svn commit: r303073 - head/sys/netinet
Michael Tuexen
tuexen at FreeBSD.org
Wed Jul 20 06:29:28 UTC 2016
Author: tuexen
Date: Wed Jul 20 06:29:26 2016
New Revision: 303073
URL: https://svnweb.freebsd.org/changeset/base/303073
Log:
Fix a bug in deferred stream reset processing which results
in using a length field before it is set.
Thanks to Taylor Brandstetter for reporting the issue and
providing a fix.
MFC after: 3 days
Modified:
head/sys/netinet/sctp_output.c
Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c Wed Jul 20 06:12:32 2016 (r303072)
+++ head/sys/netinet/sctp_output.c Wed Jul 20 06:29:26 2016 (r303073)
@@ -11940,7 +11940,6 @@ sctp_send_deferred_reset_response(struct
return;
}
SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
- sctp_add_stream_reset_result(chk, ent->seq, response);
/* setup chunk parameters */
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
@@ -11955,6 +11954,7 @@ sctp_send_deferred_reset_response(struct
ch->chunk_length = htons(chk->book_size);
atomic_add_int(&chk->whoTo->ref_count, 1);
SCTP_BUF_LEN(chk->data) = chk->send_size;
+ sctp_add_stream_reset_result(chk, ent->seq, response);
/* insert the chunk for sending */
TAILQ_INSERT_TAIL(&asoc->control_send_queue,
chk,
More information about the svn-src-all
mailing list