Changes in input.c

8fa7292f - treewide: Switch/rename to timer_delete[_sync]()

Sat, 05 Apr 2025 08:17:26 +0000

treewide: Switch/rename to timer_delete[_sync]()timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole treeover and remove the historical wrapper inlines.Conversion was done with coccinelle plus manual fixups where necessary.Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar List of files: /linux-6.15/net/sctp/input.c

9ab0faa7 - sctp: Fix null-ptr-deref in reuseport_add_sock().

Wed, 31 Jul 2024 23:46:24 +0000

sctp: Fix null-ptr-deref in reuseport_add_sock().syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb inreuseport_add_sock(). [0]The repro first creates a listener with SO_REUSEPORT. Then, it createsanother listener on the same port and concurrently closes the firstlistener.The second listen() calls reuseport_add_sock() with the first listener assk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently,but the close() does clear it by reuseport_detach_sock().The problem is SCTP does not properly synchronise reuseport_alloc(),reuseport_add_sock(), and reuseport_detach_sock().The caller of reuseport_alloc() and reuseport_{add,detach}_sock() mustprovide synchronisation for sockets that are classified into the samereuseport group.Otherwise, such sockets form multiple identical reuseport groups, andall groups except one would be silently dead. 1. Two sockets call listen() concurrently 2. No socket in the same group found in sctp_ep_hashtable[] 3. Two sockets call reuseport_alloc() and form two reuseport groups 4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives incoming packetsAlso, the reported null-ptr-deref could occur.TCP/UDP guarantees that would not happen by holding the hash bucket lock.Let's apply the locking strategy to __sctp_hash_endpoint() and__sctp_unhash_endpoint().[0]:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]CPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024RIP: 0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350Code: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14RSP: 0018:ffffc9000b947c98 EFLAGS: 00010202RAX: 0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012RBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385R10: dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000FS: 00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: __sctp_hash_endpoint net/sctp/input.c:762 [inline] sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790 sctp_listen_start net/sctp/socket.c:8570 [inline] sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625 __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] __se_sys_listen net/socket.c:1900 [inline] __x64_sys_listen+0x5a/0x70 net/socket.c:1900 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7f24e46039b9Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032RAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9RDX: 00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004RBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0R10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42cR13: 00007f24e465a5dc R14: 0020000000000001 R15: 00007ffcced5f7d8 Modules linked in:Fixes: 6ba845740267 ("sctp: process sk_reuseport in sctp_get_port_local")Reported-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.comCloses: https://syzkaller.appspot.com/bug?extid=e6979a5d2f10ecb700e4Tested-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.comSigned-off-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20240731234624.94055-1-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/sctp/input.c

6b5f43ea - inet: move inet->recverr to inet->inet_flags

Wed, 16 Aug 2023 08:15:35 +0000

inet: move inet->recverr to inet->inet_flagsIP_RECVERR socket option can now be set/get without locking the socket.This patch potentially avoid data-races around inet->recverr.Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Reviewed-by: Simon Horman Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

add7370a - sctp: delete the nested flexible array params

Wed, 19 Apr 2023 15:16:28 +0000

sctp: delete the nested flexible array paramsThis patch deletes the flexible-array params[] from the structuresctp_inithdr, sctp_addiphdr and sctp_reconf_chunk to avoid somesparse warnings: # make C=2 CF="-Wflexible-array-nested" M=./net/sctp/ net/sctp/input.c: note: in included file (through include/net/sctp/structs.h, include/net/sctp/sctp.h): ./include/linux/sctp.h:278:29: warning: nested flexible array ./include/linux/sctp.h:675:30: warning: nested flexible arrayThis warning is reported if a structure having a flexible arraymember is included by other structures.Signed-off-by: Xin Long Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

2f2d9972 - net: annotate lockless accesses to sk->sk_err_soft

Wed, 15 Mar 2023 20:57:43 +0000

net: annotate lockless accesses to sk->sk_err_softThis field can be read/written without lock synchronization.tcp and dccp have been handled in different patches.Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

0af03170 - sctp: add dif and sdif check in asoc and ep lookup

Wed, 16 Nov 2022 20:01:20 +0000

sctp: add dif and sdif check in asoc and ep lookupThis patch at first adds a pernet global l3mdev_accept to decide if itaccepts the packets from a l3mdev when a SCTP socket doesn't bind toany interface. It's set to 1 to avoid any possible incompatible issue,and in next patch, a sysctl will be introduced to allow to change it.Then similar to inet/udp_sk_bound_dev_eq(), sctp_sk_bound_dev_eq() isadded to check either dif or sdif is equal to sk_bound_dev_if, and tocheck sid is 0 or l3mdev_accept is 1 if sk_bound_dev_if is not set.This function is used to match a association or a endpoint, namelycalled by sctp_addrs_lookup_transport() and sctp_endpoint_is_match().All functions that needs updating are:sctp_rcv(): asoc: __sctp_rcv_lookup() __sctp_lookup_association() -> sctp_addrs_lookup_transport() __sctp_rcv_lookup_harder() __sctp_rcv_init_lookup() __sctp_lookup_association() -> sctp_addrs_lookup_transport() __sctp_rcv_walk_lookup() __sctp_rcv_asconf_lookup() __sctp_lookup_association() -> sctp_addrs_lookup_transport() ep: __sctp_rcv_lookup_endpoint() -> sctp_endpoint_is_match()sctp_connect(): sctp_endpoint_is_peeled_off() __sctp_lookup_association() sctp_has_association() sctp_lookup_association() __sctp_lookup_association() -> sctp_addrs_lookup_transport()sctp_diag_dump_one(): sctp_transport_lookup_process() -> sctp_addrs_lookup_transport()Signed-off-by: Xin Long Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

a20ea298 - sctp: read sk->sk_bound_dev_if once in sctp_rcv()

Fri, 13 May 2022 18:55:42 +0000

sctp: read sk->sk_bound_dev_if once in sctp_rcv()sctp_rcv() reads sk->sk_bound_dev_if twice while the socketis not locked. Another cpu could change this field under us.Fixes: 0fd9a65a76e8 ("[SCTP] Support SO_BINDTODEVICE socket option on incoming packets.")Signed-off-by: Eric Dumazet Cc: Neil Horman Cc: Vlad Yasevich Cc: Marcelo Ricardo Leitner Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

3d3b2f57 - sctp: move hlist_node and hashent out of sctp_ep_common

Tue, 21 Dec 2021 21:40:30 +0000

sctp: move hlist_node and hashent out of sctp_ep_commonStruct sctp_ep_common is included in both asoc and ep, but hlist_nodeand hashent are only needed by ep after asoc_hashtable was dropped byCommit b5eff7128366 ("sctp: drop the old assoc hashtable of sctp").So it is better to move hlist_node and hashent from sctp_ep_common tosctp_endpoint, and it saves some space for each asoc.Signed-off-by: Xin Long Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

f7e745f8 - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb

Thu, 23 Sep 2021 04:05:04 +0000

sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootbWe should always check if skb_header_pointer's return is NULL beforeusing it, otherwise it may cause null-ptr-deref, as syzbot reported: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize")Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.comSigned-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

557fb586 - sctp: fix return value check in __sctp_rcv_asconf_lookup

Wed, 28 Jul 2021 02:40:54 +0000

sctp: fix return value check in __sctp_rcv_asconf_lookupAs Ben Hutchings noticed, this check should have been inverted: the callreturns true in case of success.Reported-by: Ben Hutchings Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return")Signed-off-by: Marcelo Ricardo Leitner Reviewed-by: Xin Long Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

e3ae2365 - net: sock: introduce sk_error_report

Sun, 27 Jun 2021 22:48:21 +0000

net: sock: introduce sk_error_reportThis patch introduces a function wrapper to call the sk_error_reportcallback. That will prepare to add additional handling wheneversk_error_report is called, for example to trace socket errors.Signed-off-by: Alexander Aring Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

b6ffe767 - sctp: validate chunk size in __rcv_asconf_lookup

Mon, 28 Jun 2021 19:13:43 +0000

sctp: validate chunk size in __rcv_asconf_lookupIn one of the fallbacks that SCTP has for identifying an association for anincoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.Thing is, at this stage nothing was validating that the chunk actually hadenough content for that, allowing the peek to happen over uninitializedmemory.Similar check already exists in actual asconf handling insctp_verify_asconf().Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

50619dbf - sctp: add size validation when walking chunks

Mon, 28 Jun 2021 19:13:42 +0000

sctp: add size validation when walking chunksThe first chunk in a packet is ensured to be present at the beginning ofsctp_rcv(), as a packet needs to have at least 1 chunk. But the secondone, may not be completely available and ch->length can be overuninitialized memory.Fix here is by only trying to walk on the next chunk if there is enough tohold at least the header, and then proceed with the ch->length validationthat is already there.Reported-by: Ilja Van Sprundel Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

0c5dc070 - sctp: validate from_addr_param return

Mon, 28 Jun 2021 19:13:41 +0000

sctp: validate from_addr_param returnIlja reported that, simply putting it, nothing was validating thatfrom_addr_param functions were operating on initialized memory. That is,the parameter itself was being validated by sctp_walk_params, but itdoesn't check for types and their specific sizes and it could be a 0-lengthone, causing from_addr_param to potentially work over the next parameter oreven uninitialized memory.The fix here is to, in all calls to from_addr_param, check if enough spaceis there for the wanted IP address type.Reported-by: Ilja Van Sprundel Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

9e47df00 - sctp: process sctp over udp icmp err on sctp side

Tue, 22 Jun 2021 18:05:00 +0000

sctp: process sctp over udp icmp err on sctp sidePreviously, sctp over udp was using udp tunnel's icmp err process, whichonly does sk lookup on sctp side. However for sctp's icmp error process,there are more things to do, like syncing assoc pmtu/retransmit packetsfor toobig type err, and starting proto_unreach_timer for unreach typeerr etc.Now after adding PLPMTUD, which also requires to process toobig type erron sctp side. This patch is to process icmp err on sctp side by parsingthe type/code/info in .encap_err_lookup and call sctp's icmp processingfunctions. Note as the 'redirect' err process needs to know the outerip(v6) header's, we have to leave it to udp(v6)_err to handle it.Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

d8306075 - sctp: extract sctp_v4_err_handle function from sctp_v4_err

Tue, 22 Jun 2021 18:04:59 +0000

sctp: extract sctp_v4_err_handle function from sctp_v4_errThis patch is to extract sctp_v4_err_handle() from sctp_v4_err() toonly handle the icmp err after the sock lookup, and it also makesthe code clearer.sctp_v4_err_handle() will be used in sctp over udp's err handlingin the following patch.Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

83696408 - sctp: do state transition when receiving an icmp TOOBIG packet

Tue, 22 Jun 2021 18:04:55 +0000

sctp: do state transition when receiving an icmp TOOBIG packetPLPMTUD will short-circuit the old process for icmp TOOBIG packets.This part is described in rfc8899#section-4.6.2 (PL_PTB_SIZE =PTB_SIZE - other_headers_len). Note that from rfc8899#section-5.2State Machine, each case below is for some specific states only: a) PL_PTB_SIZE < MIN_PLPMTU || PL_PTB_SIZE >= PROBED_SIZE, discard it, for any state b) MIN_PLPMTU < PL_PTB_SIZE < BASE_PLPMTU, Base -> Error, for Base state c) BASE_PLPMTU <= PL_PTB_SIZE < PLPMTU, Search -> Base or Complete -> Base, for Search and Complete states. d) PLPMTU < PL_PTB_SIZE < PROBED_SIZE, set pl.probe_size to PL_PTB_SIZE then verify it, for Search state.The most important one is case d), which will help find the optimalfast during searching. Like when pathmtu = 1392 for SCTP over IPv4,the search will be (20 is iphdr_len): 1. probe with 1200 - 20 2. probe with 1232 - 20 3. probe with 1264 - 20 ... 7. probe with 1388 - 20 8. probe with 1420 - 20When sending the probe with 1420 - 20, TOOBIG may come with PL_PTB_SIZE =1392 - 20. Then it matches case d), and saves some rounds to try with the1392 - 20 probe. But of course, PLPMTUD doesn't trust TOOBIG packets, andit will go back to the common searching once the probe with the new sizecan't be verified.Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c

0572b37b - sctp: Fix fall-through warnings for Clang

Fri, 20 Nov 2020 18:39:41 +0000

sctp: Fix fall-through warnings for ClangIn preparation to enable -Wimplicit-fallthrough for Clang, fix a coupleof warnings by explicitly adding a break statement and replacing acomment with a goto statement instead of letting the code fall throughto the next case.Link: https://github.com/KSPP/linux/issues/115Signed-off-by: Gustavo A. R. Silva List of files: /linux-6.15/net/sctp/input.c

057a10fa - sctp: change to hold/put transport for proto_unreach_timer

Sat, 14 Nov 2020 05:22:53 +0000

sctp: change to hold/put transport for proto_unreach_timerA call trace was found in Hangbin's Codenomicon testing with debug kernel: [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp] [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0 [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0 [ 2616.191533] Call Trace: [ 2616.194265] [ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0 [ 2616.207336] slab_free_freelist_hook+0xeb/0x140 [ 2616.220971] kfree+0xd6/0x2c0 [ 2616.224293] rcu_do_batch+0x3bd/0xc70 [ 2616.243096] rcu_core+0x8b9/0xd00 [ 2616.256065] __do_softirq+0x23d/0xacd [ 2616.260166] irq_exit+0x236/0x2a0 [ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620 [ 2616.269138] apic_timer_interrupt+0xf/0x20 [ 2616.273711] This is because it holds asoc when transport->proto_unreach_timer startsand puts asoc when the timer stops, and without holding transport thetransport could be freed when the timer is still running.So fix it by holding/putting transport instead for proto_unreach_timerin transport, just like other timers in transport.v1->v2: - Also use sctp_transport_put() for the "out_unlock:" path in sctp_generate_proto_unreach_event(), as Marcelo noticed.Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")Reported-by: Hangbin Liu Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/sctp/input.c

887cf3d1 - sctp: Add missing annotation for sctp_err_finish()

Sun, 23 Feb 2020 23:16:45 +0000

sctp: Add missing annotation for sctp_err_finish()Sparse reports a warning at sctp_err_finish()warning: context imbalance in sctp_err_finish() - unexpected unlockThe root cause is a missing annotation at sctp_err_finish()Add the missing __releases(&((__sk)->sk_lock.slock)) annotationSigned-off-by: Jules Irenge Signed-off-by: David S. Miller List of files: /linux-6.15/net/sctp/input.c