size when a probe fails with this probe size in the next patches.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-22 18:04:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool sctp_transport_pl_enabled(struct sctp_transport *t)
|
|
|
|
{
|
|
|
|
return t->pl.state != SCTP_PL_DISABLED;
|
|
|
|
}
|
|
|
|
|
2019-10-08 11:09:23 +00:00
|
|
|
static inline bool sctp_newsk_ready(const struct sock *sk)
|
|
|
|
{
|
|
|
|
return sock_flag(sk, SOCK_DEAD) || sk->sk_socket;
|
|
|
|
}
|
|
|
|
|
2020-05-29 12:09:40 +00:00
|
|
|
static inline void sctp_sock_set_nodelay(struct sock *sk)
|
|
|
|
{
|
|
|
|
lock_sock(sk);
|
|
|
|
sctp_sk(sk)->nodelay = true;
|
|
|
|
release_sock(sk);
|
|
|
|
}
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
#endif /* __net_sctp_h__ */
|