Commit 3888e9ef authored by Vlad Yasevich's avatar Vlad Yasevich Committed by David S. Miller
Browse files

sctp: Mark the tsn as received after all allocations finish 



If we don't have the buffer space or memory allocations fail,
the data chunk is dropped, but TSN is still reported as received.
This introduced a data loss that can't be recovered.  We should
only mark TSNs are received after memory allocations finish.
The one exception is the invalid stream identifier, but that's
due to user error and is reported back to the user.

This was noticed by Michael Tuexen.

Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6e43829b

net/sctp/sm_statefuns.c

+3 −6
Original line number Diff line number Diff line
@@ -5899,12 +5899,6 @@ static int sctp_eat_data(const struct sctp_association *asoc, 
		return SCTP_IERROR_NO_DATA;

	}



	/* If definately accepting the DATA chunk, record its TSN, otherwise

	 * wait for renege processing.

	 */

	if (SCTP_CMD_CHUNK_ULP == deliver)

		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));



	chunk->data_accepted = 1;



	/* Note: Some chunks may get overcounted (if we drop) or overcounted
@@ -5924,6 +5918,9 @@ static int sctp_eat_data(const struct sctp_association *asoc, 
	 * and discard the DATA chunk.

	 */

	if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {

		/* Mark tsn as received even though we drop it */

		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));



		err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,

					 &data_hdr->stream,

					 sizeof(data_hdr->stream));

net/sctp/ulpevent.c

+5 −0
Original line number Diff line number Diff line
@@ -710,6 +710,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc, 
	if (!skb)

		goto fail;



	/* Now that all memory allocations for this chunk succeeded, we

	 * can mark it as received so the tsn_map is updated correctly.

	 */

	sctp_tsnmap_mark(&asoc->peer.tsn_map, ntohl(chunk->subh.data_hdr->tsn));



	/* First calculate the padding, so we don't inadvertently

	 * pass up the wrong length to the user.

	 *

CRA Git | Maintained and supported by SUSTech CRA and CCSE