svn commit: r347651 - stable/11/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu May 16 08:22:50 2019
New Revision: 347651
URL: https://svnweb.freebsd.org/changeset/base/347651

Log:
  MFC r339040:
  
  After allocating chunks set the fields in a consistent way.
  This removes two assignments for the flags field being done
  twice and adds one, which was missing.
  Thanks to Felix Weinrank for reporting the issue he found
  by using fuzz testing of the userland stack.

Modified:
  stable/11/sys/netinet/sctp_output.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_output.c
==============================================================================
--- stable/11/sys/netinet/sctp_output.c	Thu May 16 08:21:01 2019	(r347650)
+++ stable/11/sys/netinet/sctp_output.c	Thu May 16 08:22:50 2019	(r347651)
@@ -8971,14 +8971,15 @@ sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *
 		return;
 	}
 	chk->copy_by_ref = 0;
+	chk->rec.chunk_id.id = SCTP_OPERATION_ERROR;
+	chk->rec.chunk_id.can_take_data = 0;
+	chk->flags = 0;
 	chk->send_size = (uint16_t)chunk_length;
 	chk->sent = SCTP_DATAGRAM_UNSENT;
 	chk->snd_count = 0;
 	chk->asoc = &stcb->asoc;
 	chk->data = op_err;
 	chk->whoTo = NULL;
-	chk->rec.chunk_id.id = SCTP_OPERATION_ERROR;
-	chk->rec.chunk_id.can_take_data = 0;
 	hdr = mtod(op_err, struct sctp_chunkhdr *);
 	hdr->chunk_type = SCTP_OPERATION_ERROR;
 	hdr->chunk_flags = 0;
@@ -9200,7 +9201,6 @@ sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct s
 	chk->send_size = sizeof(struct sctp_chunkhdr);
 	chk->sent = SCTP_DATAGRAM_UNSENT;
 	chk->snd_count = 0;
-	chk->flags = 0;
 	chk->asoc = &stcb->asoc;
 	chk->data = m_shutdown_ack;
 	chk->whoTo = net;
@@ -9255,7 +9255,6 @@ sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_
 		chk->send_size = sizeof(struct sctp_shutdown_chunk);
 		chk->sent = SCTP_DATAGRAM_UNSENT;
 		chk->snd_count = 0;
-		chk->flags = 0;
 		chk->asoc = &stcb->asoc;
 		chk->data = m_shutdown;
 		chk->whoTo = net;
@@ -12162,7 +12161,6 @@ sctp_send_str_reset_req(struct sctp_tcb *stcb,
 	chk->book_size = sizeof(struct sctp_chunkhdr);
 	chk->send_size = SCTP_SIZE32(chk->book_size);
 	chk->book_size_scale = 0;
-
 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
 	if (chk->data == NULL) {
 		sctp_free_a_chunk(stcb, chk, SCTP_SO_LOCKED);