aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet
diff options
context:
space:
mode:
authorMichael Tuexen <tuexen@FreeBSD.org>2021-09-28 03:25:58 +0000
committerMichael Tuexen <tuexen@FreeBSD.org>2021-09-28 03:25:58 +0000
commit5b53e749a95e7f18475df9f9ce7984a31880a7ee (patch)
treecff947fc6c91d1bf3436e6a1ef24290fb0d7430f /sys/netinet
parent171633765c4367dc233a4bf0e5926cb7c4decfc1 (diff)
downloadsrc-5b53e749a95e7f18475df9f9ce7984a31880a7ee.tar.gz
src-5b53e749a95e7f18475df9f9ce7984a31880a7ee.zip
sctp: fix usage of stream scheduler functions
sctp_ss_scheduled() should only be called for streams that are scheduled. So call sctp_ss_remove_from_stream() before it. This bug was uncovered by the earlier cleanup. Reported by: syzbot+bbf739922346659df4b2@syzkaller.appspotmail.com Reported by: syzbot+0a0857458f4a7b0507c8@syzkaller.appspotmail.com Reported by: syzbot+a0b62c6107b34a04e54d@syzkaller.appspotmail.com Reported by: syzbot+0aa0d676429ebcd53299@syzkaller.appspotmail.com Reported by: syzbot+104cc0c1d3ccf2921c1d@syzkaller.appspotmail.com MFC after: 1 week
Diffstat (limited to 'sys/netinet')
-rw-r--r--sys/netinet/sctp_output.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index cad15be7a57b..cb8b8030b6ea 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -7142,6 +7142,7 @@ sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length,
static uint32_t
sctp_move_to_outqueue(struct sctp_tcb *stcb,
+ struct sctp_nets *net,
struct sctp_stream_out *strq,
uint32_t space_left,
uint32_t frag_point,
@@ -7555,6 +7556,7 @@ dont_do_it:
sctp_auth_key_acquire(stcb, chk->auth_keyid);
chk->holds_key_ref = 1;
}
+ stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move);
chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1);
if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) {
sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
@@ -7672,8 +7674,8 @@ out_of:
}
static void
-sctp_fill_outqueue(struct sctp_tcb *stcb,
- struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked)
+sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point,
+ int eeor_mode, int *quit_now, int so_locked)
{
struct sctp_association *asoc;
struct sctp_stream_out *strq;
@@ -7708,9 +7710,9 @@ sctp_fill_outqueue(struct sctp_tcb *stcb,
giveup = 0;
bail = 0;
while ((space_left > 0) && (strq != NULL)) {
- moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point,
- &giveup, eeor_mode, &bail, so_locked);
- stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved);
+ moved = sctp_move_to_outqueue(stcb, net, strq, space_left,
+ frag_point, &giveup, eeor_mode,
+ &bail, so_locked);
if ((giveup != 0) || (bail != 0)) {
break;
}