- If the reassembly queue limit was reached or if we couldn't allocate

  a reassembly queue state structure, don't update (receiver) sack
  report.
- Similarly, if tcp_drain() is called, freeing up all items on the
  reassembly queue, clean the sack report.

Found, Submitted by:	Noritoshi Demizu <demizu at dd dot iij4u dot or dot jp>
Reviewed by:	Mohan Srinivasan (mohans at yahoo-inc dot com),
		Raja Mukerji (raja at moselle dot com).

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c
index ed5eab3..3516c74 100644
--- a/sys/netinet/tcp_timewait.c
+++ b/sys/netinet/tcp_timewait.c
@@ -806,6 +806,7 @@ tcp_drain()
 					tcpb->t_segqlen--;
 					tcp_reass_qsize--;
 				}
+				tcp_clean_sackreport(tcpb);
 			}
 			INP_UNLOCK(inpb);
 		}