Turns out we would reset the TSN seq counter during

a colliding INIT. This if fine except when we have
data outstanding... we basically reset it to the
previous value it was.. so then we end up assigning
the same TSN to two different data chunks.
This patch:

1) Finds a missing lock for when we change the stream
   numbers during COOKIE and INIT-ACK processing.. we
   were NOT locking the send_buffer.. which COULD cause
   problems (found by inspection looking for <2>)

2) Fixes a case during a colliding INIT where we incorrectly
   reset the sending Sequence thus in some cases duplicately
   assigning a TSN.

3) Additional enhancments to logging so we can see strm/tsn in
   the receiver AND new tracking to watch what the sender
   is doing with TSN and STRM seq's.

Approved by:	gnn

1 files changed, 14 insertions, 8 deletions

diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index d8dd145..78b9a3e 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -4206,10 +4206,7 @@ sctp_msg_append(struct sctp_tcb *stcb,
 			sp->data = at;
 		}
 	}
-	if (holds_lock == 0) {
-		printf("Msg append gets a lock\n");
-		SCTP_TCB_LOCK(stcb);
-	}
+	SCTP_TCB_SEND_LOCK(stcb);
 	sctp_snd_sb_alloc(stcb, sp->length);
 	stcb->asoc.stream_queue_cnt++;
 	TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
@@ -4223,10 +4220,7 @@ sctp_msg_append(struct sctp_tcb *stcb,
 		sctp_insert_on_wheel(stcb, &stcb->asoc, strm, 0);
 	}
 	m = NULL;
-	if (hold_stcb_lock == 0) {
-		printf("msg append frees the lock\n");
-		SCTP_TCB_UNLOCK(stcb);
-	}
+	SCTP_TCB_SEND_UNLOCK(stcb);
 out_now:
 	if (m) {
 		sctp_m_freem(m);
@@ -5183,6 +5177,13 @@ out_gu:
 	atomic_add_int(&chk->whoTo->ref_count, 1);
 
 	chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1);
+#ifdef SCTP_LOG_SENDING_STR
+	sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
+	    (uintptr_t) stcb, (uintptr_t) sp,
+	    (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq),
+	    chk->rec.data.TSN_seq);
+#endif
+
 	dchkh = mtod(chk->data, struct sctp_data_chunk *);
 	/*
 	 * Put the rest of the things in place now. Size was done earlier in
@@ -9844,6 +9845,11 @@ sctp_lower_sosend(struct socket *so,
 			TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
 			if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
 				sp->strseq = strm->next_sequence_sent;
+#ifdef SCTP_LOG_SENDING_STR
+				sctp_misc_ints(SCTP_STRMOUT_LOG_ASSIGN,
+				    (uintptr_t) stcb, (uintptr_t) sp,
+				    (uint32_t) ((srcv->sinfo_stream << 16) | sp->strseq), 0);
+#endif
 				strm->next_sequence_sent++;
 			}
 			if ((strm->next_spoke.tqe_next == NULL) &&