History log of /freebsd-11-stable/sys/netinet/sctp_indata.c
Revision Date Author Comments
# 361473 25-May-2020 tuexen

MFC r361116: Improve stcb handling during teardown

Ensure that an stcb is not dereferenced when it is about to be
freed.
This issue was found by SYZKALLER.


# 361471 25-May-2020 tuexen

MFC r360878, r360942: Improve SCTP timer handling

Ensure that we have a path when starting the T3 RXT timer.


# 360761 07-May-2020 tuexen

MFC r357705: Cleanup timer handling

Submitted by: Taylor Brandstetter


# 360759 07-May-2020 tuexen

MFC r357500: Improve dubug information

Improve numbering of debug information.

Submitted by: Taylor Brandstetter


# 360745 07-May-2020 tuexen

MFC r353145: Plump a memory leak

Plumb an mbuf leak in a code path that should not be taken. Also avoid
that this path is taken by setting the tail pointer correctly.
There is still bug related to handling unordered unfragmented messages
which were delayed in deferred handling.
This issue was found by OSS-Fuzz testing the usrsctp stack and reported in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17794


# 360737 07-May-2020 tuexen

MFC r352652: Fix memory leak

Plumb a memory leak.
Thnanks to Felix Weinrank for finding this issue using fuzz testing
and reporting it for the userland stack:
https://github.com/sctplab/usrsctp/issues/378


# 360735 07-May-2020 tuexen

MFC r352592:

Cleanup the RTO calculation and perform some consistency checks
before computing the RTO.
This should fix an overflow issue reported by Felix Weinrank in
https://github.com/sctplab/usrsctp/issues/375
for the userland stack and found by running a fuzz tester.


# 360729 07-May-2020 tuexen

MFC r351638: Improve handling DATA chunks.

Improve the handling of illegal sequence number combinations in received
data chunks. Abort the association if there are data chunks with larger
fragement sequence numbers than the fragement sequence of the last
fragment.
Thanks to Mark Wodrich from Google who found this issue by fuzz testing
the userland stack and reporting this issue in
https://github.com/sctplab/usrsctp/issues/355


# 360711 06-May-2020 tuexen

MFC r350216: Improve PD-API for SCTP

Wakeup the application when doing PD-API for unordered DATA chunks.
Work done with rrs@.


# 347677 16-May-2019 tuexen

MFC r345494:

Fix the handling of fragmented unordered messages when using DATA chunks
and FORWARD-TSN.

This bug was reported in https://github.com/sctplab/usrsctp/issues/286
for the userland stack.

This is joint work with rrs@.


# 347165 05-May-2019 tuexen

MFC r337708:

Use the stcb instead of the asoc in state macros.
This is not a functional change. Just a preparation for upcoming
dtrace state change provider support.


# 347163 05-May-2019 tuexen

MFC r337706:
Use consistently the macors to modify the assoc state.
No functional change.


# 347154 05-May-2019 tuexen

MFC r336511:
Whitespace changes due to changes in ident.


# 347147 05-May-2019 tuexen

MFC r333979:
Make clear why there is an assignment, which is not necessary.
To resolve the merge conflict, this also contains the changes
from r333869.


# 334728 06-Jun-2018 tuexen

MFC r333304:

Ensure we are not dereferencing a NULL pointer.

CID: 1385266


# 332234 07-Apr-2018 tuexen

MFC r328066:

Fix a bug related to fast retransmissions.

When processing a SACK advancing the cumtsn-ack in fast recovery,
increment the miss-indications for all TSN's reported as missing.

Thanks to Fabian Ising for finding the bug and to Timo Voelker
for provinding a fix.

This fix moves also CMT related initialisation of some variables
to a more appropriate place.


# 332223 07-Apr-2018 tuexen

MFC r325434:

Fix an accounting bug where data was counted twice if on the read
queue and on the ordered or unordered queue.
While there, improve the checking in INVARIANTs when computing the
a_rwnd.


# 332215 07-Apr-2018 tuexen

MFC r324730:

Fix a signed/unsigned warning.


# 332214 07-Apr-2018 tuexen

MFC r324729:

Abort an SCTP association, when a DATA chunk is followed by an unknown
chunk with a length smaller than the minimum length.

Thanks to Felix Weinrank for making me aware of the problem.


# 332212 07-Apr-2018 tuexen

MFC r324615:

Code cleanup, not functional change.

This avoids taking a pointer of a packed structure which allows simpler
compilation of the userland stack.


# 332200 07-Apr-2018 tuexen

MFC r323850:

Free the control structure after using is, not before.
Found by Coverity while scanning the usrsctp library.


# 332199 07-Apr-2018 tuexen

MFC r323847:

No need to wakeup, since sctp_add_to_readq() does it.


# 332191 07-Apr-2018 tuexen

MFC r323763:

Remove a no longer used variable.

Reported by: Felix Weinrank


# 332190 07-Apr-2018 tuexen

MFC r323670:

Fix an accounting bug and use sctp_timer_start to start a timer.


# 332176 07-Apr-2018 tuexen

MFC r321463:

Remove duplicate statement.


# 332175 07-Apr-2018 tuexen

MFC r321289:

Fix the explicit EOR mode. If the final messages is not complete, send
an ABORT.
Joint work with rrs@


# 332174 07-Apr-2018 tuexen

MFC r321205:

Avoid shadowed variables.


# 332171 07-Apr-2018 tuexen

MFC r321197:

Fix the accounting and add code to detect errors in accounting.
Joint work with rrs@


# 331722 29-Mar-2018 eadler

Revert r330897:

This was intended to be a non-functional change. It wasn't. The commit
message was thus wrong. In addition it broke arm, and merged crypto
related code.

Revert with prejudice.

This revert skips files touched in r316370 since that commit was since
MFCed. This revert also skips files that require $FreeBSD$ property
changes.

Thank you to those who helped me get out of this mess including but not
limited to gonzo, kevans, rgrimes.

Requested by: gjb (re)


# 330897 14-Mar-2018 eadler

Partial merge of the SPDX changes

These changes are incomplete but are making it difficult
to determine what other changes can/should be merged.

No objections from: pfg


# 310773 29-Dec-2016 tuexen

MFC r310590:

Whitespace changes.

The toolchain for processing the sources has been updated. No functional
change.


# 310495 24-Dec-2016 tuexen

MFC r310193:

Fix the handling of buffered messages in stream reset deferred handling.

Thanks to Eugen-Andrei Gavriloaie for reporting the issue and providing
substantial help in nailing down the issue.


# 310224 18-Dec-2016 tuexen

MFC r309851:

Ensure that the reported ppid and tsn are taken from the first fragment.

This fixes a bug where the wrong ppid was reported, if
* I-DATA was used on the first fragement was not received first
* DATA was used and different ppids where used.

Thanks to Julian Cordes for making me aware of the issue.


# 310223 18-Dec-2016 tuexen

MFC r309744:

Don't bundle a SACK chunk with a SHUTDOWN chunk if it is not required.


# 310219 18-Dec-2016 tuexen

MFC r309682:

Cleanup the names of SSN, SID, TSN, FSN, PPID and MID.

This made a couple of bugs visible in handling SSN wrap-arounds
when using DATA chunks. Now bulk transfer seems to work fine...
This fixes the issue reported in
https://github.com/sctplab/usrsctp/issues/111


# 310218 18-Dec-2016 tuexen

MFC r309607:

Whitespace changes.

The tools using to generate the sources has been updated and produces
different whitespaces. Commit this seperately to avoid intermixing
these with real code changes.


# 310214 18-Dec-2016 tuexen

MFC r306082:

Fix the handling of unordered fragmented user messages using DATA chunks.

There were two bugs:
* There was an accounting bug resulting in reporting a too small a_rwnd.
* There are a bug when abandoning messages in the reassembly queue.


# 304082 14-Aug-2016 tuexen

MFC r303927:

Improve a consistency check to not detect valid cases for
unordered user messages using DATA chunks as invalid ones.
While there, ensure that error causes are provided when
sending ABORT chunks in case of reassembly problems detected.
Thanks to Taylor Brandstetter for making me aware of this problem.


# 303956 11-Aug-2016 tuexen

MFC r303792:
Fix various bugs in relation to the I-DATA chunk support
This is joint work with rrs.

MFC r303793:
Mark an unused parameter as such.

MFC r303798:
Don't modify a structure without holding a reference count on it.

MFC r303813:
Remove stream queue entry consistently from wheel.
While there, improve the handling of drain.

MFC r303819:
Consistently check for unsent data on the stream queues.

MFC r303831:
Fix a locking issue found by stress testing with tsctp.
The inp read lock neeeds to be held when considering control->do_not_ref_stcb.

MFC r303834:
Fix the sending of FORWARD-TSN and I-FORWARD-TSN chunks. The
last SID/SSN pair wasn't filled in.
Thanks to Julian Cordes for providing a packetdrill script
triggering the issue and making me aware of the bug.

Approved by: re (kib)


# 303267 24-Jul-2016 tuexen

MFC r302904:
Fix a bug which results in a core dump when running netstat with
the -W option and having a listening SCTP socket.
The bug was introduced in r279122 when adding support for libxo.

MFC r302907:
When calling netstat -Laptcp the local address values are not aligned
with the corresponding entry in the table header. r295136
increased the value width from 14 to 32 without the corresponding
change to the table header. This commit adds the change to the table
header width.

MFC r302917:
Ensure that the -a, -W, -L options for SCTP behave similar
as for TCP.

MFC r302928:
Address a potential memory leak found a the clang static code analyzer
running on the userland stack.

MFC r302930:
Don't free a data chunk twice.
Found by the clang static code analyzer running for the userland stack.

MFC r302935:
Deal with a portential memory allocation failure, which was reported
by the clang static code analyzer.
Joint work with rrs@.

MFC r302942:
Add missing sctps_reasmusrmsgs counter.
Joint work with rrs@.

MFC r302945:
Don't duplicate code for SCTP, just use the ones used for UDP and TCP.
This fixes a bug with link local addresses. This will require and
upcoming change in the kernel to bring SCTP to the same behaviour
as UDP and TCP.

MFC r302949:
Fix the PR-SCTP behaviour.
This is done by rrs@.

MFC r302950:
Add a constant required by RFC 7496.

MFC r303024:
netstat and sockstat expect the IPv6 link local addresses to
have an embedded scope. So don't recover.

MFC r303025:
Use correct order of conditions to avoid NULL deref.

MFC r303073:
Fix a bug in deferred stream reset processing which results
in using a length field before it is set.
Thanks to Taylor Brandstetter for reporting the issue and
providing a fix.

Approved by: re (kib)