Commit db8bf823 authored Apr 21, 2020 by Jere Leppänen Committed by Greg Kroah-Hartman May 14, 2020

sctp: Fix bundling of SHUTDOWN with COOKIE-ACK



commit 145cb2f7177d94bc54563ed26027e952ee0ae03c upstream.

When we start shutdown in sctp_sf_do_dupcook_a(), we want to bundle
the SHUTDOWN with the COOKIE-ACK to ensure that the peer receives them
at the same time and in the correct order. This bundling was broken by
commit 4ff40b86262b ("sctp: set chunk transport correctly when it's a
new asoc"), which assigns a transport for the COOKIE-ACK, but not for
the SHUTDOWN.

Fix this by passing a reference to the COOKIE-ACK chunk as an argument
to sctp_sf_do_9_2_start_shutdown() and onward to
sctp_make_shutdown(). This way the SHUTDOWN chunk is assigned the same
transport as the COOKIE-ACK chunk, which allows them to be bundled.

In sctp_sf_do_9_2_start_shutdown(), the void *arg parameter was
previously unused. Now that we're taking it into use, it must be a
valid pointer to a chunk, or NULL. There is only one call site where
it's not, in sctp_sf_autoclose_timer_expire(). Fix that too.

Fixes: 4ff40b86262b ("sctp: set chunk transport correctly when it's a new asoc")
Signed-off-by: Jere Leppänen <jere.leppanen@nokia.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 525d7e73

net/sctp/sm_statefuns.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -1880,7 +1880,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
		*/
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
		return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
		SCTP_ST_CHUNK(0), NULL,
		SCTP_ST_CHUNK(0), repl,
		commands);
		} else {
		sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
		@@ -5483,7 +5483,7 @@ enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
		* in the Cumulative TSN Ack field the last sequential TSN it
		* has received from the peer.
		*/
		reply = sctp_make_shutdown(asoc, NULL);
		reply = sctp_make_shutdown(asoc, arg);
		if (!reply)
		goto nomem;

		@@ -6081,7 +6081,7 @@ enum sctp_disposition sctp_sf_autoclose_timer_expire(
		disposition = SCTP_DISPOSITION_CONSUME;
		if (sctp_outq_is_empty(&asoc->outqueue)) {
		disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
		arg, commands);
		NULL, commands);
		}

		return disposition;