d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't free an mbuf twice. This only happens in very rare error

Browse Source 
cases where the peer sends illegal sequencing information in
DATA chunks for an existing association.

MFC after: 3 days.
This commit is contained in:
Michael Tuexen 2014-04-23 21:20:55 +00:00
parent 9b997115fb
commit 8be0fd55dc
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netinet/sctp_indata.c
View File

@ -1717,6 +1717,9 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
if (last_chunk) {
*m = NULL;
}
return (0);
} else {
if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
@ -1733,6 +1736,9 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
if (last_chunk) {
*m = NULL;
}
return (0);
}
}
@ -1759,6 +1765,9 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
if (last_chunk) {
*m = NULL;
}
return (0);
}
}
@ -1822,6 +1831,9 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
} else {
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag);
if (*abort_flag) {
if (last_chunk) {
*m = NULL;
}
return (0);
}
}
@ -1834,7 +1846,9 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
* the assoc is now gone and chk was put onto the
* reasm queue, which has all been freed.
*/
if (last_chunk) {
*m = NULL;
}
return (0);
}
}