svn commit: r310214 - stable/11/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sun Dec 18 12:45:37 2016
New Revision: 310214
URL: https://svnweb.freebsd.org/changeset/base/310214

Log:
  MFC r306082:
  
  Fix the handling of unordered fragmented user messages using DATA chunks.
  
  There were two bugs:
  * There was an accounting bug resulting in reporting a too small a_rwnd.
  * There are a bug when abandoning messages in the reassembly queue.

Modified:
  stable/11/sys/netinet/sctp_indata.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_indata.c
==============================================================================
--- stable/11/sys/netinet/sctp_indata.c	Sun Dec 18 12:27:35 2016	(r310213)
+++ stable/11/sys/netinet/sctp_indata.c	Sun Dec 18 12:45:37 2016	(r310214)
@@ -809,6 +809,8 @@ restart:
 					tchk = TAILQ_FIRST(&control->reasm);
 					if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 						TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
+						asoc->size_on_reasm_queue -= tchk->send_size;
+						sctp_ucount_decr(asoc->cnt_on_reasm_queue);
 						nc->first_frag_seen = 1;
 						nc->fsn_included = tchk->rec.data.fsn_num;
 						nc->data = tchk->data;
@@ -5322,6 +5324,9 @@ sctp_flush_reassm_for_str_seq(struct sct
 		/* Not found */
 		return;
 	}
+	if (old && !ordered && SCTP_TSN_GT(control->fsn_included, cumtsn)) {
+		return;
+	}
 	TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
 		/* Purge hanging chunks */
 		if (old && (ordered == 0)) {