d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Two bugs:

Browse Source 
- Locks were not being unlocked when an invalid size chunk is
    sent in.
  - When a notification comes in, we cannot use it to look up
    the fragment interleave stream information since its not
    on a stream.
This commit is contained in:
Randall Stewart 2007-05-06 00:01:17 +00:00
parent d0a68c2747
commit 6114cd961a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=169295
2 changed files with 37 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/netinet/sctp_input.c
View File

@ -3938,6 +3938,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
printf("Bad size on sack chunk .. to small\n");
}
#endif
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -3970,6 +3972,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
}
if (abort_now) {
/* ABORT signal from sack processing */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -3996,6 +4000,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
#endif /* SCTP_DEBUG */
if (chk_length != sizeof(struct sctp_heartbeat_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4024,6 +4030,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
#endif /* SCTP_DEBUG */
if (chk_length != sizeof(struct sctp_shutdown_chunk)) {
*offset = length;
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
return (NULL);
} {
@ -4211,6 +4219,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
/* He's alive so give him credit */
if (chk_length != sizeof(struct sctp_ecne_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4227,6 +4237,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
/* He's alive so give him credit */
if (chk_length != sizeof(struct sctp_cwr_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4274,6 +4286,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
#endif /* SCTP_DEBUG */
if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4291,6 +4305,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
#endif /* SCTP_DEBUG */
if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4327,6 +4343,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
chk_length, chunk_buf);
if (chk_length < sizeof(struct sctp_stream_reset_tsn_req)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4359,6 +4377,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
/* re-get it all please */
if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}
@ -4392,6 +4412,8 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
(chk_length > (sizeof(struct sctp_auth_chunk) + SCTP_AUTH_DIGEST_LEN_MAX))) {
/* Its not ours */
if (locked_tcb)
SCTP_TCB_UNLOCK(locked_tcb);
*offset = length;
return (NULL);
}

25
sys/netinet/sctputil.c
View File

@ -4526,7 +4526,8 @@ sctp_sorecvmsg(struct socket *so,
} else {
in_flags = 0;
}
slen = uio->uio_resid;
if (uio)
slen = uio->uio_resid;
/* Pull in and set up our int flags */
if (in_flags & MSG_OOB) {
/* Out of band's NOT supported */
@ -4553,11 +4554,11 @@ sctp_sorecvmsg(struct socket *so,
in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
#ifdef SCTP_RECV_RWND_LOGGING
sctp_misc_ints(SCTP_SORECV_ENTER,
rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, slen);
#endif
#ifdef SCTP_RECV_RWND_LOGGING
sctp_misc_ints(SCTP_SORECV_ENTERPL,
rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
rwnd_req, block_allowed, so->so_rcv.sb_cc, slen);
#endif
@ -4592,7 +4593,7 @@ sctp_sorecvmsg(struct socket *so,
/* we need to wait for data */
#ifdef SCTP_RECV_DETAIL_RWND_LOGGING
sctp_misc_ints(SCTP_SORECV_BLOCKSA,
0, 0, so->so_rcv.sb_cc, uio->uio_resid);
0, 0, so->so_rcv.sb_cc, slen);
#endif
if ((so->so_rcv.sb_cc == 0) &&
((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
@ -4767,6 +4768,7 @@ sctp_sorecvmsg(struct socket *so,
while (ctl) {
if ((ctl->stcb != control->stcb) && (ctl->length) &&
(ctl->some_taken ||
(ctl->spec_flags & M_NOTIFICATION) ||
((ctl->do_not_ref_stcb == 0) &&
(ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
) {
@ -4782,6 +4784,7 @@ sctp_sorecvmsg(struct socket *so,
(ctl->length) &&
((ctl->some_taken) ||
((ctl->do_not_ref_stcb == 0) &&
- ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
(ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
) {
/*-
@ -4852,7 +4855,9 @@ sctp_sorecvmsg(struct socket *so,
stcb->freed_by_sorcv_sincelast = 0;
}
}
if (stcb && control->do_not_ref_stcb == 0) {
if (stcb &&
((control->spec_flags & M_NOTIFICATION) == 0) &&
control->do_not_ref_stcb == 0) {
stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
}
/* First lets get off the sinfo and sockaddr info */
@ -5014,7 +5019,7 @@ sctp_sorecvmsg(struct socket *so,
if ((SCTP_BUF_NEXT(m) == NULL) &&
(control->end_added)) {
out_flags |= MSG_EOR;
if (control->do_not_ref_stcb == 0)
if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
}
if (control->spec_flags & M_NOTIFICATION) {
@ -5287,12 +5292,12 @@ sctp_sorecvmsg(struct socket *so,
/* he aborted, or is done i.e.did a shutdown */
out_flags |= MSG_EOR;
if (control->pdapi_aborted) {
if (control->do_not_ref_stcb == 0)
if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
out_flags |= MSG_TRUNC;
} else {
if (control->do_not_ref_stcb == 0)
if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
}
goto done_with_control;
@ -5343,7 +5348,7 @@ sctp_sorecvmsg(struct socket *so,
}
if (control->end_added) {
out_flags |= MSG_EOR;
if (control->do_not_ref_stcb == 0)
if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
}
if (control->spec_flags & M_NOTIFICATION) {
@ -5409,7 +5414,7 @@ sctp_sorecvmsg(struct socket *so,
out_flags |= MSG_EOR;
if (control->pdapi_aborted) {
out_flags |= MSG_TRUNC;
if (control->do_not_ref_stcb == 0)
if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
}
goto done_with_control;