All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
@ 2020-03-27  1:28 ` Qiujun Huang
  0 siblings, 0 replies; 6+ messages in thread
From: Qiujun Huang @ 2020-03-27  1:28 UTC (permalink / raw)
  To: marcelo.leitner, davem
  Cc: vyasevich, nhorman, kuba, linux-sctp, netdev, linux-kernel,
	anenbupt, Qiujun Huang

We should iterate over the datamsgs to modify
all chunks(skbs) to newsk.

The following case cause the bug:
for the trouble SKB, it was in outq->transmitted list

sctp_outq_sack
        sctp_check_transmitted
                SKB was moved to outq->sacked list
        then throw away the sack queue
                SKB was deleted from outq->sacked
(but it was held by datamsg at sctp_datamsg_to_asoc
So, sctp_wfree was not called here)

then migrate happened

        sctp_for_each_tx_datachunk(
        sctp_clear_owner_w);
        sctp_assoc_migrate();
        sctp_for_each_tx_datachunk(
        sctp_set_owner_w);
SKB was not in the outq, and was not changed to newsk

finally

__sctp_outq_teardown
        sctp_chunk_put (for another skb)
                sctp_datamsg_put
                        __kfree_skb(msg->frag_list)
                                sctp_wfree (for SKB)
	SKB->sk was still oldsk (skb->sk != asoc->base.sk).

Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
---
 net/sctp/socket.c | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1b56fc440606..f68076713162 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
 	skb_orphan(chunk->skb);
 }
 
+#define traverse_and_process()	\
+do {				\
+	msg = chunk->msg;	\
+	if (msg == prev_msg)	\
+		continue;	\
+	list_for_each_entry(c, &msg->chunks, frag_list) {	\
+		if ((clear && asoc->base.sk == c->skb->sk) ||	\
+		    (!clear && asoc->base.sk != c->skb->sk))	\
+		    cb(c);	\
+	}			\
+	prev_msg = msg;		\
+} while (0)
+
 static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
+				       bool clear,
 				       void (*cb)(struct sctp_chunk *))
 
 {
+	struct sctp_datamsg *msg, *prev_msg = NULL;
 	struct sctp_outq *q = &asoc->outqueue;
+	struct sctp_chunk *chunk, *c;
 	struct sctp_transport *t;
-	struct sctp_chunk *chunk;
 
 	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
 		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
-			cb(chunk);
+			traverse_and_process();
 
 	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->sacked, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->out_chunk_list, list)
-		cb(chunk);
+		traverse_and_process();
 }
 
 static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
@@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	 * paths won't try to lock it and then oldsk.
 	 */
 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
-	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
+	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
 	sctp_assoc_migrate(assoc, newsk);
-	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
+	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
 
 	/* If the association on the newsk is already closed before accept()
 	 * is called, set RCV_SHUTDOWN flag.
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
@ 2020-03-27  1:28 ` Qiujun Huang
  0 siblings, 0 replies; 6+ messages in thread
From: Qiujun Huang @ 2020-03-27  1:28 UTC (permalink / raw)
  To: marcelo.leitner, davem
  Cc: vyasevich, nhorman, kuba, linux-sctp, netdev, linux-kernel,
	anenbupt, Qiujun Huang

We should iterate over the datamsgs to modify
all chunks(skbs) to newsk.

The following case cause the bug:
for the trouble SKB, it was in outq->transmitted list

sctp_outq_sack
        sctp_check_transmitted
                SKB was moved to outq->sacked list
        then throw away the sack queue
                SKB was deleted from outq->sacked
(but it was held by datamsg at sctp_datamsg_to_asoc
So, sctp_wfree was not called here)

then migrate happened

        sctp_for_each_tx_datachunk(
        sctp_clear_owner_w);
        sctp_assoc_migrate();
        sctp_for_each_tx_datachunk(
        sctp_set_owner_w);
SKB was not in the outq, and was not changed to newsk

finally

__sctp_outq_teardown
        sctp_chunk_put (for another skb)
                sctp_datamsg_put
                        __kfree_skb(msg->frag_list)
                                sctp_wfree (for SKB)
	SKB->sk was still oldsk (skb->sk != asoc->base.sk).

Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
---
 net/sctp/socket.c | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1b56fc440606..f68076713162 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
 	skb_orphan(chunk->skb);
 }
 
+#define traverse_and_process()	\
+do {				\
+	msg = chunk->msg;	\
+	if (msg = prev_msg)	\
+		continue;	\
+	list_for_each_entry(c, &msg->chunks, frag_list) {	\
+		if ((clear && asoc->base.sk = c->skb->sk) ||	\
+		    (!clear && asoc->base.sk != c->skb->sk))	\
+		    cb(c);	\
+	}			\
+	prev_msg = msg;		\
+} while (0)
+
 static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
+				       bool clear,
 				       void (*cb)(struct sctp_chunk *))
 
 {
+	struct sctp_datamsg *msg, *prev_msg = NULL;
 	struct sctp_outq *q = &asoc->outqueue;
+	struct sctp_chunk *chunk, *c;
 	struct sctp_transport *t;
-	struct sctp_chunk *chunk;
 
 	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
 		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
-			cb(chunk);
+			traverse_and_process();
 
 	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->sacked, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->out_chunk_list, list)
-		cb(chunk);
+		traverse_and_process();
 }
 
 static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
@@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	 * paths won't try to lock it and then oldsk.
 	 */
 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
-	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
+	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
 	sctp_assoc_migrate(assoc, newsk);
-	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
+	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
 
 	/* If the association on the newsk is already closed before accept()
 	 * is called, set RCV_SHUTDOWN flag.
-- 
2.17.1

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
  2020-03-27  1:28 ` Qiujun Huang
@ 2020-03-27  2:35   ` Marcelo Ricardo Leitner
  -1 siblings, 0 replies; 6+ messages in thread
From: Marcelo Ricardo Leitner @ 2020-03-27  2:35 UTC (permalink / raw)
  To: Qiujun Huang
  Cc: davem, vyasevich, nhorman, kuba, linux-sctp, netdev,
	linux-kernel, anenbupt

On Fri, Mar 27, 2020 at 09:28:32AM +0800, Qiujun Huang wrote:
> We should iterate over the datamsgs to modify

Just two small things now.
s/modify/move/  , it's more accurate.
But mainly because...

...
> 
> Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com

checkpatch.pl is warning that there should be an empty space after the
':' here.

Otherwise, looks very good.

Btw, I learned a lot about syzbot new features with your tests, thanks :-)

> Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
> ---
>  net/sctp/socket.c | 31 +++++++++++++++++++++++--------
>  1 file changed, 23 insertions(+), 8 deletions(-)
> 
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 1b56fc440606..f68076713162 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
>  	skb_orphan(chunk->skb);
>  }
>  
> +#define traverse_and_process()	\
> +do {				\
> +	msg = chunk->msg;	\
> +	if (msg == prev_msg)	\
> +		continue;	\
> +	list_for_each_entry(c, &msg->chunks, frag_list) {	\
> +		if ((clear && asoc->base.sk == c->skb->sk) ||	\
> +		    (!clear && asoc->base.sk != c->skb->sk))	\
> +		    cb(c);	\
> +	}			\
> +	prev_msg = msg;		\
> +} while (0)
> +
>  static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
> +				       bool clear,
>  				       void (*cb)(struct sctp_chunk *))
>  
>  {
> +	struct sctp_datamsg *msg, *prev_msg = NULL;
>  	struct sctp_outq *q = &asoc->outqueue;
> +	struct sctp_chunk *chunk, *c;
>  	struct sctp_transport *t;
> -	struct sctp_chunk *chunk;
>  
>  	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
>  		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
> -			cb(chunk);
> +			traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->sacked, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->out_chunk_list, list)
> -		cb(chunk);
> +		traverse_and_process();
>  }
>  
>  static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
> @@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
>  	 * paths won't try to lock it and then oldsk.
>  	 */
>  	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
> -	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
> +	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
>  	sctp_assoc_migrate(assoc, newsk);
> -	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
> +	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
>  
>  	/* If the association on the newsk is already closed before accept()
>  	 * is called, set RCV_SHUTDOWN flag.
> -- 
> 2.17.1
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
@ 2020-03-27  2:35   ` Marcelo Ricardo Leitner
  0 siblings, 0 replies; 6+ messages in thread
From: Marcelo Ricardo Leitner @ 2020-03-27  2:35 UTC (permalink / raw)
  To: Qiujun Huang
  Cc: davem, vyasevich, nhorman, kuba, linux-sctp, netdev,
	linux-kernel, anenbupt

On Fri, Mar 27, 2020 at 09:28:32AM +0800, Qiujun Huang wrote:
> We should iterate over the datamsgs to modify

Just two small things now.
s/modify/move/  , it's more accurate.
But mainly because...

...
> 
> Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com

checkpatch.pl is warning that there should be an empty space after the
':' here.

Otherwise, looks very good.

Btw, I learned a lot about syzbot new features with your tests, thanks :-)

> Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
> ---
>  net/sctp/socket.c | 31 +++++++++++++++++++++++--------
>  1 file changed, 23 insertions(+), 8 deletions(-)
> 
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 1b56fc440606..f68076713162 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
>  	skb_orphan(chunk->skb);
>  }
>  
> +#define traverse_and_process()	\
> +do {				\
> +	msg = chunk->msg;	\
> +	if (msg = prev_msg)	\
> +		continue;	\
> +	list_for_each_entry(c, &msg->chunks, frag_list) {	\
> +		if ((clear && asoc->base.sk = c->skb->sk) ||	\
> +		    (!clear && asoc->base.sk != c->skb->sk))	\
> +		    cb(c);	\
> +	}			\
> +	prev_msg = msg;		\
> +} while (0)
> +
>  static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
> +				       bool clear,
>  				       void (*cb)(struct sctp_chunk *))
>  
>  {
> +	struct sctp_datamsg *msg, *prev_msg = NULL;
>  	struct sctp_outq *q = &asoc->outqueue;
> +	struct sctp_chunk *chunk, *c;
>  	struct sctp_transport *t;
> -	struct sctp_chunk *chunk;
>  
>  	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
>  		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
> -			cb(chunk);
> +			traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->sacked, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
> -		cb(chunk);
> +		traverse_and_process();
>  
>  	list_for_each_entry(chunk, &q->out_chunk_list, list)
> -		cb(chunk);
> +		traverse_and_process();
>  }
>  
>  static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
> @@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
>  	 * paths won't try to lock it and then oldsk.
>  	 */
>  	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
> -	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
> +	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
>  	sctp_assoc_migrate(assoc, newsk);
> -	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
> +	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
>  
>  	/* If the association on the newsk is already closed before accept()
>  	 * is called, set RCV_SHUTDOWN flag.
> -- 
> 2.17.1
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
  2020-03-27  2:35   ` Marcelo Ricardo Leitner
@ 2020-03-27  3:02     ` Qiujun Huang
  -1 siblings, 0 replies; 6+ messages in thread
From: Qiujun Huang @ 2020-03-27  3:02 UTC (permalink / raw)
  To: Marcelo Ricardo Leitner
  Cc: David S. Miller, vyasevich, nhorman, Jakub Kicinski, linux-sctp,
	netdev, LKML, anenbupt

On Fri, Mar 27, 2020 at 10:35 AM Marcelo Ricardo Leitner
<marcelo.leitner@gmail.com> wrote:
>
> On Fri, Mar 27, 2020 at 09:28:32AM +0800, Qiujun Huang wrote:
> > We should iterate over the datamsgs to modify
>
> Just two small things now.
> s/modify/move/  , it's more accurate.
Get it.

> But mainly because...
>
> ...
> >
> > Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com
>
> checkpatch.pl is warning that there should be an empty space after the
> ':' here.
forgot that.
>
> Otherwise, looks very good.
>
> Btw, I learned a lot about syzbot new features with your tests, thanks :-)

So do I, thanks.

>
> > Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
> > ---
> >  net/sctp/socket.c | 31 +++++++++++++++++++++++--------
> >  1 file changed, 23 insertions(+), 8 deletions(-)
> >
> > diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> > index 1b56fc440606..f68076713162 100644
> > --- a/net/sctp/socket.c
> > +++ b/net/sctp/socket.c
> > @@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
> >       skb_orphan(chunk->skb);
> >  }
> >
> > +#define traverse_and_process()       \
> > +do {                         \
> > +     msg = chunk->msg;       \
> > +     if (msg == prev_msg)    \
> > +             continue;       \
> > +     list_for_each_entry(c, &msg->chunks, frag_list) {       \
> > +             if ((clear && asoc->base.sk == c->skb->sk) ||   \
> > +                 (!clear && asoc->base.sk != c->skb->sk))    \
> > +                 cb(c);      \
> > +     }                       \
> > +     prev_msg = msg;         \
> > +} while (0)
> > +
> >  static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
> > +                                    bool clear,
> >                                      void (*cb)(struct sctp_chunk *))
> >
> >  {
> > +     struct sctp_datamsg *msg, *prev_msg = NULL;
> >       struct sctp_outq *q = &asoc->outqueue;
> > +     struct sctp_chunk *chunk, *c;
> >       struct sctp_transport *t;
> > -     struct sctp_chunk *chunk;
> >
> >       list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
> >               list_for_each_entry(chunk, &t->transmitted, transmitted_list)
> > -                     cb(chunk);
> > +                     traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->retransmit, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->sacked, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->abandoned, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->out_chunk_list, list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >  }
> >
> >  static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
> > @@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
> >        * paths won't try to lock it and then oldsk.
> >        */
> >       lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
> > -     sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
> > +     sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
> >       sctp_assoc_migrate(assoc, newsk);
> > -     sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
> > +     sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
> >
> >       /* If the association on the newsk is already closed before accept()
> >        * is called, set RCV_SHUTDOWN flag.
> > --
> > 2.17.1
> >

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree
@ 2020-03-27  3:02     ` Qiujun Huang
  0 siblings, 0 replies; 6+ messages in thread
From: Qiujun Huang @ 2020-03-27  3:02 UTC (permalink / raw)
  To: Marcelo Ricardo Leitner
  Cc: David S. Miller, vyasevich, nhorman, Jakub Kicinski, linux-sctp,
	netdev, LKML, anenbupt

On Fri, Mar 27, 2020 at 10:35 AM Marcelo Ricardo Leitner
<marcelo.leitner@gmail.com> wrote:
>
> On Fri, Mar 27, 2020 at 09:28:32AM +0800, Qiujun Huang wrote:
> > We should iterate over the datamsgs to modify
>
> Just two small things now.
> s/modify/move/  , it's more accurate.
Get it.

> But mainly because...
>
> ...
> >
> > Reported-and-tested-by:syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com
>
> checkpatch.pl is warning that there should be an empty space after the
> ':' here.
forgot that.
>
> Otherwise, looks very good.
>
> Btw, I learned a lot about syzbot new features with your tests, thanks :-)

So do I, thanks.

>
> > Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
> > ---
> >  net/sctp/socket.c | 31 +++++++++++++++++++++++--------
> >  1 file changed, 23 insertions(+), 8 deletions(-)
> >
> > diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> > index 1b56fc440606..f68076713162 100644
> > --- a/net/sctp/socket.c
> > +++ b/net/sctp/socket.c
> > @@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
> >       skb_orphan(chunk->skb);
> >  }
> >
> > +#define traverse_and_process()       \
> > +do {                         \
> > +     msg = chunk->msg;       \
> > +     if (msg = prev_msg)    \
> > +             continue;       \
> > +     list_for_each_entry(c, &msg->chunks, frag_list) {       \
> > +             if ((clear && asoc->base.sk = c->skb->sk) ||   \
> > +                 (!clear && asoc->base.sk != c->skb->sk))    \
> > +                 cb(c);      \
> > +     }                       \
> > +     prev_msg = msg;         \
> > +} while (0)
> > +
> >  static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
> > +                                    bool clear,
> >                                      void (*cb)(struct sctp_chunk *))
> >
> >  {
> > +     struct sctp_datamsg *msg, *prev_msg = NULL;
> >       struct sctp_outq *q = &asoc->outqueue;
> > +     struct sctp_chunk *chunk, *c;
> >       struct sctp_transport *t;
> > -     struct sctp_chunk *chunk;
> >
> >       list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
> >               list_for_each_entry(chunk, &t->transmitted, transmitted_list)
> > -                     cb(chunk);
> > +                     traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->retransmit, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->sacked, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->abandoned, transmitted_list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >
> >       list_for_each_entry(chunk, &q->out_chunk_list, list)
> > -             cb(chunk);
> > +             traverse_and_process();
> >  }
> >
> >  static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
> > @@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
> >        * paths won't try to lock it and then oldsk.
> >        */
> >       lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
> > -     sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
> > +     sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
> >       sctp_assoc_migrate(assoc, newsk);
> > -     sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
> > +     sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
> >
> >       /* If the association on the newsk is already closed before accept()
> >        * is called, set RCV_SHUTDOWN flag.
> > --
> > 2.17.1
> >

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-03-27  3:02 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-27  1:28 [PATCH v5 RESEND] sctp: fix refcount bug in sctp_wfree Qiujun Huang
2020-03-27  1:28 ` Qiujun Huang
2020-03-27  2:35 ` Marcelo Ricardo Leitner
2020-03-27  2:35   ` Marcelo Ricardo Leitner
2020-03-27  3:02   ` Qiujun Huang
2020-03-27  3:02     ` Qiujun Huang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.