- If the reassembly queue limit was reached or if we couldn't allocate

  a reassembly queue state structure, don't update (receiver) sack
  report.
- Similarly, if tcp_drain() is called, freeing up all items on the
  reassembly queue, clean the sack report.

Found, Submitted by:	Noritoshi Demizu <demizu at dd dot iij4u dot or dot jp>
Reviewed by:	Mohan Srinivasan (mohans at yahoo-inc dot com),
		Raja Mukerji (raja at moselle dot com).

1 files changed, 3 insertions, 1 deletions

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 6255042..2ed59ce 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -256,6 +256,7 @@ tcp_reass(tp, th, tlenp, m)
 		tcp_reass_overflows++;
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 
@@ -267,6 +268,7 @@ tcp_reass(tp, th, tlenp, m)
 	if (te == NULL) {
 		tcpstat.tcps_rcvmemdrop++;
 		m_freem(m);
+		*tlenp = 0;
 		return (0);
 	}
 	tp->t_segqlen++;
@@ -2295,7 +2297,7 @@ dodata:							/* XXX */
 			thflags = tcp_reass(tp, th, &tlen, m);
 			tp->t_flags |= TF_ACKNOW;
 		}
-		if (tp->sack_enable)
+		if (tlen > 0 && tp->sack_enable)
 			tcp_update_sack_list(tp, th->th_seq, th->th_seq + tlen);
 		/*
 		 * Note the amount of data that peer has sent into