[PATCH] sctp: fix oops when updating retransmit path with DEBUG on

[PATCH] sctp: fix oops when updating retransmit path with DEBUG on

[Wei Yongjun]

From: Vlad Yasevich <vladislav.yasevich@hp.com>

commit fbdf501c9374966a56829ecca3a7f25d2b49a305
  sctp: Do no select unconfirmed transports for retransmissions

Introduced the initial falt.

commit d598b166ced20d9b9281ea3527c0e18405ddb803
  sctp: Make sure we always return valid retransmit path

Solved the problem, but forgot to change the DEBUG statement.
Thus it was still possible to dereference a NULL pointer.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
---
 net/sctp/associola.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 0698cad..922fdd7 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1323,6 +1323,8 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
 
 	if (t)
 		asoc->peer.retran_path = t;
+	else
+		t = asoc->peer.retran_path;
 
 	SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
 				 " %p addr: ",
-- 
1.6.5.2

[PATCH] sctp: fix oops while removed transport still using as retran path

[Wei Yongjun]

Since we can not update retran path to unconfirmed transports,
when we remove a peer, the retran path may not be update if the
other transports are all unconfirmed, and we will still using
the removed transport as the retran path. This may cause panic
if retrasnmit happen.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
 net/sctp/associola.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 922fdd7..1a21c57 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -569,6 +569,8 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
 		sctp_assoc_set_primary(asoc, transport);
 	if (asoc->peer.active_path == peer)
 		asoc->peer.active_path = transport;
+	if (asoc->peer.retran_path == peer)
+		asoc->peer.retran_path = transport;
 	if (asoc->peer.last_data_from == peer)
 		asoc->peer.last_data_from = transport;
 
-- 
1.6.5.2

Re: [PATCH] sctp: fix oops while removed transport still using as retran path

[David Miller]

From: Wei Yongjun <yjwei@cn.fujitsu.com>
Date: Wed, 13 Apr 2011 09:22:22 +0800

> Since we can not update retran path to unconfirmed transports,
> when we remove a peer, the retran path may not be update if the
> other transports are all unconfirmed, and we will still using
> the removed transport as the retran path. This may cause panic
> if retrasnmit happen.
> 
> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>

Applied.

Re: [PATCH] sctp: fix oops when updating retransmit path with DEBUG on

[David Miller]

From: Wei Yongjun <yjwei@cn.fujitsu.com>
Date: Wed, 13 Apr 2011 09:20:48 +0800

> From: Vlad Yasevich <vladislav.yasevich@hp.com>
> 
> commit fbdf501c9374966a56829ecca3a7f25d2b49a305
>   sctp: Do no select unconfirmed transports for retransmissions
> 
> Introduced the initial falt.
> 
> commit d598b166ced20d9b9281ea3527c0e18405ddb803
>   sctp: Make sure we always return valid retransmit path
> 
> Solved the problem, but forgot to change the DEBUG statement.
> Thus it was still possible to dereference a NULL pointer.
> 
> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

Applied.