From owner-svn-src-stable@freebsd.org Sun Dec 18 12:45:38 2016 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6EC27C85291; Sun, 18 Dec 2016 12:45:38 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 37C55B26; Sun, 18 Dec 2016 12:45:38 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uBICjbbn066389; Sun, 18 Dec 2016 12:45:37 GMT (envelope-from tuexen@FreeBSD.org) Received: (from tuexen@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uBICjbcg066388; Sun, 18 Dec 2016 12:45:37 GMT (envelope-from tuexen@FreeBSD.org) Message-Id: <201612181245.uBICjbcg066388@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tuexen set sender to tuexen@FreeBSD.org using -f From: Michael Tuexen Date: Sun, 18 Dec 2016 12:45:37 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r310214 - stable/11/sys/netinet X-SVN-Group: stable-11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Dec 2016 12:45:38 -0000 Author: tuexen Date: Sun Dec 18 12:45:37 2016 New Revision: 310214 URL: https://svnweb.freebsd.org/changeset/base/310214 Log: MFC r306082: Fix the handling of unordered fragmented user messages using DATA chunks. There were two bugs: * There was an accounting bug resulting in reporting a too small a_rwnd. * There are a bug when abandoning messages in the reassembly queue. Modified: stable/11/sys/netinet/sctp_indata.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/netinet/sctp_indata.c ============================================================================== --- stable/11/sys/netinet/sctp_indata.c Sun Dec 18 12:27:35 2016 (r310213) +++ stable/11/sys/netinet/sctp_indata.c Sun Dec 18 12:45:37 2016 (r310214) @@ -809,6 +809,8 @@ restart: tchk = TAILQ_FIRST(&control->reasm); if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) { TAILQ_REMOVE(&control->reasm, tchk, sctp_next); + asoc->size_on_reasm_queue -= tchk->send_size; + sctp_ucount_decr(asoc->cnt_on_reasm_queue); nc->first_frag_seen = 1; nc->fsn_included = tchk->rec.data.fsn_num; nc->data = tchk->data; @@ -5322,6 +5324,9 @@ sctp_flush_reassm_for_str_seq(struct sct /* Not found */ return; } + if (old && !ordered && SCTP_TSN_GT(control->fsn_included, cumtsn)) { + return; + } TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) { /* Purge hanging chunks */ if (old && (ordered == 0)) {