svn commit: r364624 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon Aug 24 08:32:16 2020
New Revision: 364624
URL: https://svnweb.freebsd.org/changeset/base/364624

Log:
  MFC r362581:
  Fix the acconting for fragmented unordered messages when using
  interleaving.
  This was reported for the userland stack in
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19321

Modified:
  stable/12/sys/netinet/sctp_indata.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_indata.c
==============================================================================
--- stable/12/sys/netinet/sctp_indata.c	Mon Aug 24 08:30:36 2020	(r364623)
+++ stable/12/sys/netinet/sctp_indata.c	Mon Aug 24 08:32:16 2020	(r364624)
@@ -1111,6 +1111,16 @@ sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct
 #endif
 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
 				TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
+				if (asoc->size_on_all_streams >= control->length) {
+					asoc->size_on_all_streams -= control->length;
+				} else {
+#ifdef INVARIANTS
+					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
+#else
+					asoc->size_on_all_streams = 0;
+#endif
+				}
+				sctp_ucount_decr(asoc->cnt_on_all_streams);
 				control->on_strm_q = 0;
 			}
 			if (control->on_read_q == 0) {
@@ -1391,7 +1401,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struc
 	}
 	/* Must be added to the stream-in queue */
 	if (created_control) {
-		if (unordered == 0) {
+		if ((unordered == 0) || (asoc->idata_supported)) {
 			sctp_ucount_incr(asoc->cnt_on_all_streams);
 		}
 		if (sctp_place_control_in_stream(strm, asoc, control)) {