mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-20 11:11:24 +00:00
Code Issues Releases Activity

Ensure that the flags field of sctp_tmit_chunks is initialized.

Browse Source 
Thanks to Peter Bostroem from Google for reporting the issue.

MFC after: 3 days
This commit is contained in:
Michael Tuexen 2014-10-09 20:08:12 +00:00
parent a13a821641
commit e03159ea69
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=272841
2 changed files with 29 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netinet/sctp_input.c
View File

@ -4069,8 +4069,10 @@ __attribute__((noinline))
if (chk == NULL) { if (chk == NULL) {
return (ret_code); return (ret_code);
} }
chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_STREAM_RESET; chk->rec.chunk_id.id = SCTP_STREAM_RESET;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->no_fr_allowed = 0; chk->no_fr_allowed = 0;
chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr); chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);

51
sys/netinet/sctp_output.c
View File

@ -8925,16 +8925,11 @@ sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
return; return;
} }
chk->send_size = 0; chk->send_size = 0;
mat = op_err; for (mat = op_err; mat != NULL; mat = SCTP_BUF_NEXT(mat)) {
while (mat != NULL) {
chk->send_size += SCTP_BUF_LEN(mat); chk->send_size += SCTP_BUF_LEN(mat);
mat = SCTP_BUF_NEXT(mat);
} }
chk->rec.chunk_id.id = SCTP_OPERATION_ERROR;
chk->rec.chunk_id.can_take_data = 1;
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->data = op_err; chk->data = op_err;
chk->whoTo = NULL; chk->whoTo = NULL;
@ -9022,12 +9017,12 @@ sctp_send_cookie_echo(struct mbuf *m,
return (-5); return (-5);
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->send_size = plen;
chk->rec.chunk_id.id = SCTP_COOKIE_ECHO; chk->rec.chunk_id.id = SCTP_COOKIE_ECHO;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
chk->send_size = plen;
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->data = cookie; chk->data = cookie;
chk->whoTo = net; chk->whoTo = net;
@ -9090,12 +9085,12 @@ sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->send_size = chk_length;
chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK; chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->send_size = chk_length;
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->data = outchain; chk->data = outchain;
chk->whoTo = net; chk->whoTo = net;
@ -9127,12 +9122,12 @@ sctp_send_cookie_ack(struct sctp_tcb *stcb)
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->send_size = sizeof(struct sctp_chunkhdr);
chk->rec.chunk_id.id = SCTP_COOKIE_ACK; chk->rec.chunk_id.id = SCTP_COOKIE_ACK;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->send_size = sizeof(struct sctp_chunkhdr);
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->data = cookie_ack; chk->data = cookie_ack;
if (chk->asoc->last_control_chunk_from != NULL) { if (chk->asoc->last_control_chunk_from != NULL) {
@ -9173,9 +9168,10 @@ sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->send_size = sizeof(struct sctp_chunkhdr);
chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK; chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->send_size = sizeof(struct sctp_chunkhdr);
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = 0; chk->flags = 0;
@ -9216,9 +9212,10 @@ sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->send_size = sizeof(struct sctp_shutdown_chunk);
chk->rec.chunk_id.id = SCTP_SHUTDOWN; chk->rec.chunk_id.id = SCTP_SHUTDOWN;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->send_size = sizeof(struct sctp_shutdown_chunk);
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = 0; chk->flags = 0;
@ -9269,13 +9266,13 @@ sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked)
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->data = m_asconf;
chk->send_size = len;
chk->rec.chunk_id.id = SCTP_ASCONF; chk->rec.chunk_id.id = SCTP_ASCONF;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
chk->data = m_asconf;
chk->send_size = len;
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->whoTo = net; chk->whoTo = net;
if (chk->whoTo) { if (chk->whoTo) {
@ -9364,7 +9361,9 @@ sctp_send_asconf_ack(struct sctp_tcb *stcb)
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_ASCONF_ACK;
chk->rec.chunk_id.can_take_data = 1;
chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
chk->whoTo = net; chk->whoTo = net;
if (chk->whoTo) { if (chk->whoTo) {
atomic_add_int(&chk->whoTo->ref_count, 1); atomic_add_int(&chk->whoTo->ref_count, 1);
@ -9373,11 +9372,8 @@ sctp_send_asconf_ack(struct sctp_tcb *stcb)
chk->send_size = 0; chk->send_size = 0;
/* Get size */ /* Get size */
chk->send_size = ack->len; chk->send_size = ack->len;
chk->rec.chunk_id.id = SCTP_ASCONF_ACK;
chk->rec.chunk_id.can_take_data = 1;
chk->sent = SCTP_DATAGRAM_UNSENT; chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0; chk->snd_count = 0;
chk->flags |= CHUNK_FLAGS_FRAGMENT_OK; /* XXX */
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next); TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
@ -10257,6 +10253,7 @@ send_forward_tsn(struct sctp_tcb *stcb,
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN; chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = 0;
chk->asoc = asoc; chk->asoc = asoc;
chk->whoTo = NULL; chk->whoTo = NULL;
chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA); chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
@ -10490,6 +10487,7 @@ sctp_send_sack(struct sctp_tcb *stcb, int so_locked
/* Clear our pkt counts */ /* Clear our pkt counts */
asoc->data_pkts_seen = 0; asoc->data_pkts_seen = 0;
a_chk->flags = 0;
a_chk->asoc = asoc; a_chk->asoc = asoc;
a_chk->snd_count = 0; a_chk->snd_count = 0;
a_chk->send_size = 0; /* fill in later */ a_chk->send_size = 0; /* fill in later */
@ -11267,6 +11265,7 @@ sctp_send_hb(struct sctp_tcb *stcb, struct sctp_nets *net, int so_locked
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST; chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_heartbeat_chunk); chk->send_size = sizeof(struct sctp_heartbeat_chunk);
@ -11368,10 +11367,11 @@ sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
if (chk == NULL) { if (chk == NULL) {
return; return;
} }
chk->copy_by_ref = 0;
SCTP_STAT_INCR(sctps_queue_upd_ecne); SCTP_STAT_INCR(sctps_queue_upd_ecne);
chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_ECN_ECHO; chk->rec.chunk_id.id = SCTP_ECN_ECHO;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_ecne_chunk); chk->send_size = sizeof(struct sctp_ecne_chunk);
chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER);
@ -11431,6 +11431,9 @@ sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
return; return;
} }
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_PACKET_DROPPED;
chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
len -= iphlen; len -= iphlen;
chk->send_size = len; chk->send_size = len;
/* Validate that we do not have an ABORT in here. */ /* Validate that we do not have an ABORT in here. */
@ -11517,8 +11520,6 @@ sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
} else { } else {
chk->whoTo = NULL; chk->whoTo = NULL;
} }
chk->rec.chunk_id.id = SCTP_PACKET_DROPPED;
chk->rec.chunk_id.can_take_data = 1;
drp->ch.chunk_type = SCTP_PACKET_DROPPED; drp->ch.chunk_type = SCTP_PACKET_DROPPED;
drp->ch.chunk_length = htons(chk->send_size); drp->ch.chunk_length = htons(chk->send_size);
spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket); spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket);
@ -11584,6 +11585,7 @@ sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn, u
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_ECN_CWR; chk->rec.chunk_id.id = SCTP_ECN_CWR;
chk->rec.chunk_id.can_take_data = 1; chk->rec.chunk_id.can_take_data = 1;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_cwr_chunk); chk->send_size = sizeof(struct sctp_cwr_chunk);
chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER); chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_NOWAIT, 1, MT_HEADER);
@ -11895,6 +11897,7 @@ sctp_send_str_reset_req(struct sctp_tcb *stcb,
chk->copy_by_ref = 0; chk->copy_by_ref = 0;
chk->rec.chunk_id.id = SCTP_STREAM_RESET; chk->rec.chunk_id.id = SCTP_STREAM_RESET;
chk->rec.chunk_id.can_take_data = 0; chk->rec.chunk_id.can_take_data = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc; chk->asoc = &stcb->asoc;
chk->book_size = sizeof(struct sctp_chunkhdr); chk->book_size = sizeof(struct sctp_chunkhdr);
chk->send_size = SCTP_SIZE32(chk->book_size); chk->send_size = SCTP_SIZE32(chk->book_size);