Author: tuexen
Date: Wed Jul 20 06:29:26 2016
New Revision: 303073
URL: https://svnweb.freebsd.org/changeset/base/303073
Log:
Fix a bug in deferred stream reset processing which results
in using a length field before it is set.
Thanks to Taylor Brandstetter for reporting the issue and
providing a fix.
MFC after: 3 days
Modified:
head/sys/netinet/sctp_output.c
Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c Wed Jul 20 06:12:32 2016
(r303072)
+++ head/sys/netinet/sctp_output.c Wed Jul 20 06:29:26 2016
(r303073)
@@ -11940,7 +11940,6 @@ sctp_send_deferred_reset_response(struct
return;
}
SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
- sctp_add_stream_reset_result(chk, ent->seq, response);
/* setup chunk parameters */
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
@@ -11955,6 +11954,7 @@ sctp_send_deferred_reset_response(struct
ch->chunk_length = htons(chk->book_size);
atomic_add_int(&chk->whoTo->ref_count, 1);
SCTP_BUF_LEN(chk->data) = chk->send_size;
+ sctp_add_stream_reset_result(chk, ent->seq, response);
/* insert the chunk for sending */
TAILQ_INSERT_TAIL(&asoc->control_send_queue,
chk,
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
