From owner-dev-commits-src-main@freebsd.org Tue Sep 28 13:55:44 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id DAA0267DA03; Tue, 28 Sep 2021 13:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HJgy85ljFz3K4J; Tue, 28 Sep 2021 13:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A553925A9D; Tue, 28 Sep 2021 13:55:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 18SDtiZf095203; Tue, 28 Sep 2021 13:55:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 18SDtidU095202; Tue, 28 Sep 2021 13:55:44 GMT (envelope-from git) Date: Tue, 28 Sep 2021 13:55:44 GMT Message-Id: <202109281355.18SDtidU095202@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 5b53e749a95e - main - sctp: fix usage of stream scheduler functions MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5b53e749a95e7f18475df9f9ce7984a31880a7ee Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Sep 2021 13:55:44 -0000 The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=5b53e749a95e7f18475df9f9ce7984a31880a7ee commit 5b53e749a95e7f18475df9f9ce7984a31880a7ee Author: Michael Tuexen AuthorDate: 2021-09-28 03:25:58 +0000 Commit: Michael Tuexen CommitDate: 2021-09-28 03:25:58 +0000 sctp: fix usage of stream scheduler functions sctp_ss_scheduled() should only be called for streams that are scheduled. So call sctp_ss_remove_from_stream() before it. This bug was uncovered by the earlier cleanup. Reported by: syzbot+bbf739922346659df4b2@syzkaller.appspotmail.com Reported by: syzbot+0a0857458f4a7b0507c8@syzkaller.appspotmail.com Reported by: syzbot+a0b62c6107b34a04e54d@syzkaller.appspotmail.com Reported by: syzbot+0aa0d676429ebcd53299@syzkaller.appspotmail.com Reported by: syzbot+104cc0c1d3ccf2921c1d@syzkaller.appspotmail.com MFC after: 1 week --- sys/netinet/sctp_output.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c index cad15be7a57b..cb8b8030b6ea 100644 --- a/sys/netinet/sctp_output.c +++ b/sys/netinet/sctp_output.c @@ -7142,6 +7142,7 @@ sctp_can_we_split_this(struct sctp_tcb *stcb, uint32_t length, static uint32_t sctp_move_to_outqueue(struct sctp_tcb *stcb, + struct sctp_nets *net, struct sctp_stream_out *strq, uint32_t space_left, uint32_t frag_point, @@ -7555,6 +7556,7 @@ dont_do_it: sctp_auth_key_acquire(stcb, chk->auth_keyid); chk->holds_key_ref = 1; } + stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, to_move); chk->rec.data.tsn = atomic_fetchadd_int(&asoc->sending_seq, 1); if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) { sctp_misc_ints(SCTP_STRMOUT_LOG_SEND, @@ -7672,8 +7674,8 @@ out_of: } static void -sctp_fill_outqueue(struct sctp_tcb *stcb, - struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now, int so_locked) +sctp_fill_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net, int frag_point, + int eeor_mode, int *quit_now, int so_locked) { struct sctp_association *asoc; struct sctp_stream_out *strq; @@ -7708,9 +7710,9 @@ sctp_fill_outqueue(struct sctp_tcb *stcb, giveup = 0; bail = 0; while ((space_left > 0) && (strq != NULL)) { - moved = sctp_move_to_outqueue(stcb, strq, space_left, frag_point, - &giveup, eeor_mode, &bail, so_locked); - stcb->asoc.ss_functions.sctp_ss_scheduled(stcb, net, asoc, strq, moved); + moved = sctp_move_to_outqueue(stcb, net, strq, space_left, + frag_point, &giveup, eeor_mode, + &bail, so_locked); if ((giveup != 0) || (bail != 0)) { break; }