From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752318AbbIOC0v (ORCPT <rfc822;w@1wt.eu>);
	Mon, 14 Sep 2015 22:26:51 -0400
Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:55587 "EHLO
	shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1751387AbbIOC0t convert rfc822-to-8bit
	(ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Mon, 14 Sep 2015 22:26:49 -0400
Message-ID: <1442284004.29883.4.camel@decadent.org.uk>
Subject: Re: [PATCH 2.6.32 29/62] sctp: Fix race between OOTB responce and
 route removal
From: Ben Hutchings <ben@decadent.org.uk>
To: Willy Tarreau <w@1wt.eu>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Alexander Sverdlin <alexander.sverdlin@nokia.com>,
        Neil Horman <nhorman@tuxdriver.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
        Vlad Yasevich <vyasevich@gmail.com>,
        "David S. Miller" <davem@davemloft.net>
Date: Tue, 15 Sep 2015 03:26:44 +0100
In-Reply-To: <20150912225607.810043732@1wt.eu>
References: <20150912225607.810043732@1wt.eu>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8BIT
X-Mailer: Evolution 3.12.9-1+b1 
Mime-Version: 1.0
X-SA-Exim-Connect-IP: 192.168.2.6
X-SA-Exim-Mail-From: ben@decadent.org.uk
X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, 2015-09-13 at 00:56 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
> 
> [ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ]
> 
> There is NULL pointer dereference possible during statistics update if the route
> used for OOTB responce is removed at unfortunate time. If the route exists when
> we receive OOTB packet and we finally jump into sctp_packet_transmit() to send
> ABORT, but in the meantime route is removed under our feet, we take "no_route"
> path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...).
[...]
> [bwh: Backported to 3.2: sctp alway uses init_net]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[...]

This doesn't make sense in 2.6.32 and it didn't make sense for me to
apply it to 3.2 either!  Since sctp is not using asoc to look up a net
namespace here, the null pointer doesn't get dereferenced.

Ben.