[SCTP] Handle non-linear ip re-assembled skb's in sctp_rcv()

include/net/sctp/sctp.h

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001-2002 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  * Copyright (c) 2001 Intel Corp.
  *
  * This file is part of the SCTP kernel reference Implementation
@@ -37,6 +37,7 @@
  *    Xingang Guo           <xingang.guo@intel.com>
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Daisy Chang	    <daisyc@us.ibm.com>
+ *    Sridhar Samudrala     <sri@us.ibm.com>
  *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -147,7 +148,9 @@ extern int sctp_primitive_REQUESTHEARTBEAT(sctp_association_t *, void *arg);
 /*
  * sctp_crc32c.c
  */
-extern __u32 count_crc(__u8 *ptr, __u16 count);
+extern __u32 sctp_start_cksum(__u8 *ptr, __u16 count);
+extern __u32 sctp_update_cksum(__u8 *ptr, __u16 count, __u32 cksum);
+extern __u32 sctp_end_cksum(__u32 cksum);
 
 /*
  * sctp_input.c

net/sctp/adler32.c

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
+ * Copyright (c) 2003 International Business Machines, Corp.
  * 
  * This file is part of the SCTP kernel reference Implementation
  * 
@@ -36,6 +37,7 @@
  *    Randall Stewart <rstewar1@email.mot.com>
  *    Ken Morneau     <kmorneau@cisco.com>
  *    Qiaobing Xie    <qxie1@email.mot.com>
+ *    Sridhar Samudrala <sri@us.ibm.com>
  * 
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -122,7 +124,7 @@ unsigned long update_adler32(unsigned long adler,
 	return (s2 << 16) + s1;
 }
 
-__u32 count_crc(__u8 *ptr, __u16 count)
+__u32 sctp_start_cksum(__u8 *ptr, __u16 count)
 {
 	/*
 	 * Update a running Adler-32 checksum with the bytes
@@ -146,3 +148,15 @@ __u32 count_crc(__u8 *ptr, __u16 count)
 
         return adler;
 }
+
+__u32 sctp_update_cksum(__u8 *ptr, __u16 count, __u32 adler)
+{
+	adler = update_adler32(adler, ptr, count);
+
+	return adler;
+}
+
+__u32 sctp_end_cksum(__u32 adler)
+{
+	return adler;
+}

net/sctp/crc32c.c

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  * 
  * This file is part of the SCTP kernel reference Implementation
  * 
@@ -33,6 +33,7 @@
  * Written or modified by: 
  *    Dinakaran Joseph 
  *    Jon Grimm <jgrimm@us.ibm.com>
+ *    Sridhar Samudrala <sri@us.ibm.com>
  * 
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -135,11 +136,10 @@ __u32 crc_c[256] = {
 	0xBE2DA0A5, 0x4C4623A6, 0x5F16D052, 0xAD7D5351,
 };
      
-__u32 count_crc(__u8 *buffer, __u16 length)
+__u32 sctp_start_cksum(__u8 *buffer, __u16 length)
 {
     	__u32 crc32 = ~(__u32) 0;
-	__u32 i, result;
-	__u8 byte0, byte1, byte2, byte3;
+	__u32 i;
 
 	/* Optimize this routine to be SCTP specific, knowing how
 	 * to skip the checksum field of the SCTP header.
@@ -157,6 +157,24 @@ __u32 count_crc(__u8 *buffer, __u16 length)
 	for (i = sizeof(struct sctphdr); i < length ; i++)
 		CRC32C(crc32, buffer[i]);
 
+	return crc32;
+}
+
+__u32 sctp_update_cksum(__u8 *buffer, __u16 length, __u32 crc32)
+{
+	__u32 i;
+
+	for (i = 0; i < length ; i++)
+		CRC32C(crc32, buffer[i]);
+
+	return crc32;
+}
+
+__u32 sctp_end_cksum(__u32 crc32)
+{
+	__u32 result;
+	__u8 byte0, byte1, byte2, byte3;
+
 	result = ~crc32;
 
 	/*  result  now holds the negated polynomial remainder;
@@ -183,5 +201,3 @@ __u32 count_crc(__u8 *buffer, __u16 length)
 		 byte3);
 	return crc32;
 }
-
-

net/sctp/input.c

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  * Copyright (c) 2001 Intel Corp.
  * Copyright (c) 2001 Nokia, Inc.
  * Copyright (c) 2001 La Monte H.P. Yarroll
@@ -72,10 +72,19 @@ static inline int sctp_rcv_checksum(struct sk_buff *skb)
 {
 	struct sctphdr *sh;
 	__u32 cmp, val;
+	struct sk_buff *list = skb_shinfo(skb)->frag_list;
 
 	sh = (struct sctphdr *) skb->h.raw;
 	cmp = ntohl(sh->checksum);
-	val = count_crc((__u8 *)sh, skb->len);
+
+	val = sctp_start_cksum((__u8 *)sh, skb_headlen(skb));
+
+	for (; list; list = list->next)
+		val = sctp_update_cksum((__u8 *)list->data, skb_headlen(list),
+					val);
+
+	val = sctp_end_cksum(val);
+
 	if (val != cmp) {
 		/* CRC failure, dump it. */
 		return -1;

net/sctp/output.c

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  *
  * This file is part of the SCTP kernel reference Implementation
  *
@@ -62,7 +62,6 @@
 #include <net/sctp/sm.h>
 
 /* Forward declarations for private helpers. */
-__u32 count_crc(__u8 *ptr, __u16  count);
 static void sctp_packet_reset(sctp_packet_t *packet);
 static sctp_xmit_t sctp_packet_append_data(sctp_packet_t *packet,
 					   sctp_chunk_t *chunk);
@@ -358,7 +357,8 @@ int sctp_packet_transmit(sctp_packet_t *packet)
 	 * Note: Adler-32 is no longer applicable, as has been replaced
 	 * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
 	 */
-	crc32 = count_crc((__u8 *)sh, nskb->len);
+	crc32 = sctp_start_cksum((__u8 *)sh, nskb->len);
+	crc32 = sctp_end_cksum(crc32);
 
 	/* 3) Put the resultant value into the checksum field in the
 	 *    common header, and leave the rest of the bits unchanged.

net/sctp/socket.c

 /* Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001-2002 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  * Copyright (c) 2001-2002 Intel Corp.
  * Copyright (c) 2001-2002 Nokia, Inc.
  * Copyright (c) 2001 La Monte H.P. Yarroll
@@ -1091,18 +1091,25 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 static int sctp_skb_pull(struct sk_buff *skb, int len)
 {
 	struct sk_buff *list;
+	int skb_len = skb_headlen(skb);
+	int rlen;
 
-	if (len <= skb->len) {
+	if (len <= skb_len) {
 		__skb_pull(skb, len);
 		return 0;
 	}
-	len -= skb->len;
-	__skb_pull(skb, skb->len);
+	len -= skb_len;
+	__skb_pull(skb, skb_len);
 
 	for (list = skb_shinfo(skb)->frag_list; list; list = list->next) {
-		len = sctp_skb_pull(list, len);
-		if (!len)
+		rlen = sctp_skb_pull(list, len);
+		skb->len -= (len-rlen);
+		skb->data_len -= (len-rlen);
+
+		if (!rlen)
 			return 0;
+
+		len = rlen;
 	}
 
 	return len;
@@ -1130,7 +1137,7 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr
 {
 	sctp_ulpevent_t *event = NULL;
 	sctp_opt_t *sp = sctp_sk(sk);
-	struct sk_buff *skb, *list;
+	struct sk_buff *skb;
 	int copied;
 	int err = 0;
 	int skb_len;
@@ -1154,8 +1161,6 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr
 	 * frag_list.
 	 */ 
 	skb_len = skb->len;
-	for (list = skb_shinfo(skb)->frag_list; list; list = list->next)
-		skb_len += list->len;
 
 	copied = skb_len;
 	if (copied > len)

net/sctp/ulpqueue.c

 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001-2002 International Business Machines, Corp.
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
  * Copyright (c) 2001 Intel Corp.
  * Copyright (c) 2001 Nokia, Inc.
  * Copyright (c) 2001 La Monte H.P. Yarroll
@@ -233,16 +233,30 @@ static inline void sctp_ulpqueue_store_reasm(sctp_ulpqueue_t *ulpq, sctp_ulpeven
 
 /* Helper function to return an event corresponding to the reassembled
  * datagram.
+ * This routine creates a re-assembled skb given the first and last skb's
+ * as stored in the reassembly queue. The skb's may be non-linear if the sctp
+ * payload was fragmented on the way and ip had to reassemble them.
+ * We add the rest of skb's to the first skb's fraglist.
  */
 static inline sctp_ulpevent_t *sctp_make_reassembled_event(struct sk_buff *f_frag, struct sk_buff *l_frag)
 {
 	struct sk_buff *pos;
 	sctp_ulpevent_t *event;
-	struct sk_buff *pnext;
+	struct sk_buff *pnext, *last;
+	struct sk_buff *list = skb_shinfo(f_frag)->frag_list;
 
+	/* Store the pointer to the 2nd skb */
 	pos = f_frag->next;
 
-	/* Set the first fragment's frag_list to point to the 2nd fragment.  */
+	/* Get the last skb in the f_frag's frag_list if present. */
+	for (last = list; list; last = list,list = list->next);
+
+	/* Add the list of remaining fragments to the first fragments
+	 * frag_list.
+	 */
+	if (last)
+		last->next = pos;
+	else
 		skb_shinfo(f_frag)->frag_list = pos;
 
 	/* Remove the first fragment from the reassembly queue.  */
@@ -250,6 +264,10 @@ static inline sctp_ulpevent_t *sctp_make_reassembled_event(struct sk_buff *f_fra
 	do {
 		pnext = pos->next;
 
+		/* Update the len and data_len fields of the first fragment. */
+		f_frag->len += pos->len;
+		f_frag->data_len += pos->len;
+
 		/* Remove the fragment from the reassembly queue.  */
 		__skb_unlink(pos, pos->list);