Marcelo Ricardo Leitner 493d6a2da3 sctp: fix ASCONF list handling ... commit 2d45a02d0166caf2627fe91897c6ffc3b19514c4 upstream. ->auto_asconf_splist is per namespace and mangled by functions like sctp_setsockopt_auto_asconf() which doesn't guarantee any serialization. Also, the call to inet_sk_copy_descendant() was backuping ->auto_asconf_list through the copy but was not honoring ->do_auto_asconf, which could lead to list corruption if it was different between both sockets. This commit thus fixes the list handling by using ->addr_wq_lock spinlock to protect the list. A special handling is done upon socket creation and destruction for that. Error handlig on sctp_init_sock() will never return an error after having initialized asconf, so sctp_destroy_sock() can be called without addrq_wq_lock. The lock now will be take on sctp_close_sock(), before locking the socket, so we don't do it in inverse order compared to sctp_addr_wq_timeout_handler(). Instead of taking the lock on sctp_sock_migrate() for copying and restoring the list values, it's preferred to avoid rewritting it by implementing sctp_copy_descendant(). Issue was found with a test application that kept flipping sysctl default_auto_asconf on and off, but one could trigger it by issuing simultaneous setsockopt() calls on multiple sockets or by creating/destroying sockets fast enough. This is only triggerable locally. Fixes: 9f7d653b67 ("sctp: Add Auto-ASCONF support (core).") Reported-by: Ji Jianwen <jiji@redhat.com> Suggested-by: Neil Horman <nhorman@tuxdriver.com> Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> [lizf: Backported to 3.4: - use global spinlock instead of per-namespace lock] Signed-off-by: Zefan Li <lizefan@huawei.com>		2015-10-22 09:20:04 +08:00
..
auth.h
checksum.h
command.h	sctp: deal with multiple COOKIE_ECHO chunks	2011-09-16 17:17:22 -04:00
constants.h	sctp: remove completely unsed EMPTY state	2011-04-20 01:51:03 -07:00
sctp.h	net: sctp: fix panic on duplicate ASCONF chunks	2015-04-14 17:33:57 +08:00
sm.h	net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks	2015-04-14 17:33:57 +08:00
structs.h	sctp: fix ASCONF list handling	2015-10-22 09:20:04 +08:00
tsnmap.h
ulpevent.h	sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket	2011-07-08 09:53:08 -07:00
ulpqueue.h
user.h	sctp: Add socket option operation for Auto-ASCONF.	2011-06-02 02:04:53 -07:00