git: d67ef7473591 - stable/13 - sctp: fix usage of stream scheduler functions

The branch stable/13 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=d67ef7473591476ebb44fb37da2ec6f104035be6

commit d67ef7473591476ebb44fb37da2ec6f104035be6
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2021-09-28 03:25:58 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2022-02-22 22:56:26 +0000

    sctp: fix usage of stream scheduler functions
    
    sctp_ss_scheduled() should only be called for streams that are
    scheduled. So call sctp_ss_remove_from_stream() before it.
    This bug was uncovered by the earlier cleanup.
    
    Reported by:    syzbot+bbf739922346659df4b2@syzkaller.appspotmail.com
    Reported by:    syzbot+0a0857458f4a7b0507c8@syzkaller.appspotmail.com
    Reported by:    syzbot+a0b62c6107b34a04e54d@syzkaller.appspotmail.com
    Reported by:    syzbot+0aa0d676429ebcd53299@syzkaller.appspotmail.com
    Reported by:    syzbot+104cc0c1d3ccf2921c1d@syzkaller.appspotmail.com
    
    (cherry picked from commit 5b53e749a95e7f18475df9f9ce7984a31880a7ee)
---
 sys/netinet/sctp_output.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index de5241555fd8..2f5183bacc9a 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -7142,6 +7142,7 @@ sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length,
 
 static uint32_t
 sctp_move_to_outqueue(struct sctp_tcb *stcb,
+    struct sctp_nets *net,
     struct sctp_stream_out *strq,
     uint32_t space_left,
     uint32_t frag_point,
@@ -7555,6 +7556,7 @@ dont_do_it:
 		sctp_auth_key_acquire(stcb, chk->auth_keyid);
 		chk->holds_key_ref = 1;
 	}
+	stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move);
 	chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1);
 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) {
 		sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
@@ -7672,8 +7674,8 @@ out_of:
 }
 
 static void
-sctp_fill_outqueue(struct sctp_tcb *stcb,
-    struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked)
+sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point,
+    int eeor_mode, int *quit_now, int so_locked)
 {
 	struct sctp_association *asoc;
 	struct sctp_stream_out *strq;
@@ -7708,9 +7710,9 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
 	giveup = 0;
 	bail = 0;
 	while ((space_left > 0) && (strq != NULL)) {
-		moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point,
-		    &giveup, eeor_mode, &bail, so_locked);
-		stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved);
+		moved = sctp_move_to_outqueue(stcb, net, strq, space_left,
+		    frag_point, &giveup, eeor_mode,
+		    &bail, so_locked);
 		if ((giveup != 0) || (bail != 0)) {
 			break;
 		}