Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95ac7b85 authored by Lee A. Roberts's avatar Lee A. Roberts Committed by David S. Miller
Browse files

sctp: fix association hangs due to errors when reneging events from the ordering queue 



In sctp_ulpq_renege_list(), events being reneged from the
ordering queue may correspond to multiple TSNs.  Identify
all affected packets; sum freed space and renege from the
tsnmap.

Signed-off-by: default avatarLee A. Roberts <lee.roberts@hp.com>
Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
parent e67f85ec

net/sctp/ulpqueue.c

+22 −4
Original line number Diff line number Diff line
@@ -962,8 +962,8 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq, 
		struct sk_buff_head *list, __u16 needed)

{

	__u16 freed = 0;

	__u32 tsn;

	struct sk_buff *skb;

	__u32 tsn, last_tsn;

	struct sk_buff *skb, *flist, *last;

	struct sctp_ulpevent *event;

	struct sctp_tsnmap *tsnmap;
@@ -977,10 +977,28 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq, 
		if (TSN_lte(tsn, sctp_tsnmap_get_ctsn(tsnmap)))

			break;



		__skb_unlink(skb, list);

		/* Events in ordering queue may have multiple fragments

		 * corresponding to additional TSNs.  Sum the total

		 * freed space; find the last TSN.

		 */

		freed += skb_headlen(skb);

		flist = skb_shinfo(skb)->frag_list;

		for (last = flist; flist; flist = flist->next) {

			last = flist;

			freed += skb_headlen(last);

		}

		if (last)

			last_tsn = sctp_skb2event(last)->tsn;

		else

			last_tsn = tsn;



		/* Unlink the event, then renege all applicable TSNs. */

		__skb_unlink(skb, list);

		sctp_ulpevent_free(event);

		while (TSN_lte(tsn, last_tsn)) {

			sctp_tsnmap_renege(tsnmap, tsn);

			tsn++;

		}

		if (freed >= needed)

			return freed;

	}