d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix the acconting for fragmented unordered messages when using

Browse Source 
interleaving.
This was reported for the userland stack in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19321

MFC after:		1 week
This commit is contained in:
Michael Tuexen 2020-06-24 14:47:51 +00:00
parent 6e26dd0dbe
commit 132c073866
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=362581
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/netinet/sctp_indata.c
View File

@ -1111,6 +1111,16 @@ sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc,
#endif
SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
if (asoc->size_on_all_streams >= control->length) {
asoc->size_on_all_streams -= control->length;
} else {
#ifdef INVARIANTS
panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
#else
asoc->size_on_all_streams = 0;
#endif
}
sctp_ucount_decr(asoc->cnt_on_all_streams);
control->on_strm_q = 0;
}
if (control->on_read_q == 0) {
@ -1391,7 +1401,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
}
/* Must be added to the stream-in queue */
if (created_control) {
if (unordered == 0) {
if ((unordered == 0) || (asoc->idata_supported)) {
sctp_ucount_incr(asoc->cnt_on_all_streams);
}
if (sctp_place_control_in_stream(strm, asoc, control)) {