d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sctp: fix usage of stream scheduler functions

Browse Source 
sctp_ss_scheduled() should only be called for streams that are
scheduled. So call sctp_ss_remove_from_stream() before it.
This bug was uncovered by the earlier cleanup.

Reported by:	syzbot+bbf739922346659df4b2@syzkaller.appspotmail.com
Reported by:	syzbot+0a0857458f4a7b0507c8@syzkaller.appspotmail.com
Reported by:	syzbot+a0b62c6107b34a04e54d@syzkaller.appspotmail.com
Reported by:	syzbot+0aa0d676429ebcd53299@syzkaller.appspotmail.com
Reported by:	syzbot+104cc0c1d3ccf2921c1d@syzkaller.appspotmail.com
MFC after:	1 week
This commit is contained in:
Michael Tuexen 2021-09-28 05:25:58 +02:00
parent 171633765c
commit 5b53e749a9
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/netinet/sctp_output.c
View File

@ -7142,6 +7142,7 @@ sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length,
static uint32_t
sctp_move_to_outqueue(struct sctp_tcb *stcb,
struct sctp_nets *net,
struct sctp_stream_out *strq,
uint32_t space_left,
uint32_t frag_point,
@ -7555,6 +7556,7 @@ sctp_move_to_outqueue(struct sctp_tcb *stcb,
sctp_auth_key_acquire(stcb, chk->auth_keyid);
chk->holds_key_ref = 1;
}
stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move);
chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1);
if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) {
sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
@ -7672,8 +7674,8 @@ sctp_move_to_outqueue(struct sctp_tcb *stcb,
}
static void
sctp_fill_outqueue(struct sctp_tcb *stcb,
struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked)
sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point,
int eeor_mode, int *quit_now, int so_locked)
{
struct sctp_association *asoc;
struct sctp_stream_out *strq;
@ -7708,9 +7710,9 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
giveup = 0;
bail = 0;
while ((space_left > 0) && (strq != NULL)) {
moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point,
&giveup, eeor_mode, &bail, so_locked);
stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved);
moved = sctp_move_to_outqueue(stcb, net, strq, space_left,
frag_point, &giveup, eeor_mode,
&bail, so_locked);
if ((giveup != 0) || (bail != 0)) {
break;
}