diff options
| author | tuexen <tuexen@FreeBSD.org> | 2015-05-29 13:13:12 +0000 |
|---|---|---|
| committer | tuexen <tuexen@FreeBSD.org> | 2015-05-29 13:13:12 +0000 |
| commit | d8c5ad4ada6fae7033eba310f4ab9c58f72402bf (patch) | |
| tree | b3ae33ce76036866ce5e1fd074622e895252856f /sys/netinet/sctp_indata.c | |
| parent | ae995cba1559aaf47b84e218b91a8041505f681c (diff) | |
| download | FreeBSD-src-d8c5ad4ada6fae7033eba310f4ab9c58f72402bf.zip FreeBSD-src-d8c5ad4ada6fae7033eba310f4ab9c58f72402bf.tar.gz | |
MFC r280440:
Fix the bug in the handling of fragmented abandoned SCTP user messages reported in
https://code.google.com/p/sctp-refimpl/issues/detail?id=11
Thanks to Lally Singh for reporting it.
Diffstat (limited to 'sys/netinet/sctp_indata.c')
| -rw-r--r-- | sys/netinet/sctp_indata.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c index 5a70615..ea3d3e7 100644 --- a/sys/netinet/sctp_indata.c +++ b/sys/netinet/sctp_indata.c @@ -2597,12 +2597,14 @@ sctp_process_segment_range(struct sctp_tcb *stcb, struct sctp_tmit_chunk **p_tp1 * cumack trackers for first transmissions, * and retransmissions. */ - if ((tp1->whoTo->find_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) && + if ((tp1->sent < SCTP_DATAGRAM_RESEND) && + (tp1->whoTo->find_pseudo_cumack == 1) && (tp1->snd_count == 1)) { tp1->whoTo->pseudo_cumack = tp1->rec.data.TSN_seq; tp1->whoTo->find_pseudo_cumack = 0; } - if ((tp1->whoTo->find_rtx_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) && + if ((tp1->sent < SCTP_DATAGRAM_RESEND) && + (tp1->whoTo->find_rtx_pseudo_cumack == 1) && (tp1->snd_count > 1)) { tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.TSN_seq; tp1->whoTo->find_rtx_pseudo_cumack = 0; @@ -3512,7 +3514,7 @@ sctp_window_probe_recovery(struct sctp_tcb *stcb, if ((tp1->sent >= SCTP_DATAGRAM_ACKED) || (tp1->data == NULL)) { /* TSN's skipped we do NOT move back. */ sctp_misc_ints(SCTP_FLIGHT_LOG_DWN_WP_FWD, - tp1->whoTo->flight_size, + tp1->whoTo ? tp1->whoTo->flight_size : 0, tp1->book_size, (uintptr_t) tp1->whoTo, tp1->rec.data.TSN_seq); |
