-Fixes first of all the getcred on IPv6 and V4. The

 copy's were incorrect and so was the locking.
-A bug was also found that would create a race and
 panic when an abort arrived on a socket being read
 from.
-Also fix the reader to get MSG_TRUNC when a partial
 delivery is aborted.
-Also addresses a couple of coverity caught error path
 memory leaks and a couple of other valid complaints
Approved by:	gnn

1 files changed, 26 insertions, 40 deletions

diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c
index 24c2ba5..fb74b44 100644
--- a/sys/netinet/sctp_pcb.c
+++ b/sys/netinet/sctp_pcb.c
@@ -1769,8 +1769,10 @@ sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 		 */
 		/* got to be root to get at low ports */
 		if (ntohs(lport) < IPPORT_RESERVED) {
-			if (p && (error = priv_check(p,
-			    PRIV_NETINET_RESERVEDPORT))) {
+			if (p && (error =
+			    priv_check(p,
+			    PRIV_NETINET_RESERVEDPORT)
+			    )) {
 				SCTP_INP_DECR_REF(inp);
 				SCTP_INP_WUNLOCK(inp);
 				SCTP_INP_INFO_WUNLOCK();
@@ -3290,46 +3292,30 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 			if (sq->stcb == stcb) {
 				sq->do_not_ref_stcb = 1;
 				sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
-				if ((from_inpcbfree == 0) && so) {
-					/*
-					 * Only if we have a socket lock do
-					 * we do this
-					 */
-					if ((sq->held_length) ||
-					    (sq->end_added == 0) ||
-					    ((sq->length == 0) && (sq->end_added == 0))) {
-						/* Held for PD-API */
-						sq->held_length = 0;
-						if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PDAPIEVNT)) {
-							/*
-							 * need to change to
-							 * PD-API aborted
-							 */
-							stcb->asoc.control_pdapi = sq;
-							sctp_notify_partial_delivery_indication(stcb,
-							    SCTP_PARTIAL_DELIVERY_ABORTED, 1);
-							stcb->asoc.control_pdapi = NULL;
-						} else {
-							/*
-							 * need to get the
-							 * reader to remove
-							 * it
-							 */
-							sq->length = 0;
-							if (sq->data) {
-								struct mbuf *m;
-
-								m = sq->data;
-								while (m) {
-									sctp_sbfree(sq, stcb, &stcb->sctp_socket->so_rcv, m);
-									m = sctp_m_free(m);
-								}
-								sq->data = NULL;
-								sq->tail_mbuf = NULL;
-							}
-						}
+				/*
+				 * If there is no end, there never will be
+				 * now.
+				 */
+				if (sq->end_added == 0) {
+					/* Held for PD-API clear that. */
+					sq->pdapi_aborted = 1;
+					sq->held_length = 0;
+					if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PDAPIEVNT)) {
+						/*
+						 * Need to add a PD-API
+						 * aborted indication.
+						 * Setting the control_pdapi
+						 * assures that it will be
+						 * added right after this
+						 * msg.
+						 */
+						stcb->asoc.control_pdapi = sq;
+						sctp_notify_partial_delivery_indication(stcb,
+						    SCTP_PARTIAL_DELIVERY_ABORTED, 1);
+						stcb->asoc.control_pdapi = NULL;
 					}
 				}
+				/* Add an end to wake them */
 				sq->end_added = 1;
 				cnt++;
 			}