svn commit: r283731 - stable/10/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Fri May 29 13:13:12 2015
New Revision: 283731
URL: https://svnweb.freebsd.org/changeset/base/283731

Log:
  MFC r280440:
  
  Fix the bug in the handling of fragmented abandoned SCTP user messages reported in
  https://code.google.com/p/sctp-refimpl/issues/detail?id=11
  Thanks to Lally Singh for reporting it.

Modified:
  stable/10/sys/netinet/sctp_indata.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet/sctp_indata.c
==============================================================================
--- stable/10/sys/netinet/sctp_indata.c	Fri May 29 13:11:13 2015	(r283730)
+++ stable/10/sys/netinet/sctp_indata.c	Fri May 29 13:13:12 2015	(r283731)
@@ -2597,12 +2597,14 @@ sctp_process_segment_range(struct sctp_t
 			 * cumack trackers for first transmissions,
 			 * and retransmissions.
 			 */
-			if ((tp1->whoTo->find_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
+			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
+			    (tp1->whoTo->find_pseudo_cumack == 1) &&
 			    (tp1->snd_count == 1)) {
 				tp1->whoTo->pseudo_cumack = tp1->rec.data.TSN_seq;
 				tp1->whoTo->find_pseudo_cumack = 0;
 			}
-			if ((tp1->whoTo->find_rtx_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
+			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
+			    (tp1->whoTo->find_rtx_pseudo_cumack == 1) &&
 			    (tp1->snd_count > 1)) {
 				tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.TSN_seq;
 				tp1->whoTo->find_rtx_pseudo_cumack = 0;
@@ -3512,7 +3514,7 @@ sctp_window_probe_recovery(struct sctp_t
 	if ((tp1->sent >= SCTP_DATAGRAM_ACKED) || (tp1->data == NULL)) {
 		/* TSN's skipped we do NOT move back. */
 		sctp_misc_ints(SCTP_FLIGHT_LOG_DWN_WP_FWD,
-		    tp1->whoTo->flight_size,
+		    tp1->whoTo ? tp1->whoTo->flight_size : 0,
 		    tp1->book_size,
 		    (uintptr_t) tp1->whoTo,
 		    tp1->rec.data.TSN_seq);