SCTP: Enable netns

The following set of patches enable network-namespaces for the SCTP protocol.

The multitude of global parameters are stored in a net_generic structure, and the bulk of the patches enable the protocol to access the parameters on a per-namespace basis. The first five patches enable netns handling of the protocol, procfs and sysfs.

Signed-off-by Jan Ariyasu <[email protected]>

The following set of patches enable network-namespaces for the SCTP protocol.

The multitude of global parameters are stored in a net_generic structure, and the bulk of the patches enable the protocol to access the parameters on a per-namespace basis. The first five patches enable netns handling of the protocol, procfs and sysfs.

- Add struct net into the port hash table hash calculation
- Add struct net inot the struct sctp_bind_bucket so there is a memory of which network namespace a port is allocated in. No need for a ref count because sctp_bind_bucket only exists when there are sockets in the hash table and sockets can not change their network namspace, and sockets already ref count their network namespace.
- Add struct net into the key comparison when we are testing to see if we have found the port hash table entry we are looking for.

With these changes lookups in the port hash table becomes safe to use in multiple network namespaces.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/sctp/sctp.h    |    4 ++--
  include/net/sctp/structs.h |    1 +
  net/sctp/socket.c          |   22 +++++++++++++---------
  3 files changed, 16 insertions(+), 11 deletions(-)

include/net/sctp/sctp.h +2 -2

index ff49964..7c05040 100644
@@ -632,9 +632,9 @@ static inline int sctp_sanity_check(void)
 
  /* Warning: The following hash functions assume a power of two 'size'. */
  /* This is the hash function for the SCTP port hash table. */
-static inline int sctp_phashfn(__u16 lport)
+static inline int sctp_phashfn(struct net *net, __u16 lport)
  {
-	return lport & (sctp_port_hashsize - 1);
+	return (net_hash_mix(net) + lport) & (sctp_port_hashsize - 1);
  }
 
  /* This is the hash function for the endpoint hash table. */

include/net/sctp/structs.h +1 -0

index fc5e600..c089bb1 100644
@@ -102,6 +102,7 @@ struct sctp_bind_bucket {
  	unsigned short	fastreuse;
  	struct hlist_node	node;
  	struct hlist_head	owner;
+	struct net	*net;
  };
 
  struct sctp_bind_hashbucket {

net/sctp/socket.c +13 -8

index 5e25981..4316b0f 100644
@@ -5769,7 +5769,7 @@ static void sctp_unhash(struct sock *sk)
   * a fastreuse flag (FIXME: NPI ipg).
   */
  static struct sctp_bind_bucket *sctp_bucket_create(
-	struct sctp_bind_hashbucket *head, unsigned short snum);
+	struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
 
  static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
  {

@@ -5799,11 +5799,12 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
  				rover = low;
  			if (inet_is_reserved_local_port(rover))
  				continue;
-			index = sctp_phashfn(rover);
+			index = sctp_phashfn(sock_net(sk), rover);
  			head = &sctp_port_hashtable[index];
  			sctp_spin_lock(&head->lock);
  			sctp_for_each_hentry(pp, node, &head->chain)
-				if (pp->port = rover)
+				if ((pp->port = rover) &&
+				    net_eq(sock_net(sk), pp->net))
  					goto next;
  			break;
  		next:

@@ -5827,10 +5828,10 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
  		 * to the port number (snum) - we detect that with the
  		 * port iterator, pp being NULL.
  		 */
-		head = &sctp_port_hashtable[sctp_phashfn(snum)];
+		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
  		sctp_spin_lock(&head->lock);
  		sctp_for_each_hentry(pp, node, &head->chain) {
-			if (pp->port = snum)
+			if ((pp->port = snum) && net_eq(pp->net, sock_net(sk)))
  				goto pp_found;
  		}
  	}

@@ -5881,7 +5882,7 @@ pp_found:
  pp_not_found:
  	/* If there was a hash table miss, create a new port.  */
  	ret = 1;
-	if (!pp && !(pp = sctp_bucket_create(head, snum)))
+	if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
  		goto fail_unlock;
 
  	/* In either case (hit or miss), make sure fastreuse is 1 only

@@ -6113,7 +6114,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
   ********************************************************************/
 
  static struct sctp_bind_bucket *sctp_bucket_create(
-	struct sctp_bind_hashbucket *head, unsigned short snum)
+	struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
  {
  	struct sctp_bind_bucket *pp;
 

@@ -6123,6 +6124,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
  		pp->port = snum;
  		pp->fastreuse = 0;
  		INIT_HLIST_HEAD(&pp->owner);
+		pp->net = net;
  		hlist_add_head(&pp->node, &head->chain);
  	}
  	return pp;

@@ -6142,7 +6144,8 @@ static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
  static inline void __sctp_put_port(struct sock *sk)
  {
  	struct sctp_bind_hashbucket *head > -		&sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->inet_num)];
+		&sctp_port_hashtable[sctp_phashfn(sock_net(sk),
+						  inet_sk(sk)->inet_num)];
  	struct sctp_bind_bucket *pp;
 
  	sctp_spin_lock(&head->lock);

@@ -6809,7 +6812,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
  	newsp->hmac = NULL;
 
  	/* Hook this new socket in to the bind_hash list. */
-	head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->inet_num)];
+	head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
+						 inet_sk(oldsk)->inet_num)];
  	sctp_local_bh_disable();
  	sctp_spin_lock(&head->lock);
  	pp = sctp_sk(oldsk)->bind_hash;

- Use struct net in the hash calculation
- Use sock_net(endpoint.base.sk) in the endpoint lookups.
- On receive calculate the network namespace from skb->dev.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/sctp/sctp.h    |    4 ++--
  include/net/sctp/structs.h |    2 +-
  net/sctp/endpointola.c     |    4 +++-
  net/sctp/input.c           |   19 ++++++++++++-------
  4 files changed, 18 insertions(+), 11 deletions(-)

include/net/sctp/sctp.h +2 -2

index 7c05040..87b119f 100644
@@ -638,9 +638,9 @@ static inline int sctp_phashfn(struct net *net, __u16 lport)
  }
 
  /* This is the hash function for the endpoint hash table. */
-static inline int sctp_ep_hashfn(__u16 lport)
+static inline int sctp_ep_hashfn(struct net *net, __u16 lport)
  {
-	return lport & (sctp_ep_hashsize - 1);
+	return (net_hash_mix(net) + lport) & (sctp_ep_hashsize - 1);
  }
 
  /* This is the hash function for the association hash table. */

include/net/sctp/structs.h +1 -1

index c089bb1..9f9de55 100644
@@ -1426,7 +1426,7 @@ struct sctp_association *sctp_endpoint_lookup_assoc(
  int sctp_endpoint_is_peeled_off(struct sctp_endpoint *,
  				const union sctp_addr *);
  struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
-					const union sctp_addr *);
+					struct net *, const union sctp_addr *);
  int sctp_has_association(const union sctp_addr *laddr,
  			 const union sctp_addr *paddr);
 

net/sctp/endpointola.c +3 -1

index 68a385d..50c87b4 100644
@@ -302,11 +302,13 @@ void sctp_endpoint_put(struct sctp_endpoint *ep)
 
  /* Is this the endpoint we are looking for?  */
  struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *ep,
+					       struct net *net,
  					       const union sctp_addr *laddr)
  {
  	struct sctp_endpoint *retval = NULL;
 
-	if (htons(ep->base.bind_addr.port) = laddr->v4.sin_port) {
+	if ((htons(ep->base.bind_addr.port) = laddr->v4.sin_port) &&
+	    net_eq(sock_net(ep->base.sk), net)) {
  		if (sctp_bind_addr_match(&ep->base.bind_addr, laddr,
  					 sctp_sk(ep->base.sk)))
  			retval = ep;

net/sctp/input.c +12 -7

index e64d521..c0ca893 100644
@@ -70,7 +70,8 @@ static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
  				      const union sctp_addr *laddr,
  				      const union sctp_addr *paddr,
  				      struct sctp_transport **transportp);
-static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr);
+static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
+						const union sctp_addr *laddr);
  static struct sctp_association *__sctp_lookup_association(
  					const union sctp_addr *local,
  					const union sctp_addr *peer,

@@ -129,6 +130,7 @@ int sctp_rcv(struct sk_buff *skb)
  	union sctp_addr dest;
  	int family;
  	struct sctp_af *af;
+	struct net *net = dev_net(skb->dev);
 
  	if (skb->pkt_type!=PACKET_HOST)
  		goto discard_it;

@@ -181,7 +183,7 @@ int sctp_rcv(struct sk_buff *skb)
  	asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
 
  	if (!asoc)
-		ep = __sctp_rcv_lookup_endpoint(&dest);
+		ep = __sctp_rcv_lookup_endpoint(net, &dest);
 
  	/* Retrieve the common input handling substructure. */
  	rcvr = asoc ? &asoc->base : &ep->base;

@@ -723,12 +725,13 @@ discard:
  /* Insert endpoint into the hash table.  */
  static void __sctp_hash_endpoint(struct sctp_endpoint *ep)
  {
+	struct net *net = sock_net(ep->base.sk);
  	struct sctp_ep_common *epb;
  	struct sctp_hashbucket *head;
 
  	epb = &ep->base;
 
-	epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
+	epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port);
  	head = &sctp_ep_hashtable[epb->hashent];
 
  	sctp_write_lock(&head->lock);

@@ -747,12 +750,13 @@ void sctp_hash_endpoint(struct sctp_endpoint *ep)
  /* Remove endpoint from the hash table.  */
  static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
  {
+	struct net *net = sock_net(ep->base.sk);
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;
 
  	epb = &ep->base;
 
-	epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
+	epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port);
 
  	head = &sctp_ep_hashtable[epb->hashent];
 

@@ -770,7 +774,8 @@ void sctp_unhash_endpoint(struct sctp_endpoint *ep)
  }
 
  /* Look up an endpoint. */
-static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr)
+static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
+						const union sctp_addr *laddr)
  {
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;

@@ -778,12 +783,12 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *l
  	struct hlist_node *node;
  	int hash;
 
-	hash = sctp_ep_hashfn(ntohs(laddr->v4.sin_port));
+	hash = sctp_ep_hashfn(net, ntohs(laddr->v4.sin_port));
  	head = &sctp_ep_hashtable[hash];
  	read_lock(&head->lock);
  	sctp_for_each_hentry(epb, node, &head->chain) {
  		ep = sctp_ep(epb);
-		if (sctp_endpoint_is_match(ep, laddr))
+		if (sctp_endpoint_is_match(ep, net, laddr))
  			goto hit;
  	}
 

- Use struct net in the hash calculation
- Use sock_net(association.base.sk) in the association lookups.
- On receive calculate the network namespace from skb->dev.
- Pass struct net from receive down to the functions that actually do the association lookup.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/sctp/sctp.h    |    6 ++--
  include/net/sctp/structs.h |    3 +-
  net/sctp/associola.c       |    4 ++-
  net/sctp/endpointola.c     |    6 +++-
  net/sctp/input.c           |   64 +++++++++++++++++++++++++++----------------
  net/sctp/ipv6.c            |    3 +-
  6 files changed, 54 insertions(+), 32 deletions(-)

include/net/sctp/sctp.h +3 -3

index 87b119f..640915a 100644
@@ -156,7 +156,7 @@ void sctp_hash_established(struct sctp_association *);
  void sctp_unhash_established(struct sctp_association *);
  void sctp_hash_endpoint(struct sctp_endpoint *);
  void sctp_unhash_endpoint(struct sctp_endpoint *);
-struct sock *sctp_err_lookup(int family, struct sk_buff *,
+struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *,
  			     struct sctphdr *, struct sctp_association **,
  			     struct sctp_transport **);
  void sctp_err_finish(struct sock *, struct sctp_association *);

@@ -644,9 +644,9 @@ static inline int sctp_ep_hashfn(struct net *net, __u16 lport)
  }
 
  /* This is the hash function for the association hash table. */
-static inline int sctp_assoc_hashfn(__u16 lport, __u16 rport)
+static inline int sctp_assoc_hashfn(struct net *net, __u16 lport, __u16 rport)
  {
-	int h = (lport << 16) + rport;
+	int h = (lport << 16) + rport + net_hash_mix(net);
  	h ^= h>>8;
  	return h & (sctp_assoc_hashsize - 1);
  }

include/net/sctp/structs.h +2 -1

index 9f9de55..c0563d1 100644
@@ -1427,7 +1427,7 @@ int sctp_endpoint_is_peeled_off(struct sctp_endpoint *,
  				const union sctp_addr *);
  struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
  					struct net *, const union sctp_addr *);
-int sctp_has_association(const union sctp_addr *laddr,
+int sctp_has_association(struct net *net, const union sctp_addr *laddr,
  			 const union sctp_addr *paddr);
 
  int sctp_verify_init(const struct sctp_association *asoc, sctp_cid_t,

@@ -2014,6 +2014,7 @@ void sctp_assoc_control_transport(struct sctp_association *,
  				  sctp_transport_cmd_t, sctp_sn_error_t);
  struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *, __u32);
  struct sctp_transport *sctp_assoc_is_match(struct sctp_association *,
+					   struct net *,
  					   const union sctp_addr *,
  					   const union sctp_addr *);
  void sctp_assoc_migrate(struct sctp_association *, struct sock *);

net/sctp/associola.c +3 -1

index ebaef3e..a3601f3 100644
@@ -1089,13 +1089,15 @@ out:
 
  /* Is this the association we are looking for? */
  struct sctp_transport *sctp_assoc_is_match(struct sctp_association *asoc,
+					   struct net *net,
  					   const union sctp_addr *laddr,
  					   const union sctp_addr *paddr)
  {
  	struct sctp_transport *transport;
 
  	if ((htons(asoc->base.bind_addr.port) = laddr->v4.sin_port) &&
-	    (htons(asoc->peer.port) = paddr->v4.sin_port)) {
+	    (htons(asoc->peer.port) = paddr->v4.sin_port) &&
+	    net_eq(sock_net(asoc->base.sk), net)) {
  		transport = sctp_assoc_lookup_paddr(asoc, paddr);
  		if (!transport)
  			goto out;

net/sctp/endpointola.c +4 -2

index 50c87b4..6b76393 100644
@@ -345,7 +345,8 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
 
  	rport = ntohs(paddr->v4.sin_port);
 
-	hash = sctp_assoc_hashfn(ep->base.bind_addr.port, rport);
+	hash = sctp_assoc_hashfn(sock_net(ep->base.sk), ep->base.bind_addr.port,
+				 rport);
  	head = &sctp_assoc_hashtable[hash];
  	read_lock(&head->lock);
  	sctp_for_each_hentry(epb, node, &head->chain) {

@@ -388,13 +389,14 @@ int sctp_endpoint_is_peeled_off(struct sctp_endpoint *ep,
  {
  	struct sctp_sockaddr_entry *addr;
  	struct sctp_bind_addr *bp;
+	struct net *net = sock_net(ep->base.sk);
 
  	bp = &ep->base.bind_addr;
  	/* This function is called with the socket lock held,
  	 * so the address_list can not change.
  	 */
  	list_for_each_entry(addr, &bp->address_list, list) {
-		if (sctp_has_association(&addr->a, paddr))
+		if (sctp_has_association(net, &addr->a, paddr))
  			return 1;
  	}
 

net/sctp/input.c +40 -24

index c0ca893..a7e9a85 100644
@@ -66,13 +66,15 @@
 
  /* Forward declarations for internal helpers. */
  static int sctp_rcv_ootb(struct sk_buff *);
-static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup(struct net *net,
+				      struct sk_buff *skb,
  				      const union sctp_addr *laddr,
  				      const union sctp_addr *paddr,
  				      struct sctp_transport **transportp);
  static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
  						const union sctp_addr *laddr);
  static struct sctp_association *__sctp_lookup_association(
+					struct net *net,
  					const union sctp_addr *local,
  					const union sctp_addr *peer,
  					struct sctp_transport **pt);

@@ -180,7 +182,7 @@ int sctp_rcv(struct sk_buff *skb)
  	    !af->addr_valid(&dest, NULL, skb))
  		goto discard_it;
 
-	asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
+	asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport);
 
  	if (!asoc)
  		ep = __sctp_rcv_lookup_endpoint(net, &dest);

@@ -476,7 +478,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
  }
 
  /* Common lookup code for icmp/icmpv6 error handler. */
-struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
+struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
  			     struct sctphdr *sctphdr,
  			     struct sctp_association **app,
  			     struct sctp_transport **tpp)

@@ -505,7 +507,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
  	/* Look for an association that matches the incoming ICMP error
  	 * packet.
  	 */
-	asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
+	asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport);
  	if (!asoc)
  		return NULL;
 

@@ -588,6 +590,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
  	struct inet_sock *inet;
  	sk_buff_data_t saveip, savesctp;
  	int err;
+	struct net *net = dev_net(skb->dev);
 
  	if (skb->len < ihlen + 8) {
  		ICMP_INC_STATS_BH(&init_net, ICMP_MIB_INERRORS);

@@ -599,7 +602,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
  	savesctp = skb->transport_header;
  	skb_reset_network_header(skb);
  	skb_set_transport_header(skb, ihlen);
-	sk = sctp_err_lookup(AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
+	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
  	/* Put back, the original values. */
  	skb->network_header = saveip;
  	skb->transport_header = savesctp;

@@ -803,13 +806,15 @@ hit:
  /* Insert association into the hash table.  */
  static void __sctp_hash_established(struct sctp_association *asoc)
  {
+	struct net *net = sock_net(asoc->base.sk);
  	struct sctp_ep_common *epb;
  	struct sctp_hashbucket *head;
 
  	epb = &asoc->base;
 
  	/* Calculate which chain this entry will belong to. */
-	epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port, asoc->peer.port);
+	epb->hashent = sctp_assoc_hashfn(net, epb->bind_addr.port,
+					 asoc->peer.port);
 
  	head = &sctp_assoc_hashtable[epb->hashent];
 

@@ -832,12 +837,13 @@ void sctp_hash_established(struct sctp_association *asoc)
  /* Remove association from the hash table.  */
  static void __sctp_unhash_established(struct sctp_association *asoc)
  {
+	struct net *net = sock_net(asoc->base.sk);
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;
 
  	epb = &asoc->base;
 
-	epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port,
+	epb->hashent = sctp_assoc_hashfn(net, epb->bind_addr.port,
  					 asoc->peer.port);
 
  	head = &sctp_assoc_hashtable[epb->hashent];

@@ -860,6 +866,7 @@ void sctp_unhash_established(struct sctp_association *asoc)
 
  /* Look up an association. */
  static struct sctp_association *__sctp_lookup_association(
+					struct net *net,
  					const union sctp_addr *local,
  					const union sctp_addr *peer,
  					struct sctp_transport **pt)

@@ -874,12 +881,13 @@ static struct sctp_association *__sctp_lookup_association(
  	/* Optimize here for direct hit, only listening connections can
  	 * have wildcards anyways.
  	 */
-	hash = sctp_assoc_hashfn(ntohs(local->v4.sin_port), ntohs(peer->v4.sin_port));
+	hash = sctp_assoc_hashfn(net, ntohs(local->v4.sin_port),
+				 ntohs(peer->v4.sin_port));
  	head = &sctp_assoc_hashtable[hash];
  	read_lock(&head->lock);
  	sctp_for_each_hentry(epb, node, &head->chain) {
  		asoc = sctp_assoc(epb);
-		transport = sctp_assoc_is_match(asoc, local, peer);
+		transport = sctp_assoc_is_match(asoc, net, local, peer);
  		if (transport)
  			goto hit;
  	}

@@ -897,27 +905,29 @@ hit:
 
  /* Look up an association. BH-safe. */
  SCTP_STATIC
-struct sctp_association *sctp_lookup_association(const union sctp_addr *laddr,
+struct sctp_association *sctp_lookup_association(struct net *net,
+						 const union sctp_addr *laddr,
  						 const union sctp_addr *paddr,
  					    struct sctp_transport **transportp)
  {
  	struct sctp_association *asoc;
 
  	sctp_local_bh_disable();
-	asoc = __sctp_lookup_association(laddr, paddr, transportp);
+	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
  	sctp_local_bh_enable();
 
  	return asoc;
  }
 
  /* Is there an association matching the given local and peer addresses? */
-int sctp_has_association(const union sctp_addr *laddr,
+int sctp_has_association(struct net *net,
+			 const union sctp_addr *laddr,
  			 const union sctp_addr *paddr)
  {
  	struct sctp_association *asoc;
  	struct sctp_transport *transport;
 
-	if ((asoc = sctp_lookup_association(laddr, paddr, &transport))) {
+	if ((asoc = sctp_lookup_association(net, laddr, paddr, &transport))) {
  		sctp_association_put(asoc);
  		return 1;
  	}

@@ -943,7 +953,8 @@ int sctp_has_association(const union sctp_addr *laddr,
   * in certain circumstances.
   *
   */
-static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
+	struct sk_buff *skb,
  	const union sctp_addr *laddr, struct sctp_transport **transportp)
  {
  	struct sctp_association *asoc;

@@ -983,7 +994,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
 
  		af->from_addr_param(paddr, params.addr, sh->source, 0);
 
-		asoc = __sctp_lookup_association(laddr, paddr, &transport);
+		asoc = __sctp_lookup_association(net, laddr, paddr, &transport);
  		if (asoc)
  			return asoc;
  	}

@@ -1006,6 +1017,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
   * subsequent ASCONF Chunks. If found, proceed to rule D4.
   */
  static struct sctp_association *__sctp_rcv_asconf_lookup(
+					struct net *net,
  					sctp_chunkhdr_t *ch,
  					const union sctp_addr *laddr,
  					__be16 peer_port,

@@ -1025,7 +1037,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 
  	af->from_addr_param(&paddr, param, peer_port, 0);
 
-	return __sctp_lookup_association(laddr, &paddr, transportp);
+	return __sctp_lookup_association(net, laddr, &paddr, transportp);
  }
 
 

@@ -1038,7 +1050,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
  * This means that any chunks that can help us identify the association need
  * to be looked at to find this association.
  */
-static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
+				      struct sk_buff *skb,
  				      const union sctp_addr *laddr,
  				      struct sctp_transport **transportp)
  {

@@ -1080,7 +1093,8 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
 
  		    case SCTP_CID_ASCONF:
  			    if (have_auth || sctp_addip_noauth)
-				    asoc = __sctp_rcv_asconf_lookup(ch, laddr,
+				    asoc = __sctp_rcv_asconf_lookup(
+							net, ch, laddr,
  							sctp_hdr(skb)->source,
  							transportp);
  		    default:

@@ -1103,7 +1117,8 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
   * include looking inside of INIT/INIT-ACK chunks or after the AUTH
   * chunks.
   */
-static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
+				      struct sk_buff *skb,
  				      const union sctp_addr *laddr,
  				      struct sctp_transport **transportp)
  {

@@ -1123,11 +1138,11 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
  	switch (ch->type) {
  	case SCTP_CID_INIT:
  	case SCTP_CID_INIT_ACK:
-		return __sctp_rcv_init_lookup(skb, laddr, transportp);
+		return __sctp_rcv_init_lookup(net, skb, laddr, transportp);
  		break;
 
  	default:
-		return __sctp_rcv_walk_lookup(skb, laddr, transportp);
+		return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
  		break;
  	}
 

@@ -1136,21 +1151,22 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
  }
 
  /* Lookup an association for an inbound skb. */
-static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup(struct net *net,
+				      struct sk_buff *skb,
  				      const union sctp_addr *paddr,
  				      const union sctp_addr *laddr,
  				      struct sctp_transport **transportp)
  {
  	struct sctp_association *asoc;
 
-	asoc = __sctp_lookup_association(laddr, paddr, transportp);
+	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
 
  	/* Further lookup for INIT/INIT-ACK packets.
  	 * SCTP Implementors Guide, 2.18 Handling of address
  	 * parameters within the INIT or INIT-ACK.
  	 */
  	if (!asoc)
-		asoc = __sctp_rcv_lookup_harder(skb, laddr, transportp);
+		asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp);
 
  	return asoc;
  }

net/sctp/ipv6.c +2 -1

index ed7139e..2165a7e 100644
@@ -154,6 +154,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  	struct ipv6_pinfo *np;
  	sk_buff_data_t saveip, savesctp;
  	int err;
+	struct net *net = dev_net(skb->dev);
 
  	idev = in6_dev_get(skb->dev);
 

@@ -162,7 +163,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  	savesctp = skb->transport_header;
  	skb_reset_network_header(skb);
  	skb_set_transport_header(skb, offset);
-	sk = sctp_err_lookup(AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
+	sk = sctp_err_lookup(net, AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
  	/* Put back, the original pointers. */
  	skb->network_header   = saveip;
  	skb->transport_header = savesctp;

- Move the address lists into struct net
- Add per network namespace initialization and cleanup
- Pass around struct net so it is everywhere I need it.
- Rename all of the global variable references into references to the variables moved into struct net

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/net_namespace.h |    4 +
  include/net/netns/sctp.h    |   21 +++++++
  include/net/sctp/sctp.h     |    4 +-
  include/net/sctp/structs.h  |   22 +-------
  net/sctp/associola.c        |    3 +-
  net/sctp/bind_addr.c        |   14 ++--
  net/sctp/ipv6.c             |   17 +++---
  net/sctp/protocol.c         |  141 +++++++++++++++++++++++++------------------
  net/sctp/socket.c           |    7 +-
  9 files changed, 131 insertions(+), 102 deletions(-)

create mode 100644 include/net/netns/sctp.h

include/net/net_namespace.h +4 -0

index ae1cd6c..8ab5250 100644
@@ -15,6 +15,7 @@
  #include <net/netns/packet.h>
  #include <net/netns/ipv4.h>
  #include <net/netns/ipv6.h>
+#include <net/netns/sctp.h>
  #include <net/netns/dccp.h>
  #include <net/netns/x_tables.h>
  #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

@@ -80,6 +81,9 @@ struct net {
  #if IS_ENABLED(CONFIG_IPV6)
  	struct netns_ipv6	ipv6;
  #endif
+#if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
+	struct netns_sctp	sctp;
+#endif
  #if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
  	struct netns_dccp	dccp;
  #endif

include/net/netns/sctp.h new file +21 -0

new file mode 100644
index 0000000..cbd684e
@@ -0,0 +1,21 @@
+#ifndef __NETNS_SCTP_H__
+#define __NETNS_SCTP_H__
+
+struct netns_sctp {
+	/* This is the global local address list.
+	 * We actively maintain this complete list of addresses on
+	 * the system by catching address add/delete events.
+	 *
+	 * It is a list of sctp_sockaddr_entry.
+	 */
+	struct list_head local_addr_list;
+	struct list_head addr_waitq;
+	struct timer_list addr_wq_timer;
+	struct list_head auto_asconf_splist;
+	spinlock_t addr_wq_lock;
+
+	/* Lock that protects the local_addr_list writers */
+	spinlock_t local_addr_lock;
+};
+
+#endif /* __NETNS_SCTP_H__ */

include/net/sctp/sctp.h +2 -2

index 640915a..00c9205 100644
@@ -115,12 +115,12 @@
   * sctp/protocol.c
   */
  extern struct sock *sctp_get_ctl_sock(void);
-extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
+extern int sctp_copy_local_addr_list(struct net *, struct sctp_bind_addr *,
  				     sctp_scope_t, gfp_t gfp,
  				     int flags);
  extern struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
  extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
-extern void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *, int);
+extern void sctp_addr_wq_mgmt(struct net *, struct sctp_sockaddr_entry *, int);
 
  /*
   * sctp/socket.c

include/net/sctp/structs.h +1 -21

index c0563d1..6bdfcab 100644
@@ -205,21 +205,7 @@ extern struct sctp_globals {
  	int port_hashsize;
  	struct sctp_bind_hashbucket *port_hashtable;
 
-	/* This is the global local address list.
-	 * We actively maintain this complete list of addresses on
-	 * the system by catching address add/delete events.
-	 *
-	 * It is a list of sctp_sockaddr_entry.
-	 */
-	struct list_head local_addr_list;
  	int default_auto_asconf;
-	struct list_head addr_waitq;
-	struct timer_list addr_wq_timer;
-	struct list_head auto_asconf_splist;
-	spinlock_t addr_wq_lock;
-
-	/* Lock that protects the local_addr_list writers */
-	spinlock_t addr_list_lock;
 
  	/* Flag to indicate if addip is enabled. */
  	int addip_enable;

@@ -278,12 +264,6 @@ extern struct sctp_globals {
  #define sctp_assoc_hashtable		(sctp_globals.assoc_hashtable)
  #define sctp_port_hashsize		(sctp_globals.port_hashsize)
  #define sctp_port_hashtable		(sctp_globals.port_hashtable)
-#define sctp_local_addr_list		(sctp_globals.local_addr_list)
-#define sctp_local_addr_lock		(sctp_globals.addr_list_lock)
-#define sctp_auto_asconf_splist		(sctp_globals.auto_asconf_splist)
-#define sctp_addr_waitq			(sctp_globals.addr_waitq)
-#define sctp_addr_wq_timer		(sctp_globals.addr_wq_timer)
-#define sctp_addr_wq_lock		(sctp_globals.addr_wq_lock)
  #define sctp_default_auto_asconf	(sctp_globals.default_auto_asconf)
  #define sctp_scope_policy		(sctp_globals.ipv4_scope_policy)
  #define sctp_addip_enable		(sctp_globals.addip_enable)

@@ -1241,7 +1221,7 @@ struct sctp_bind_addr {
 
  void sctp_bind_addr_init(struct sctp_bind_addr *, __u16 port);
  void sctp_bind_addr_free(struct sctp_bind_addr *);
-int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
+int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest,
  			const struct sctp_bind_addr *src,
  			sctp_scope_t scope, gfp_t gfp,
  			int flags);

net/sctp/associola.c +2 -1

index a3601f3..ed4930b 100644
@@ -1544,7 +1544,8 @@ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
  	if (asoc->peer.ipv6_address)
  		flags |= SCTP_ADDR6_PEERSUPP;
 
-	return sctp_bind_addr_copy(&asoc->base.bind_addr,
+	return sctp_bind_addr_copy(sock_net(asoc->base.sk),
+				   &asoc->base.bind_addr,
  				   &asoc->ep->base.bind_addr,
  				   scope, gfp, flags);
  }

net/sctp/bind_addr.c +7 -7

index 4ece451..a85ce4b 100644
@@ -52,8 +52,8 @@
  #include <net/sctp/sm.h>
 
  /* Forward declarations for internal helpers. */
-static int sctp_copy_one_addr(struct sctp_bind_addr *, union sctp_addr *,
-			      sctp_scope_t scope, gfp_t gfp,
+static int sctp_copy_one_addr(struct net *, struct sctp_bind_addr *,
+			      union sctp_addr *, sctp_scope_t scope, gfp_t gfp,
  			      int flags);
  static void sctp_bind_addr_clean(struct sctp_bind_addr *);
 

@@ -62,7 +62,7 @@ static void sctp_bind_addr_clean(struct sctp_bind_addr *);
  /* Copy 'src' to 'dest' taking 'scope' into account.  Omit addresses
   * in 'src' which have a broader scope than 'scope'.
   */
-int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
+int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest,
  			const struct sctp_bind_addr *src,
  			sctp_scope_t scope, gfp_t gfp,
  			int flags)

@@ -75,7 +75,7 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
 
  	/* Extract the addresses which are relevant for this scope.  */
  	list_for_each_entry(addr, &src->address_list, list) {
-		error = sctp_copy_one_addr(dest, &addr->a, scope,
+		error = sctp_copy_one_addr(net, dest, &addr->a, scope,
  					   gfp, flags);
  		if (error < 0)
  			goto out;

@@ -87,7 +87,7 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
  	 */
  	if (list_empty(&dest->address_list) && (SCTP_SCOPE_GLOBAL = scope)) {
  		list_for_each_entry(addr, &src->address_list, list) {
-			error = sctp_copy_one_addr(dest, &addr->a,
+			error = sctp_copy_one_addr(net, dest, &addr->a,
  						   SCTP_SCOPE_LINK, gfp,
  						   flags);
  			if (error < 0)

@@ -448,7 +448,7 @@ union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr	*bp,
  }
 
  /* Copy out addresses from the global local address list. */
-static int sctp_copy_one_addr(struct sctp_bind_addr *dest,
+static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
  			      union sctp_addr *addr,
  			      sctp_scope_t scope, gfp_t gfp,
  			      int flags)

@@ -456,7 +456,7 @@ static int sctp_copy_one_addr(struct sctp_bind_addr *dest,
  	int error = 0;
 
  	if (sctp_is_any(NULL, addr)) {
-		error = sctp_copy_local_addr_list(dest, scope, gfp, flags);
+		error = sctp_copy_local_addr_list(net, dest, scope, gfp, flags);
  	} else if (sctp_in_scope(addr, scope)) {
  		/* Now that the address is in scope, check to see if
  		 * the address type is supported by local sock as

net/sctp/ipv6.c +9 -8

index 2165a7e..bbf1534 100644
@@ -99,6 +99,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
  	struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
  	struct sctp_sockaddr_entry *addr = NULL;
  	struct sctp_sockaddr_entry *temp;
+	struct net *net = dev_net(ifa->idev->dev);
  	int found = 0;
 
  	switch (ev) {

@@ -110,27 +111,27 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
  			addr->a.v6.sin6_addr = ifa->addr;
  			addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
  			addr->valid = 1;
-			spin_lock_bh(&sctp_local_addr_lock);
-			list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
-			sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
-			spin_unlock_bh(&sctp_local_addr_lock);
+			spin_lock_bh(&net->sctp.local_addr_lock);
+			list_add_tail_rcu(&addr->list, &net->sctp.local_addr_list);
+			sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_NEW);
+			spin_unlock_bh(&net->sctp.local_addr_lock);
  		}
  		break;
  	case NETDEV_DOWN:
-		spin_lock_bh(&sctp_local_addr_lock);
+		spin_lock_bh(&net->sctp.local_addr_lock);
  		list_for_each_entry_safe(addr, temp,
-					&sctp_local_addr_list, list) {
+					&net->sctp.local_addr_list, list) {
  			if (addr->a.sa.sa_family = AF_INET6 &&
  					ipv6_addr_equal(&addr->a.v6.sin6_addr,
  						&ifa->addr)) {
-				sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
+				sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL);
  				found = 1;
  				addr->valid = 0;
  				list_del_rcu(&addr->list);
  				break;
  			}
  		}
-		spin_unlock_bh(&sctp_local_addr_lock);
+		spin_unlock_bh(&net->sctp.local_addr_lock);
  		if (found)
  			kfree_rcu(addr, rcu);
  		break;

net/sctp/protocol.c +81 -60

index 1f89c4e..291e682 100644
@@ -201,29 +201,29 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
  /* Extract our IP addresses from the system and stash them in the
   * protocol structure.
   */
-static void sctp_get_local_addr_list(void)
+static void sctp_get_local_addr_list(struct net *net)
  {
  	struct net_device *dev;
  	struct list_head *pos;
  	struct sctp_af *af;
 
  	rcu_read_lock();
-	for_each_netdev_rcu(&init_net, dev) {
+	for_each_netdev_rcu(net, dev) {
  		__list_for_each(pos, &sctp_address_families) {
  			af = list_entry(pos, struct sctp_af, list);
-			af->copy_addrlist(&sctp_local_addr_list, dev);
+			af->copy_addrlist(&net->sctp.local_addr_list, dev);
  		}
  	}
  	rcu_read_unlock();
  }
 
  /* Free the existing local addresses.  */
-static void sctp_free_local_addr_list(void)
+static void sctp_free_local_addr_list(struct net *net)
  {
  	struct sctp_sockaddr_entry *addr;
  	struct list_head *pos, *temp;
 
-	list_for_each_safe(pos, temp, &sctp_local_addr_list) {
+	list_for_each_safe(pos, temp, &net->sctp.local_addr_list) {
  		addr = list_entry(pos, struct sctp_sockaddr_entry, list);
  		list_del(pos);
  		kfree(addr);

@@ -231,14 +231,14 @@ static void sctp_free_local_addr_list(void)
  }
 
  /* Copy the local addresses which are valid for 'scope' into 'bp'.  */
-int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
-			      gfp_t gfp, int copy_flags)
+int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
+			      sctp_scope_t scope, gfp_t gfp, int copy_flags)
  {
  	struct sctp_sockaddr_entry *addr;
  	int error = 0;
 
  	rcu_read_lock();
-	list_for_each_entry_rcu(addr, &sctp_local_addr_list, list) {
+	list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
  		if (!addr->valid)
  			continue;
  		if (sctp_in_scope(&addr->a, scope)) {

@@ -627,14 +627,15 @@ static void sctp_v4_ecn_capable(struct sock *sk)
 
  void sctp_addr_wq_timeout_handler(unsigned long arg)
  {
+	struct net *net = (struct net *)arg;
  	struct sctp_sockaddr_entry *addrw, *temp;
  	struct sctp_sock *sp;
 
-	spin_lock_bh(&sctp_addr_wq_lock);
+	spin_lock_bh(&net->sctp.addr_wq_lock);
 
-	list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+	list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
  		SCTP_DEBUG_PRINTK_IPADDR("sctp_addrwq_timo_handler: the first ent in wq %p is ",
-		    " for cmd %d at entry %p\n", &sctp_addr_waitq, &addrw->a, addrw->state,
+		    " for cmd %d at entry %p\n", &net->sctp.addr_waitq, &addrw->a, addrw->state,
  		    addrw);
 
  #if IS_ENABLED(CONFIG_IPV6)

@@ -648,7 +649,7 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
  				goto free_next;
 
  			in6 = (struct in6_addr *)&addrw->a.v6.sin6_addr;
-			if (ipv6_chk_addr(&init_net, in6, NULL, 0) = 0 &&
+			if (ipv6_chk_addr(net, in6, NULL, 0) = 0 &&
  			    addrw->state = SCTP_ADDR_NEW) {
  				unsigned long timeo_val;
 

@@ -656,12 +657,12 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
  				    SCTP_ADDRESS_TICK_DELAY);
  				timeo_val = jiffies;
  				timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
-				mod_timer(&sctp_addr_wq_timer, timeo_val);
+				mod_timer(&net->sctp.addr_wq_timer, timeo_val);
  				break;
  			}
  		}
  #endif
-		list_for_each_entry(sp, &sctp_auto_asconf_splist, auto_asconf_list) {
+		list_for_each_entry(sp, &net->sctp.auto_asconf_splist, auto_asconf_list) {
  			struct sock *sk;
 
  			sk = sctp_opt2sk(sp);

@@ -679,31 +680,32 @@ free_next:
  		list_del(&addrw->list);
  		kfree(addrw);
  	}
-	spin_unlock_bh(&sctp_addr_wq_lock);
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
  }
 
-static void sctp_free_addr_wq(void)
+static void sctp_free_addr_wq(struct net *net)
  {
  	struct sctp_sockaddr_entry *addrw;
  	struct sctp_sockaddr_entry *temp;
 
-	spin_lock_bh(&sctp_addr_wq_lock);
-	del_timer(&sctp_addr_wq_timer);
-	list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+	spin_lock_bh(&net->sctp.addr_wq_lock);
+	del_timer(&net->sctp.addr_wq_timer);
+	list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
  		list_del(&addrw->list);
  		kfree(addrw);
  	}
-	spin_unlock_bh(&sctp_addr_wq_lock);
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
  }
 
  /* lookup the entry for the same address in the addr_waitq
   * sctp_addr_wq MUST be locked
   */
-static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct sctp_sockaddr_entry *addr)
+static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct net *net,
+					struct sctp_sockaddr_entry *addr)
  {
  	struct sctp_sockaddr_entry *addrw;
 
-	list_for_each_entry(addrw, &sctp_addr_waitq, list) {
+	list_for_each_entry(addrw, &net->sctp.addr_waitq, list) {
  		if (addrw->a.sa.sa_family != addr->a.sa.sa_family)
  			continue;
  		if (addrw->a.sa.sa_family = AF_INET) {

@@ -719,7 +721,7 @@ static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct sctp_sockaddr_entr
  	return NULL;
  }
 
-void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
+void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cmd)
  {
  	struct sctp_sockaddr_entry *addrw;
  	unsigned long timeo_val;

@@ -730,9 +732,9 @@ void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
  	 * new address after a couple of addition and deletion of that address
  	 */
 
-	spin_lock_bh(&sctp_addr_wq_lock);
+	spin_lock_bh(&net->sctp.addr_wq_lock);
  	/* Offsets existing events in addr_wq */
-	addrw = sctp_addr_wq_lookup(addr);
+	addrw = sctp_addr_wq_lookup(net, addr);
  	if (addrw) {
  		if (addrw->state != cmd) {
  			SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt offsets existing entry for %d ",

@@ -741,27 +743,27 @@ void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
  			list_del(&addrw->list);
  			kfree(addrw);
  		}
-		spin_unlock_bh(&sctp_addr_wq_lock);
+		spin_unlock_bh(&net->sctp.addr_wq_lock);
  		return;
  	}
 
  	/* OK, we have to add the new address to the wait queue */
  	addrw = kmemdup(addr, sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
  	if (addrw = NULL) {
-		spin_unlock_bh(&sctp_addr_wq_lock);
+		spin_unlock_bh(&net->sctp.addr_wq_lock);
  		return;
  	}
  	addrw->state = cmd;
-	list_add_tail(&addrw->list, &sctp_addr_waitq);
+	list_add_tail(&addrw->list, &net->sctp.addr_waitq);
  	SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt add new entry for cmd:%d ",
-	    " in wq %p\n", addrw->state, &addrw->a, &sctp_addr_waitq);
+	    " in wq %p\n", addrw->state, &addrw->a, &net->sctp.addr_waitq);
 
-	if (!timer_pending(&sctp_addr_wq_timer)) {
+	if (!timer_pending(&net->sctp.addr_wq_timer)) {
  		timeo_val = jiffies;
  		timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
-		mod_timer(&sctp_addr_wq_timer, timeo_val);
+		mod_timer(&net->sctp.addr_wq_timer, timeo_val);
  	}
-	spin_unlock_bh(&sctp_addr_wq_lock);
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
  }
 
  /* Event handler for inet address addition/deletion events.

@@ -776,11 +778,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
  	struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
  	struct sctp_sockaddr_entry *addr = NULL;
  	struct sctp_sockaddr_entry *temp;
+	struct net *net = dev_net(ifa->ifa_dev->dev);
  	int found = 0;
 
-	if (!net_eq(dev_net(ifa->ifa_dev->dev), &init_net))
-		return NOTIFY_DONE;
-
  	switch (ev) {
  	case NETDEV_UP:
  		addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);

@@ -789,27 +789,27 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
  			addr->a.v4.sin_port = 0;
  			addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
  			addr->valid = 1;
-			spin_lock_bh(&sctp_local_addr_lock);
-			list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
-			sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
-			spin_unlock_bh(&sctp_local_addr_lock);
+			spin_lock_bh(&net->sctp.local_addr_lock);
+			list_add_tail_rcu(&addr->list, &net->sctp.local_addr_list);
+			sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_NEW);
+			spin_unlock_bh(&net->sctp.local_addr_lock);
  		}
  		break;
  	case NETDEV_DOWN:
-		spin_lock_bh(&sctp_local_addr_lock);
+		spin_lock_bh(&net->sctp.local_addr_lock);
  		list_for_each_entry_safe(addr, temp,
-					&sctp_local_addr_list, list) {
+					&net->sctp.local_addr_list, list) {
  			if (addr->a.sa.sa_family = AF_INET &&
  					addr->a.v4.sin_addr.s_addr =
  					ifa->ifa_local) {
-				sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
+				sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL);
  				found = 1;
  				addr->valid = 0;
  				list_del_rcu(&addr->list);
  				break;
  			}
  		}
-		spin_unlock_bh(&sctp_local_addr_lock);
+		spin_unlock_bh(&net->sctp.local_addr_lock);
  		if (found)
  			kfree_rcu(addr, rcu);
  		break;

@@ -1194,6 +1194,36 @@ static void sctp_v4_del_protocol(void)
  	unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
  }
 
+static int sctp_net_init(struct net *net)
+{
+	/* Initialize the local address list. */
+	INIT_LIST_HEAD(&net->sctp.local_addr_list);
+	spin_lock_init(&net->sctp.local_addr_lock);
+	sctp_get_local_addr_list(net);
+
+	/* Initialize the address event list */
+	INIT_LIST_HEAD(&net->sctp.addr_waitq);
+	INIT_LIST_HEAD(&net->sctp.auto_asconf_splist);
+	spin_lock_init(&net->sctp.addr_wq_lock);
+	net->sctp.addr_wq_timer.expires = 0;
+	setup_timer(&net->sctp.addr_wq_timer, sctp_addr_wq_timeout_handler,
+		    (unsigned long)net);
+
+	return 0;
+}
+
+static void sctp_net_exit(struct net *net)
+{
+	/* Free the local address list */
+	sctp_free_addr_wq(net);
+	sctp_free_local_addr_list(net);
+}
+
+static struct pernet_operations sctp_net_ops = {
+	.init = sctp_net_init,
+	.exit = sctp_net_exit,
+};
+
  /* Initialize the universe into something sensible.  */
  SCTP_STATIC __init int sctp_init(void)
  {

@@ -1399,18 +1429,6 @@ SCTP_STATIC __init int sctp_init(void)
  	sctp_v4_pf_init();
  	sctp_v6_pf_init();
 
-	/* Initialize the local address list. */
-	INIT_LIST_HEAD(&sctp_local_addr_list);
-	spin_lock_init(&sctp_local_addr_lock);
-	sctp_get_local_addr_list();
-
-	/* Initialize the address event list */
-	INIT_LIST_HEAD(&sctp_addr_waitq);
-	INIT_LIST_HEAD(&sctp_auto_asconf_splist);
-	spin_lock_init(&sctp_addr_wq_lock);
-	sctp_addr_wq_timer.expires = 0;
-	setup_timer(&sctp_addr_wq_timer, sctp_addr_wq_timeout_handler, 0);
-
  	status = sctp_v4_protosw_init();
 
  	if (status)

@@ -1426,6 +1444,10 @@ SCTP_STATIC __init int sctp_init(void)
  		goto err_ctl_sock_init;
  	}
 
+	status = register_pernet_subsys(&sctp_net_ops);
+	if (status)
+		goto err_register_pernet_subsys;
+
  	status = sctp_v4_add_protocol();
  	if (status)
  		goto err_add_protocol;

@@ -1441,13 +1463,14 @@ out:
  err_v6_add_protocol:
  	sctp_v4_del_protocol();
  err_add_protocol:
+	unregister_pernet_subsys(&sctp_net_ops);
+err_register_pernet_subsys:
  	inet_ctl_sock_destroy(sctp_ctl_sock);
  err_ctl_sock_init:
  	sctp_v6_protosw_exit();
  err_v6_protosw_init:
  	sctp_v4_protosw_exit();
  err_protosw_init:
-	sctp_free_local_addr_list();
  	sctp_v4_pf_exit();
  	sctp_v6_pf_exit();
  	sctp_sysctl_unregister();

@@ -1482,18 +1505,16 @@ SCTP_STATIC __exit void sctp_exit(void)
  	/* Unregister with inet6/inet layers. */
  	sctp_v6_del_protocol();
  	sctp_v4_del_protocol();
-	sctp_free_addr_wq();
 
  	/* Free the control endpoint.  */
  	inet_ctl_sock_destroy(sctp_ctl_sock);
 
+	unregister_pernet_subsys(&sctp_net_ops);
+
  	/* Free protosw registrations */
  	sctp_v6_protosw_exit();
  	sctp_v4_protosw_exit();
 
-	/* Free the local address list.  */
-	sctp_free_local_addr_list();
-
  	/* Unregister with socket layer. */
  	sctp_v6_pf_exit();
  	sctp_v4_pf_exit();

net/sctp/socket.c +4 -3

index 4316b0f..5b6dd0e 100644
@@ -3471,7 +3471,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
  		sp->do_auto_asconf = 0;
  	} else if (val && !sp->do_auto_asconf) {
  		list_add_tail(&sp->auto_asconf_list,
-		    &sctp_auto_asconf_splist);
+		    &sock_net(sk)->sctp.auto_asconf_splist);
  		sp->do_auto_asconf = 1;
  	}
  	return 0;

@@ -3964,7 +3964,7 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
  	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
  	if (sctp_default_auto_asconf) {
  		list_add_tail(&sp->auto_asconf_list,
-		    &sctp_auto_asconf_splist);
+		    &sock_net(sk)->sctp.auto_asconf_splist);
  		sp->do_auto_asconf = 1;
  	} else
  		sp->do_auto_asconf = 0;

@@ -4653,9 +4653,10 @@ static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
  	union sctp_addr temp;
  	int cnt = 0;
  	int addrlen;
+	struct net *net = sock_net(sk);
 
  	rcu_read_lock();
-	list_for_each_entry_rcu(addr, &sctp_local_addr_list, list) {
+	list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
  		if (!addr->valid)
  			continue;
 

- Kill sctp_get_ctl_sock, it is useless now.
- Pass struct net where needed so net->sctp.ctl_sock is accessible.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/netns/sctp.h |    8 +++++++
  include/net/sctp/sctp.h  |    1 -
  net/sctp/input.c         |    4 +-
  net/sctp/protocol.c      |   47 ++++++++++++++++++---------------------------
  net/sctp/sm_statefuns.c  |   45 ++++++++++++++++++++++++++++++-------------
  5 files changed, 60 insertions(+), 45 deletions(-)

include/net/netns/sctp.h +8 -0

index cbd684e..29e36b4 100644
@@ -1,7 +1,15 @@
  #ifndef __NETNS_SCTP_H__
  #define __NETNS_SCTP_H__
 
+struct sock;
+
  struct netns_sctp {
+	/* This is the global socket data structure used for responding to
+	 * the Out-of-the-blue (OOTB) packets.  A control sock will be created
+	 * for this socket at the initialization time.
+	 */
+	struct sock *ctl_sock;
+
  	/* This is the global local address list.
  	 * We actively maintain this complete list of addresses on
  	 * the system by catching address add/delete events.

include/net/sctp/sctp.h +0 -1

index 00c9205..550a81b 100644
@@ -114,7 +114,6 @@
  /*
   * sctp/protocol.c
   */
-extern struct sock *sctp_get_ctl_sock(void);
  extern int sctp_copy_local_addr_list(struct net *, struct sctp_bind_addr *,
  				     sctp_scope_t, gfp_t gfp,
  				     int flags);

net/sctp/input.c +2 -2

index a7e9a85..c9a0449 100644
@@ -204,7 +204,7 @@ int sctp_rcv(struct sk_buff *skb)
  			sctp_endpoint_put(ep);
  			ep = NULL;
  		}
-		sk = sctp_get_ctl_sock();
+		sk = net->sctp.ctl_sock;
  		ep = sctp_sk(sk)->ep;
  		sctp_endpoint_hold(ep);
  		rcvr = &ep->base;

@@ -795,7 +795,7 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
  			goto hit;
  	}
 
-	ep = sctp_sk((sctp_get_ctl_sock()))->ep;
+	ep = sctp_sk(net->sctp.ctl_sock)->ep;
 
  hit:
  	sctp_endpoint_hold(ep);

net/sctp/protocol.c +19 -28

index 291e682..6193d20 100644
@@ -78,12 +78,6 @@ struct proc_dir_entry	*proc_net_sctp;
  struct idr sctp_assocs_id;
  DEFINE_SPINLOCK(sctp_assocs_id_lock);
 
-/* This is the global socket data structure used for responding to
- * the Out-of-the-blue (OOTB) packets.  A control sock will be created
- * for this socket at the initialization time.
- */
-static struct sock *sctp_ctl_sock;
-
  static struct sctp_pf *sctp_pf_inet6_specific;
  static struct sctp_pf *sctp_pf_inet_specific;
  static struct sctp_af *sctp_af_v4_specific;

@@ -96,12 +90,6 @@ long sysctl_sctp_mem[3];
  int sysctl_sctp_rmem[3];
  int sysctl_sctp_wmem[3];
 
-/* Return the address of the control sock. */
-struct sock *sctp_get_ctl_sock(void)
-{
-	return sctp_ctl_sock;
-}
-
  /* Set up the proc fs entry for the SCTP protocol. */
  static __init int sctp_proc_init(void)
  {

@@ -822,7 +810,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
   * Initialize the control inode/socket with a control endpoint data
   * structure.  This endpoint is reserved exclusively for the OOTB processing.
   */
-static int sctp_ctl_sock_init(void)
+static int sctp_ctl_sock_init(struct net *net)
  {
  	int err;
  	sa_family_t family = PF_INET;

@@ -830,14 +818,14 @@ static int sctp_ctl_sock_init(void)
  	if (sctp_get_pf_specific(PF_INET6))
  		family = PF_INET6;
 
-	err = inet_ctl_sock_create(&sctp_ctl_sock, family,
-				   SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
+	err = inet_ctl_sock_create(&net->sctp.ctl_sock, family,
+				   SOCK_SEQPACKET, IPPROTO_SCTP, net);
 
  	/* If IPv6 socket could not be created, try the IPv4 socket */
  	if (err < 0 && family = PF_INET6)
-		err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
+		err = inet_ctl_sock_create(&net->sctp.ctl_sock, AF_INET,
  					   SOCK_SEQPACKET, IPPROTO_SCTP,
-					   &init_net);
+					   net);
 
  	if (err < 0) {
  		pr_err("Failed to create the SCTP control socket\n");

@@ -1196,6 +1184,14 @@ static void sctp_v4_del_protocol(void)
 
  static int sctp_net_init(struct net *net)
  {
+	int status;
+
+	/* Initialize the control inode/socket for handling OOTB packets.  */
+	if ((status = sctp_ctl_sock_init(net))) {
+		pr_err("Failed to initialize the SCTP control sock\n");
+		goto err_ctl_sock_init;
+	}
+
  	/* Initialize the local address list. */
  	INIT_LIST_HEAD(&net->sctp.local_addr_list);
  	spin_lock_init(&net->sctp.local_addr_lock);

@@ -1210,6 +1206,9 @@ static int sctp_net_init(struct net *net)
  		    (unsigned long)net);
 
  	return 0;
+
+err_ctl_sock_init:
+	return status;
  }
 
  static void sctp_net_exit(struct net *net)

@@ -1217,6 +1216,9 @@ static void sctp_net_exit(struct net *net)
  	/* Free the local address list */
  	sctp_free_addr_wq(net);
  	sctp_free_local_addr_list(net);
+
+	/* Free the control endpoint.  */
+	inet_ctl_sock_destroy(net->sctp.ctl_sock);
  }
 
  static struct pernet_operations sctp_net_ops = {

@@ -1438,12 +1440,6 @@ SCTP_STATIC __init int sctp_init(void)
  	if (status)
  		goto err_v6_protosw_init;
 
-	/* Initialize the control inode/socket for handling OOTB packets.  */
-	if ((status = sctp_ctl_sock_init())) {
-		pr_err("Failed to initialize the SCTP control sock\n");
-		goto err_ctl_sock_init;
-	}
-
  	status = register_pernet_subsys(&sctp_net_ops);
  	if (status)
  		goto err_register_pernet_subsys;

@@ -1465,8 +1461,6 @@ err_v6_add_protocol:
  err_add_protocol:
  	unregister_pernet_subsys(&sctp_net_ops);
  err_register_pernet_subsys:
-	inet_ctl_sock_destroy(sctp_ctl_sock);
-err_ctl_sock_init:
  	sctp_v6_protosw_exit();
  err_v6_protosw_init:
  	sctp_v4_protosw_exit();

@@ -1506,9 +1500,6 @@ SCTP_STATIC __exit void sctp_exit(void)
  	sctp_v6_del_protocol();
  	sctp_v4_del_protocol();
 
-	/* Free the control endpoint.  */
-	inet_ctl_sock_destroy(sctp_ctl_sock);
-
  	unregister_pernet_subsys(&sctp_net_ops);
 
  	/* Free protosw registrations */

net/sctp/sm_statefuns.c +31 -14

index 9fca103..f2daf61 100644
@@ -74,7 +74,8 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  static int sctp_eat_data(const struct sctp_association *asoc,
  			 struct sctp_chunk *chunk,
  			 sctp_cmd_seq_t *commands);
-static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
+static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
+					     const struct sctp_association *asoc,
  					     const struct sctp_chunk *chunk);
  static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  				       const struct sctp_association *asoc,

@@ -301,6 +302,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
  	struct sctp_chunk *err_chunk;
  	struct sctp_packet *packet;
  	sctp_unrecognized_param_t *unk_param;
+	struct net *net;
  	int len;
 
  	/* 6.10 Bundling

@@ -318,7 +320,8 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
  	/* If the packet is an OOTB packet which is temporarily on the
  	 * control endpoint, respond with an ABORT.
  	 */
-	if (ep = sctp_sk((sctp_get_ctl_sock()))->ep) {
+	net = sock_net(ep->base.sk);
+	if (ep = sctp_sk(net->sctp.ctl_sock)->ep) {
  		SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  		return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  	}

@@ -646,11 +649,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
  	int error = 0;
  	struct sctp_chunk *err_chk_p;
  	struct sock *sk;
+	struct net *net;
 
  	/* If the packet is an OOTB packet which is temporarily on the
  	 * control endpoint, respond with an ABORT.
  	 */
-	if (ep = sctp_sk((sctp_get_ctl_sock()))->ep) {
+	net = sock_net(ep->base.sk);
+	if (ep = sctp_sk(net->sctp.ctl_sock)->ep) {
  		SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  		return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  	}

@@ -1171,7 +1176,7 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
  /* Helper function to send out an abort for the restart
   * condition.
   */
-static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
+static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
  				      struct sctp_chunk *init,
  				      sctp_cmd_seq_t *commands)
  {

@@ -1197,7 +1202,7 @@ static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
  	errhdr->length = htons(len);
 
  	/* Assign to the control socket. */
-	ep = sctp_sk((sctp_get_ctl_sock()))->ep;
+	ep = sctp_sk(net->sctp.ctl_sock)->ep;
 
  	/* Association is NULL since this may be a restart attack and we
  	 * want to send back the attacker's vtag.

@@ -1240,6 +1245,7 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
  				       struct sctp_chunk *init,
  				       sctp_cmd_seq_t *commands)
  {
+	struct net *net = sock_net(new_asoc->base.sk);
  	struct sctp_transport *new_addr;
  	int ret = 1;
 

@@ -1258,7 +1264,7 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
  			    transports) {
  		if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
  					&new_addr->ipaddr)) {
-			sctp_sf_send_restart_abort(&new_addr->ipaddr, init,
+			sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
  						   commands);
  			ret = 0;
  			break;

@@ -1650,10 +1656,11 @@ sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
  					    const sctp_subtype_t type,
  					    void *arg, sctp_cmd_seq_t *commands)
  {
+	struct net *net = sock_net(ep->base.sk);
  	/* Per the above section, we'll discard the chunk if we have an
  	 * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
  	 */
-	if (ep = sctp_sk((sctp_get_ctl_sock()))->ep)
+	if (ep = sctp_sk(net->sctp.ctl_sock)->ep)
  		return sctp_sf_ootb(ep, asoc, type, arg, commands);
  	else
  		return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);

@@ -3163,8 +3170,10 @@ static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  	struct sctp_packet *packet = NULL;
  	struct sctp_chunk *chunk = arg;
  	struct sctp_chunk *abort;
+	struct net *net;
 
-	packet = sctp_ootb_pkt_new(asoc, chunk);
+	net = sock_net(ep->base.sk);
+	packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
  	if (packet) {
  		/* Make an ABORT. The T bit will be set if the asoc

@@ -3425,8 +3434,10 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  	struct sctp_packet *packet = NULL;
  	struct sctp_chunk *chunk = arg;
  	struct sctp_chunk *shut;
+	struct net *net;
 
-	packet = sctp_ootb_pkt_new(asoc, chunk);
+	net = sock_net(ep->base.sk);
+	packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
  	if (packet) {
  		/* Make an SHUTDOWN_COMPLETE.

@@ -4262,6 +4273,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
  	struct sctp_packet *packet = NULL;
  	struct sctp_chunk *chunk =  arg;
  	struct sctp_chunk *abort = NULL;
+	struct net *net;
 
  	/* SCTP-AUTH, Section 6.3:
  	 *    It should be noted that if the receiver wants to tear

@@ -4282,6 +4294,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
  	if (!abort)
  		goto nomem;
 
+	net = sock_net(ep->base.sk);
  	if (asoc) {
  		/* Treat INIT-ACK as a special case during COOKIE-WAIT. */
  		if (chunk->chunk_hdr->type = SCTP_CID_INIT_ACK &&

@@ -4319,7 +4332,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
  			SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  		}
  	} else {
-		packet = sctp_ootb_pkt_new(asoc, chunk);
+		packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
  		if (!packet)
  			goto nomem_pkt;

@@ -5825,8 +5838,10 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  {
  	struct sctp_packet *packet;
  	struct sctp_chunk *abort;
+	struct net *net;
 
-	packet = sctp_ootb_pkt_new(asoc, chunk);
+	net = sock_net(ep->base.sk);
+	packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
  	if (packet) {
  		/* Make an ABORT.

@@ -5858,7 +5873,8 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  }
 
  /* Allocate a packet for responding in the OOTB conditions.  */
-static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
+static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
+					     const struct sctp_association *asoc,
  					     const struct sctp_chunk *chunk)
  {
  	struct sctp_packet *packet;

@@ -5919,7 +5935,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc
  	 * the source address.
  	 */
  	sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
-			     sctp_sk(sctp_get_ctl_sock()));
+			     sctp_sk(net->sctp.ctl_sock));
 
  	packet = sctp_packet_init(&transport->packet, transport, sport, dport);
  	packet = sctp_packet_config(packet, vtag, 0);

@@ -5946,7 +5962,8 @@ static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  	struct sctp_packet *packet;
 
  	if (err_chunk) {
-		packet = sctp_ootb_pkt_new(asoc, chunk);
+		struct net *net = sock_net(ep->base.sk);
+		packet = sctp_ootb_pkt_new(net, asoc, chunk);
  		if (packet) {
  			struct sctp_signed_cookie *cookie;
 

The percpu sctp socket counter has nothing at all to do with the sctp proc files, and having it in the wrong initialization is confusing, and makes network namespace support a pain.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  net/sctp/protocol.c |   13 +++++++------
  1 files changed, 7 insertions(+), 6 deletions(-)

net/sctp/protocol.c +7 -6

index 6193d20..976d765 100644
@@ -93,8 +93,6 @@ int sysctl_sctp_wmem[3];
  /* Set up the proc fs entry for the SCTP protocol. */
  static __init int sctp_proc_init(void)
  {
-	if (percpu_counter_init(&sctp_sockets_allocated, 0))
-		goto out_nomem;
  #ifdef CONFIG_PROC_FS
  	if (!proc_net_sctp) {
  		proc_net_sctp = proc_mkdir("sctp", init_net.proc_net);

@@ -125,12 +123,9 @@ out_snmp_proc_init:
  		remove_proc_entry("sctp", init_net.proc_net);
  	}
  out_free_percpu:
-	percpu_counter_destroy(&sctp_sockets_allocated);
  #else
  	return 0;
  #endif /* CONFIG_PROC_FS */
-
-out_nomem:
  	return -ENOMEM;
  }
 

@@ -151,7 +146,6 @@ static void sctp_proc_exit(void)
  		remove_proc_entry("sctp", init_net.proc_net);
  	}
  #endif
-	percpu_counter_destroy(&sctp_sockets_allocated);
  }
 
  /* Private helper to extract ipv4 address and stash them in

@@ -1261,6 +1255,10 @@ SCTP_STATIC __init int sctp_init(void)
  	if (status)
  		goto err_init_mibs;
 
+	status = percpu_counter_init(&sctp_sockets_allocated, 0);
+	if (status)
+		goto err_percpu_counter_init;
+
  	/* Initialize proc fs directory.  */
  	status = sctp_proc_init();
  	if (status)

@@ -1481,6 +1479,8 @@ err_ahash_alloc:
  	sctp_dbg_objcnt_exit();
  	sctp_proc_exit();
  err_init_proc:
+	percpu_counter_destroy(&sctp_sockets_allocated);
+err_percpu_counter_init:
  	cleanup_sctp_mibs();
  err_init_mibs:
  	kmem_cache_destroy(sctp_chunk_cachep);

@@ -1521,6 +1521,7 @@ SCTP_STATIC __exit void sctp_exit(void)
  			     sizeof(struct sctp_bind_hashbucket)));
 
  	sctp_dbg_objcnt_exit();
+	percpu_counter_destroy(&sctp_sockets_allocated);
  	sctp_proc_exit();
  	cleanup_sctp_mibs();
 

- Convert all of the files under /proc/net/sctp to be per network namespace.

- Don't print anything for /proc/net/sctp/snmp except in the initial network namespaces as the snmp counters still have to be converted to be per network namespace.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  include/net/netns/sctp.h |    5 +++
  include/net/sctp/sctp.h  |   16 +++++-----
  net/sctp/proc.c          |   59 +++++++++++++++++++++++------------
  net/sctp/protocol.c      |   77 +++++++++++++++++++--------------------------
  4 files changed, 85 insertions(+), 72 deletions(-)

include/net/netns/sctp.h +5 -0

index 29e36b4..9c20a82 100644
@@ -2,8 +2,13 @@
  #define __NETNS_SCTP_H__
 
  struct sock;
+struct proc_dir_entry;
 
  struct netns_sctp {
+#ifdef CONFIG_PROC_FS
+	struct proc_dir_entry *proc_net_sctp;
+#endif
+
  	/* This is the global socket data structure used for responding to
  	 * the Out-of-the-blue (OOTB) packets.  A control sock will be created
  	 * for this socket at the initialization time.

include/net/sctp/sctp.h +8 -8

index 550a81b..ca716da 100644
@@ -172,14 +172,14 @@ void sctp_backlog_migrate(struct sctp_association *assoc,
  /*
   * sctp/proc.c
   */
-int sctp_snmp_proc_init(void);
-void sctp_snmp_proc_exit(void);
-int sctp_eps_proc_init(void);
-void sctp_eps_proc_exit(void);
-int sctp_assocs_proc_init(void);
-void sctp_assocs_proc_exit(void);
-int sctp_remaddr_proc_init(void);
-void sctp_remaddr_proc_exit(void);
+int sctp_snmp_proc_init(struct net *net);
+void sctp_snmp_proc_exit(struct net *net);
+int sctp_eps_proc_init(struct net *net);
+void sctp_eps_proc_exit(struct net *net);
+int sctp_assocs_proc_init(struct net *net);
+void sctp_assocs_proc_exit(struct net *net);
+int sctp_remaddr_proc_init(struct net *net);
+void sctp_remaddr_proc_exit(struct net *net);
 
 
  /*

net/sctp/proc.c +39 -20

index 1e2eee8..dc79a3a 100644
@@ -80,8 +80,12 @@ static const struct snmp_mib sctp_snmp_list[] = {
  /* Display sctp snmp mib statistics(/proc/net/sctp/snmp). */
  static int sctp_snmp_seq_show(struct seq_file *seq, void *v)
  {
+	struct net *net = seq->private;
  	int i;
 
+	if (!net_eq(net, &init_net))
+		return 0;
+
  	for (i = 0; sctp_snmp_list[i].name != NULL; i++)
  		seq_printf(seq, "%-32s\t%ld\n", sctp_snmp_list[i].name,
  			   snmp_fold_field((void __percpu **)sctp_statistics,

@@ -93,7 +97,7 @@ static int sctp_snmp_seq_show(struct seq_file *seq, void *v)
  /* Initialize the seq file operations for 'snmp' object. */
  static int sctp_snmp_seq_open(struct inode *inode, struct file *file)
  {
-	return single_open(file, sctp_snmp_seq_show, NULL);
+	return single_open_net(inode, file, sctp_snmp_seq_show);
  }
 
  static const struct file_operations sctp_snmp_seq_fops = {

@@ -105,11 +109,12 @@ static const struct file_operations sctp_snmp_seq_fops = {
  };
 
  /* Set up the proc fs entry for 'snmp' object. */
-int __init sctp_snmp_proc_init(void)
+int __net_init sctp_snmp_proc_init(struct net *net)
  {
  	struct proc_dir_entry *p;
 
-	p = proc_create("snmp", S_IRUGO, proc_net_sctp, &sctp_snmp_seq_fops);
+	p = proc_create("snmp", S_IRUGO, net->sctp.proc_net_sctp,
+			&sctp_snmp_seq_fops);
  	if (!p)
  		return -ENOMEM;
 

@@ -117,9 +122,9 @@ int __init sctp_snmp_proc_init(void)
  }
 
  /* Cleanup the proc fs entry for 'snmp' object. */
-void sctp_snmp_proc_exit(void)
+void sctp_snmp_proc_exit(struct net *net)
  {
-	remove_proc_entry("snmp", proc_net_sctp);
+	remove_proc_entry("snmp", net->sctp.proc_net_sctp);
  }
 
  /* Dump local addresses of an association/endpoint. */

@@ -197,6 +202,7 @@ static void * sctp_eps_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  /* Display sctp endpoints (/proc/net/sctp/eps). */
  static int sctp_eps_seq_show(struct seq_file *seq, void *v)
  {
+	struct seq_net_private *priv = seq->private;
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;
  	struct sctp_endpoint *ep;

@@ -213,6 +219,8 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
  	sctp_for_each_hentry(epb, node, &head->chain) {
  		ep = sctp_ep(epb);
  		sk = epb->sk;
+		if (!net_eq(sock_net(sk), priv->net))
+			continue;
  		seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
  			   sctp_sk(sk)->type, sk->sk_state, hash,
  			   epb->bind_addr.port,

@@ -238,7 +246,8 @@ static const struct seq_operations sctp_eps_ops = {
  /* Initialize the seq file operations for 'eps' object. */
  static int sctp_eps_seq_open(struct inode *inode, struct file *file)
  {
-	return seq_open(file, &sctp_eps_ops);
+	return seq_open_net(inode, file, &sctp_eps_ops,
+			    sizeof(struct seq_net_private));
  }
 
  static const struct file_operations sctp_eps_seq_fops = {

@@ -249,11 +258,12 @@ static const struct file_operations sctp_eps_seq_fops = {
  };
 
  /* Set up the proc fs entry for 'eps' object. */
-int __init sctp_eps_proc_init(void)
+int __net_init sctp_eps_proc_init(struct net *net)
  {
  	struct proc_dir_entry *p;
 
-	p = proc_create("eps", S_IRUGO, proc_net_sctp, &sctp_eps_seq_fops);
+	p = proc_create("eps", S_IRUGO, net->sctp.proc_net_sctp,
+			&sctp_eps_seq_fops);
  	if (!p)
  		return -ENOMEM;
 

@@ -261,9 +271,9 @@ int __init sctp_eps_proc_init(void)
  }
 
  /* Cleanup the proc fs entry for 'eps' object. */
-void sctp_eps_proc_exit(void)
+void sctp_eps_proc_exit(struct net *net)
  {
-	remove_proc_entry("eps", proc_net_sctp);
+	remove_proc_entry("eps", net->sctp.proc_net_sctp);
  }
 
 

@@ -300,6 +310,7 @@ static void * sctp_assocs_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  /* Display sctp associations (/proc/net/sctp/assocs). */
  static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
  {
+	struct seq_net_private *priv = seq->private;
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;
  	struct sctp_association *assoc;

@@ -316,6 +327,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
  	sctp_for_each_hentry(epb, node, &head->chain) {
  		assoc = sctp_assoc(epb);
  		sk = epb->sk;
+		if (!net_eq(sock_net(sk), priv->net))
+			continue;
  		seq_printf(seq,
  			   "%8pK %8pK %-3d %-3d %-2d %-4d "
  			   "%4d %8d %8d %7d %5lu %-5d %5d ",

@@ -354,7 +367,8 @@ static const struct seq_operations sctp_assoc_ops = {
  /* Initialize the seq file operations for 'assocs' object. */
  static int sctp_assocs_seq_open(struct inode *inode, struct file *file)
  {
-	return seq_open(file, &sctp_assoc_ops);
+	return seq_open_net(inode, file, &sctp_assoc_ops,
+			    sizeof(struct seq_net_private));
  }
 
  static const struct file_operations sctp_assocs_seq_fops = {

@@ -365,11 +379,11 @@ static const struct file_operations sctp_assocs_seq_fops = {
  };
 
  /* Set up the proc fs entry for 'assocs' object. */
-int __init sctp_assocs_proc_init(void)
+int __net_init sctp_assocs_proc_init(struct net *net)
  {
  	struct proc_dir_entry *p;
 
-	p = proc_create("assocs", S_IRUGO, proc_net_sctp,
+	p = proc_create("assocs", S_IRUGO, net->sctp.proc_net_sctp,
  			&sctp_assocs_seq_fops);
  	if (!p)
  		return -ENOMEM;

@@ -378,9 +392,9 @@ int __init sctp_assocs_proc_init(void)
  }
 
  /* Cleanup the proc fs entry for 'assocs' object. */
-void sctp_assocs_proc_exit(void)
+void sctp_assocs_proc_exit(struct net *net)
  {
-	remove_proc_entry("assocs", proc_net_sctp);
+	remove_proc_entry("assocs", net->sctp.proc_net_sctp);
  }
 
  static void *sctp_remaddr_seq_start(struct seq_file *seq, loff_t *pos)

@@ -412,6 +426,7 @@ static void sctp_remaddr_seq_stop(struct seq_file *seq, void *v)
 
  static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
  {
+	struct seq_net_private *priv = seq->private;
  	struct sctp_hashbucket *head;
  	struct sctp_ep_common *epb;
  	struct sctp_association *assoc;

@@ -426,6 +441,8 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
  	sctp_local_bh_disable();
  	read_lock(&head->lock);
  	sctp_for_each_hentry(epb, node, &head->chain) {
+		if (!net_eq(sock_net(epb->sk), priv->net))
+			continue;
  		assoc = sctp_assoc(epb);
  		list_for_each_entry(tsp, &assoc->peer.transport_addr_list,
  					transports) {

@@ -489,14 +506,15 @@ static const struct seq_operations sctp_remaddr_ops = {
  };
 
  /* Cleanup the proc fs entry for 'remaddr' object. */
-void sctp_remaddr_proc_exit(void)
+void sctp_remaddr_proc_exit(struct net *net)
  {
-	remove_proc_entry("remaddr", proc_net_sctp);
+	remove_proc_entry("remaddr", net->sctp.proc_net_sctp);
  }
 
  static int sctp_remaddr_seq_open(struct inode *inode, struct file *file)
  {
-	return seq_open(file, &sctp_remaddr_ops);
+	return seq_open_net(inode, file, &sctp_remaddr_ops,
+			    sizeof(struct seq_net_private));
  }
 
  static const struct file_operations sctp_remaddr_seq_fops = {

@@ -506,11 +524,12 @@ static const struct file_operations sctp_remaddr_seq_fops = {
  	.release = seq_release,
  };
 
-int __init sctp_remaddr_proc_init(void)
+int __net_init sctp_remaddr_proc_init(struct net *net)
  {
  	struct proc_dir_entry *p;
 
-	p = proc_create("remaddr", S_IRUGO, proc_net_sctp, &sctp_remaddr_seq_fops);
+	p = proc_create("remaddr", S_IRUGO, net->sctp.proc_net_sctp,
+			&sctp_remaddr_seq_fops);
  	if (!p)
  		return -ENOMEM;
  	return 0;

net/sctp/protocol.c +33 -44

index 976d765..72b3aa7 100644
@@ -71,10 +71,6 @@
  struct sctp_globals sctp_globals __read_mostly;
  DEFINE_SNMP_STAT(struct sctp_mib, sctp_statistics) __read_mostly;
 
-#ifdef CONFIG_PROC_FS
-struct proc_dir_entry	*proc_net_sctp;
-#endif
-
  struct idr sctp_assocs_id;
  DEFINE_SPINLOCK(sctp_assocs_id_lock);
 

@@ -91,60 +87,52 @@ int sysctl_sctp_rmem[3];
  int sysctl_sctp_wmem[3];
 
  /* Set up the proc fs entry for the SCTP protocol. */
-static __init int sctp_proc_init(void)
+static __net_init int sctp_proc_init(struct net *net)
  {
  #ifdef CONFIG_PROC_FS
-	if (!proc_net_sctp) {
-		proc_net_sctp = proc_mkdir("sctp", init_net.proc_net);
-		if (!proc_net_sctp)
-			goto out_free_percpu;
-	}
-
-	if (sctp_snmp_proc_init())
+	net->sctp.proc_net_sctp = proc_net_mkdir(net, "sctp", net->proc_net);
+	if (!net->sctp.proc_net_sctp)
+		goto out_proc_net_sctp;
+	if (sctp_snmp_proc_init(net))
  		goto out_snmp_proc_init;
-	if (sctp_eps_proc_init())
+	if (sctp_eps_proc_init(net))
  		goto out_eps_proc_init;
-	if (sctp_assocs_proc_init())
+	if (sctp_assocs_proc_init(net))
  		goto out_assocs_proc_init;
-	if (sctp_remaddr_proc_init())
+	if (sctp_remaddr_proc_init(net))
  		goto out_remaddr_proc_init;
 
  	return 0;
 
  out_remaddr_proc_init:
-	sctp_assocs_proc_exit();
+	sctp_assocs_proc_exit(net);
  out_assocs_proc_init:
-	sctp_eps_proc_exit();
+	sctp_eps_proc_exit(net);
  out_eps_proc_init:
-	sctp_snmp_proc_exit();
+	sctp_snmp_proc_exit(net);
  out_snmp_proc_init:
-	if (proc_net_sctp) {
-		proc_net_sctp = NULL;
-		remove_proc_entry("sctp", init_net.proc_net);
-	}
-out_free_percpu:
-#else
-	return 0;
-#endif /* CONFIG_PROC_FS */
+	remove_proc_entry("sctp", net->proc_net);
+	net->sctp.proc_net_sctp = NULL;
+out_proc_net_sctp:
  	return -ENOMEM;
+#endif /* CONFIG_PROC_FS */
+	return 0;
  }
 
  /* Clean up the proc fs entry for the SCTP protocol.
   * Note: Do not make this __exit as it is used in the init error
   * path.
   */
-static void sctp_proc_exit(void)
+static void sctp_proc_exit(struct net *net)
  {
  #ifdef CONFIG_PROC_FS
-	sctp_snmp_proc_exit();
-	sctp_eps_proc_exit();
-	sctp_assocs_proc_exit();
-	sctp_remaddr_proc_exit();
-
-	if (proc_net_sctp) {
-		proc_net_sctp = NULL;
-		remove_proc_entry("sctp", init_net.proc_net);
-	}
+	sctp_snmp_proc_exit(net);
+	sctp_eps_proc_exit(net);
+	sctp_assocs_proc_exit(net);
+	sctp_remaddr_proc_exit(net);
+
+	remove_proc_entry("sctp", net->proc_net);
+	net->sctp.proc_net_sctp = NULL;
  #endif
  }
 

@@ -1180,6 +1168,11 @@ static int sctp_net_init(struct net *net)
  {
  	int status;
 
+	/* Initialize proc fs directory.  */
+	status = sctp_proc_init(net);
+	if (status)
+		goto err_init_proc;
+
  	/* Initialize the control inode/socket for handling OOTB packets.  */
  	if ((status = sctp_ctl_sock_init(net))) {
  		pr_err("Failed to initialize the SCTP control sock\n");

@@ -1202,6 +1195,8 @@ static int sctp_net_init(struct net *net)
  	return 0;
 
  err_ctl_sock_init:
+	sctp_proc_exit(net);
+err_init_proc:
  	return status;
  }
 

@@ -1213,6 +1208,8 @@ static void sctp_net_exit(struct net *net)
 
  	/* Free the control endpoint.  */
  	inet_ctl_sock_destroy(net->sctp.ctl_sock);
+
+	sctp_proc_exit(net);
  }
 
  static struct pernet_operations sctp_net_ops = {

@@ -1259,11 +1256,6 @@ SCTP_STATIC __init int sctp_init(void)
  	if (status)
  		goto err_percpu_counter_init;
 
-	/* Initialize proc fs directory.  */
-	status = sctp_proc_init();
-	if (status)
-		goto err_init_proc;
-
  	/* Initialize object count debugging.  */
  	sctp_dbg_objcnt_init();
 

@@ -1477,8 +1469,6 @@ err_ehash_alloc:
  			     sizeof(struct sctp_hashbucket)));
  err_ahash_alloc:
  	sctp_dbg_objcnt_exit();
-	sctp_proc_exit();
-err_init_proc:
  	percpu_counter_destroy(&sctp_sockets_allocated);
  err_percpu_counter_init:
  	cleanup_sctp_mibs();

@@ -1522,7 +1512,6 @@ SCTP_STATIC __exit void sctp_exit(void)
 
  	sctp_dbg_objcnt_exit();
  	percpu_counter_destroy(&sctp_sockets_allocated);
-	sctp_proc_exit();
  	cleanup_sctp_mibs();
 
  	rcu_barrier(); /* Wait for completion of call_rcu()'s */

- Fix the sctp_af operations to work in all namespaces
- Enable sctp socket creation in all network namespaces.

Signed-off-by "Eric W. Biederman" <[email protected]>

---
  net/sctp/ipv6.c     |   12 ++++++------
  net/sctp/protocol.c |    8 +++++---
  2 files changed, 11 insertions(+), 9 deletions(-)

net/sctp/ipv6.c +6 -6

index bbf1534..a18cda6 100644
@@ -582,7 +582,7 @@ static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
  	if (!(type & IPV6_ADDR_UNICAST))
  		return 0;
 
-	return ipv6_chk_addr(&init_net, in6, NULL, 0);
+	return ipv6_chk_addr(sock_net(&sp->inet.sk), in6, NULL, 0);
  }
 
  /* This function checks if the address is a valid address to be used for

@@ -859,14 +859,14 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
  		struct net_device *dev;
 
  		if (type & IPV6_ADDR_LINKLOCAL) {
+			struct net *net;
  			if (!addr->v6.sin6_scope_id)
  				return 0;
+			net = sock_net(&opt->inet.sk);
  			rcu_read_lock();
-			dev = dev_get_by_index_rcu(&init_net,
-						   addr->v6.sin6_scope_id);
+			dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
  			if (!dev ||
-			    !ipv6_chk_addr(&init_net, &addr->v6.sin6_addr,
-					   dev, 0)) {
+			    !ipv6_chk_addr(net, &addr->v6.sin6_addr, dev, 0)) {
  				rcu_read_unlock();
  				return 0;
  			}

@@ -899,7 +899,7 @@ static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
  			if (!addr->v6.sin6_scope_id)
  				return 0;
  			rcu_read_lock();
-			dev = dev_get_by_index_rcu(&init_net,
+			dev = dev_get_by_index_rcu(sock_net(&opt->inet.sk),
  						   addr->v6.sin6_scope_id);
  			rcu_read_unlock();
  			if (!dev)

net/sctp/protocol.c +5 -3

index 72b3aa7..ab35691 100644
@@ -367,7 +367,8 @@ static int sctp_v4_addr_valid(union sctp_addr *addr,
  /* Should this be available for binding?   */
  static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp)
  {
-	int ret = inet_addr_type(&init_net, addr->v4.sin_addr.s_addr);
+	struct net *net = sock_net(&sp->inet.sk);
+	int ret = inet_addr_type(net, addr->v4.sin_addr.s_addr);
 
 
  	if (addr->v4.sin_addr.s_addr != htonl(INADDR_ANY) &&

@@ -454,7 +455,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
  	SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
  			  __func__, &fl4->daddr, &fl4->saddr);
 
-	rt = ip_route_output_key(&init_net, fl4);
+	rt = ip_route_output_key(sock_net(sk), fl4);
  	if (!IS_ERR(rt))
  		dst = &rt->dst;
 

@@ -500,7 +501,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
  		    (AF_INET = laddr->a.sa.sa_family)) {
  			fl4->saddr = laddr->a.v4.sin_addr.s_addr;
  			fl4->fl4_sport = laddr->a.v4.sin_port;
-			rt = ip_route_output_key(&init_net, fl4);
+			rt = ip_route_output_key(sock_net(sk), fl4);
  			if (!IS_ERR(rt)) {
  				dst = &rt->dst;
  				goto out_unlock;

@@ -1033,6 +1034,7 @@ static const struct net_protocol sctp_protocol = {
  	.handler     = sctp_rcv,
  	.err_handler = sctp_v4_err,
  	.no_policy   = 1,
+	.netns_ok    = 1,
  };
 
  /* IPv4 address related functions.  */