git: 5b53e749a95e - main - sctp: fix usage of stream scheduler functions

[Michael Tuexen]

The branch main has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=5b53e749a95e7f18475df9f9ce7984a31880a7ee

commit 5b53e749a95e7f18475df9f9ce7984a31880a7ee
Author:     Michael Tuexen <tuexen at FreeBSD.org>
AuthorDate: 2021-09-28 03:25:58 +0000
Commit:     Michael Tuexen <tuexen at FreeBSD.org>
CommitDate: 2021-09-28 03:25:58 +0000

    sctp: fix usage of stream scheduler functions
    
    sctp_ss_scheduled() should only be called for streams that are
    scheduled. So call sctp_ss_remove_from_stream() before it.
    This bug was uncovered by the earlier cleanup.
    
    Reported by:    syzbot+bbf739922346659df4b2 at syzkaller.appspotmail.com
    Reported by:    syzbot+0a0857458f4a7b0507c8 at syzkaller.appspotmail.com
    Reported by:    syzbot+a0b62c6107b34a04e54d at syzkaller.appspotmail.com
    Reported by:    syzbot+0aa0d676429ebcd53299 at syzkaller.appspotmail.com
    Reported by:    syzbot+104cc0c1d3ccf2921c1d at syzkaller.appspotmail.com
    MFC after:      1 week
---
 sys/netinet/sctp_output.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index cad15be7a57b..cb8b8030b6ea 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -7142,6 +7142,7 @@ sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length,
 
 static uint32_t
 sctp_move_to_outqueue(struct sctp_tcb *stcb,
+    struct sctp_nets *net,
     struct sctp_stream_out *strq,
     uint32_t space_left,
     uint32_t frag_point,
@@ -7555,6 +7556,7 @@ dont_do_it:
 		sctp_auth_key_acquire(stcb, chk->auth_keyid);
 		chk->holds_key_ref = 1;
 	}
+	stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move);
 	chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1);
 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) {
 		sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
@@ -7672,8 +7674,8 @@ out_of:
 }
 
 static void
-sctp_fill_outqueue(struct sctp_tcb *stcb,
-    struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked)
+sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point,
+    int eeor_mode, int *quit_now, int so_locked)
 {
 	struct sctp_association *asoc;
 	struct sctp_stream_out *strq;
@@ -7708,9 +7710,9 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
 	giveup = 0;
 	bail = 0;
 	while ((space_left > 0) && (strq != NULL)) {
-		moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point,
-		    &giveup, eeor_mode, &bail, so_locked);
-		stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved);
+		moved = sctp_move_to_outqueue(stcb, net, strq, space_left,
+		    frag_point, &giveup, eeor_mode,
+		    &bail, so_locked);
 		if ((giveup != 0) || (bail != 0)) {
 			break;
 		}