svn commit: r362581 - head/sys/netinet

Michael Tuexen tuexen at FreeBSD.org
Wed Jun 24 14:47:52 UTC 2020


Author: tuexen
Date: Wed Jun 24 14:47:51 2020
New Revision: 362581
URL: https://svnweb.freebsd.org/changeset/base/362581

Log:
  Fix the acconting for fragmented unordered messages when using
  interleaving.
  This was reported for the userland stack in
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19321
  
  MFC after:		1 week

Modified:
  head/sys/netinet/sctp_indata.c

Modified: head/sys/netinet/sctp_indata.c
==============================================================================
--- head/sys/netinet/sctp_indata.c	Wed Jun 24 13:52:53 2020	(r362580)
+++ head/sys/netinet/sctp_indata.c	Wed Jun 24 14:47:51 2020	(r362581)
@@ -1111,6 +1111,16 @@ sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct
 #endif
 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
 				TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
+				if (asoc->size_on_all_streams >= control->length) {
+					asoc->size_on_all_streams -= control->length;
+				} else {
+#ifdef INVARIANTS
+					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
+#else
+					asoc->size_on_all_streams = 0;
+#endif
+				}
+				sctp_ucount_decr(asoc->cnt_on_all_streams);
 				control->on_strm_q = 0;
 			}
 			if (control->on_read_q == 0) {
@@ -1391,7 +1401,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struc
 	}
 	/* Must be added to the stream-in queue */
 	if (created_control) {
-		if (unordered == 0) {
+		if ((unordered == 0) || (asoc->idata_supported)) {
 			sctp_ucount_incr(asoc->cnt_on_all_streams);
 		}
 		if (sctp_place_control_in_stream(strm, asoc, control)) {


More information about the svn-src-head mailing list