Vlad, > -----Original Message----- > From: Roberts, Lee A. > Sent: Thursday, February 21, 2013 11:00 AM > To: 'Vlad Yasevich' > Cc: linux-sctp@xxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx > Subject: RE: [PATCH 1/4] sctp: fix association hangs due to off-by-one errors in sctp_tsnmap_grow() > > Vlad, > > > -----Original Message----- > > From: Vlad Yasevich [mailto:vyasevich@xxxxxxxxx] > > Sent: Thursday, February 21, 2013 10:19 AM > > To: Roberts, Lee A. > > Cc: linux-sctp@xxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx > > Subject: Re: [PATCH 1/4] sctp: fix association hangs due to off-by-one errors in sctp_tsnmap_grow() > > > > On 02/21/2013 11:44 AM, Roberts, Lee A. wrote: > > > From: Lee A. Roberts <lee.roberts@xxxxxx> > > > > > > Resolve SCTP association hangs observed during SCTP stress > > > testing. Observable symptoms include communications hangs > > > with data being held in the association lobby (ordering) > > > queue. Close examination of reassembly/ordering queues shows > > > duplicated packets. > > > > > > In sctp_tsnmap_grow(), correct off-by-one errors when copying > > > and resizing the tsnmap. If max_tsn_seen is in the LSB of the > > > word, this bit can be lost, causing the corresponding packet > > > to be transmitted again and to be entered as a duplicate into > > > the SCTP reassembly/ordering queues. > > > > > > Patch applies to linux-3.8 kernel. > > > > > > Signed-off-by: Lee A. Roberts <lee.roberts@xxxxxx> > > > --- > > > net/sctp/tsnmap.c | 5 +++-- > > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > > > diff -uprN -X linux-3.8-vanilla/Documentation/dontdiff linux-3.8-vanilla/net/sctp/tsnmap.c linux- > > 3.8-SCTP+1/net/sctp/tsnmap.c > > > --- linux-3.8-vanilla/net/sctp/tsnmap.c 2013-02-18 16:58:34.000000000 -0700 > > > +++ linux-3.8-SCTP+1/net/sctp/tsnmap.c 2013-02-20 08:01:02.555223259 -0700 > > > @@ -369,14 +369,15 @@ static int sctp_tsnmap_grow(struct sctp_ > > > if (gap >= SCTP_TSN_MAP_SIZE) > > > > No that I think about this a bit more, this should be gap + 1. If you > > do that, you might as well call sctp_tsnmap_grow() with gap+1 as > > argument and then can just use the 'gap' everywhere inside. > > I think the calculation of "gap" in sctp_tsnmap_mark() should change: > > - gap = tsn - map->base_tsn; > + gap = tsn - map->cumulative_tsn_ack_point; > Oops, this breaks the logic that follows. Using "gap + 1" in the call should work. I sent an updated patch (v3). - Lee > > > > > return 0; > > > > > > - inc = ALIGN((gap - map->len),BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT; > > > + inc = ALIGN((gap - map->len + 1), BITS_PER_LONG) > > > + + SCTP_TSN_MAP_INCREMENT; > > > len = min_t(u16, map->len + inc, SCTP_TSN_MAP_SIZE); > > > > > > new = kzalloc(len>>3, GFP_ATOMIC); > > > if (!new) > > > return 0; > > > > > > - bitmap_copy(new, map->tsn_map, map->max_tsn_seen - map->base_tsn); > > > + bitmap_copy(new, map->tsn_map, map->max_tsn_seen - map->base_tsn + 1); > > > > Can simplify that this by using map->cumulative_tsn_ack_point instead of > > base_tsn. > > > > -vlad > > > > I changed the code to use "cumulative_tsn_ack_point" in an updated version > of the patch. > > -- Lee > > > > kfree(map->tsn_map); > > > map->tsn_map = new; > > > map->len = len; > > > -- > > > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > > > the body of a message to majordomo@xxxxxxxxxxxxxxx > > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > > -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
