diff options
| author | Wei Yongjun <yjwei@cn.fujitsu.com> | 2009-04-26 17:13:35 +0200 |
|---|---|---|
| committer | Vlad Yasevich <vladislav.yasevich@hp.com> | 2009-06-03 15:14:46 +0200 |
| commit | 6345b19985e9f3ec31b61720de01806e3ef680fe (patch) | |
| tree | bb34bf4a7c0bc539e405a68c6835bb40d6b91147 /net/sctp | |
| parent | sctp: fix to only enable IPv6 address support on PF_INET6 socket (diff) | |
| download | linux-6345b19985e9f3ec31b61720de01806e3ef680fe.tar.xz linux-6345b19985e9f3ec31b61720de01806e3ef680fe.zip | |
sctp: fix panic when T2-shutdown timer expire on removed transport
If T2-shutdown timer is expired on a removed transport, kernel
panic will occur when we do failure management on that transport.
You can reproduce this use the following sequence:
Endpoint A Endpoint B
(ESTABLISHED) (ESTABLISHED)
<----------------- SHUTDOWN
(SRC=X)
ASCONF ----------------->
(Delete IP Address = X)
<----------------- ASCONF-ACK
(Success Indication)
<----------------- SHUTDOWN
(T2-shutdown timer expire)
This patch fixed the problem.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Diffstat (limited to 'net/sctp')
| -rw-r--r-- | net/sctp/associola.c | 8 | ||||
| -rw-r--r-- | net/sctp/sm_statefuns.c | 10 |
2 files changed, 15 insertions, 3 deletions
diff --git a/net/sctp/associola.c b/net/sctp/associola.c index e7b69a7360e2..3be28fed5915 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -567,6 +567,14 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, if (asoc->init_last_sent_to == peer) asoc->init_last_sent_to = NULL; + /* If we remove the transport an SHUTDOWN was last sent to, set it + * to NULL. Combined with the update of the retran path above, this + * will cause the next SHUTDOWN to be sent to the next available + * transport, maintaining the cycle. + */ + if (asoc->shutdown_last_sent_to == peer) + asoc->shutdown_last_sent_to = NULL; + asoc->peer.transport_count--; sctp_transport_free(peer); diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 55a61aa69662..10abc07d42cb 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -5432,9 +5432,13 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep, if (!reply) goto nomem; - /* Do some failure management (Section 8.2). */ - sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, - SCTP_TRANSPORT(asoc->shutdown_last_sent_to)); + /* Do some failure management (Section 8.2). + * If we remove the transport an SHUTDOWN was last sent to, don't + * do failure management. + */ + if (asoc->shutdown_last_sent_to) + sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, + SCTP_TRANSPORT(asoc->shutdown_last_sent_to)); /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for * the T2-shutdown timer. |