diff options
| author | tuexen <tuexen@FreeBSD.org> | 2016-12-18 12:45:37 +0000 |
|---|---|---|
| committer | tuexen <tuexen@FreeBSD.org> | 2016-12-18 12:45:37 +0000 |
| commit | 5a3d7366a3162fee6fb4463dcc5134958485339e (patch) | |
| tree | 650946c88fb78035b22ebda00a6f667d180f5df0 | |
| parent | efa3a5d78ea45cbf6f0e4eb4f2afea13c6cfc1d4 (diff) | |
| download | FreeBSD-src-5a3d7366a3162fee6fb4463dcc5134958485339e.zip FreeBSD-src-5a3d7366a3162fee6fb4463dcc5134958485339e.tar.gz | |
MFC r306082:
Fix the handling of unordered fragmented user messages using DATA chunks.
There were two bugs:
* There was an accounting bug resulting in reporting a too small a_rwnd.
* There are a bug when abandoning messages in the reassembly queue.
| -rw-r--r-- | sys/netinet/sctp_indata.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c index 4011253..cfdcfe7 100644 --- a/sys/netinet/sctp_indata.c +++ b/sys/netinet/sctp_indata.c @@ -809,6 +809,8 @@ restart: tchk = TAILQ_FIRST(&control->reasm); if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) { TAILQ_REMOVE(&control->reasm, tchk, sctp_next); + asoc->size_on_reasm_queue -= tchk->send_size; + sctp_ucount_decr(asoc->cnt_on_reasm_queue); nc->first_frag_seen = 1; nc->fsn_included = tchk->rec.data.fsn_num; nc->data = tchk->data; @@ -5322,6 +5324,9 @@ sctp_flush_reassm_for_str_seq(struct sctp_tcb *stcb, /* Not found */ return; } + if (old && !ordered && SCTP_TSN_GT(control->fsn_included, cumtsn)) { + return; + } TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) { /* Purge hanging chunks */ if (old && (ordered == 0)) { |
