-Fixes first of all the getcred on IPv6 and V4. The

 copy's were incorrect and so was the locking.
-A bug was also found that would create a race and
 panic when an abort arrived on a socket being read
 from.
-Also fix the reader to get MSG_TRUNC when a partial
 delivery is aborted.
-Also addresses a couple of coverity caught error path
 memory leaks and a couple of other valid complaints
Approved by:	gnn

1 files changed, 3 insertions, 0 deletions

diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c
index 1545e8c..ac8940c 100644
--- a/sys/netinet/sctp_input.c
+++ b/sys/netinet/sctp_input.c
@@ -582,6 +582,7 @@ sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
 		 */
 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
 		stcb->asoc.control_pdapi->end_added = 1;
+		stcb->asoc.control_pdapi->pdapi_aborted = 1;
 		if (stcb->asoc.control_pdapi->tail_mbuf) {
 			stcb->asoc.control_pdapi->tail_mbuf->m_flags |= M_EOR;
 		}
@@ -673,6 +674,7 @@ sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
 		 */
 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
 		stcb->asoc.control_pdapi->end_added = 1;
+		stcb->asoc.control_pdapi->pdapi_aborted = 1;
 		if (stcb->asoc.control_pdapi->tail_mbuf) {
 			stcb->asoc.control_pdapi->tail_mbuf->m_flags |= M_EOR;
 		}
@@ -1823,6 +1825,7 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 	sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
 	if (sig == NULL) {
 		/* couldn't find signature */
+		sctp_m_freem(m_sig);
 		return (NULL);
 	}
 	/* compare the received digest with the computed digest */