- If the reassembly queue limit was reached or if we couldn't allocate

a reassembly queue state structure, don't update (receiver) sack
  report.
- Similarly, if tcp_drain() is called, freeing up all items on the
  reassembly queue, clean the sack report.

Found, Submitted by:	Noritoshi Demizu <demizu at dd dot iij4u dot or dot jp>
Reviewed by:	Mohan Srinivasan (mohans at yahoo-inc dot com),
		Raja Mukerji (raja at moselle dot com).

sys/netinet/tcp_input.c

@@ -256,6 +256,7 @@ tcp_reass(tp, th, tlenp, m)
 		tcp_reass_overflows++;
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 
@@ -267,6 +268,7 @@ tcp_reass(tp, th, tlenp, m)
 	if (te == NULL) {
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 	tp->t_segqlen++;
@@ -2295,7 +2297,7 @@ tcp_input(m, off0)
 			thflags = tcp_reass(tp, th, &tlen, m);
 			tp->t_flags |= TF_ACKNOW;
 		}
-		if (tp->sack_enable)
+		if (tlen > 0 && tp->sack_enable)
 			tcp_update_sack_list(tp, th->th_seq, th->th_seq + tlen);
 		/*
 		 * Note the amount of data that peer has sent into

sys/netinet/tcp_reass.c

@@ -256,6 +256,7 @@ tcp_reass(tp, th, tlenp, m)
 		tcp_reass_overflows++;
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 
@@ -267,6 +268,7 @@ tcp_reass(tp, th, tlenp, m)
 	if (te == NULL) {
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 	tp->t_segqlen++;
@@ -2295,7 +2297,7 @@ tcp_input(m, off0)
 			thflags = tcp_reass(tp, th, &tlen, m);
 			tp->t_flags |= TF_ACKNOW;
 		}
-		if (tp->sack_enable)
+		if (tlen > 0 && tp->sack_enable)
 			tcp_update_sack_list(tp, th->th_seq, th->th_seq + tlen);
 		/*
 		 * Note the amount of data that peer has sent into

sys/netinet/tcp_subr.c

@@ -806,6 +806,7 @@ tcp_drain()
 					tcpb->t_segqlen--;
 					tcp_reass_qsize--;
 				}
+				tcp_clean_sackreport(tcpb);
 			}
 			INP_UNLOCK(inpb);
 		}

sys/netinet/tcp_timewait.c

@@ -806,6 +806,7 @@ tcp_drain()
 					tcpb->t_segqlen--;
 					tcp_reass_qsize--;
 				}
+				tcp_clean_sackreport(tcpb);
 			}
 			INP_UNLOCK(inpb);
 		}