Commit 3888e9ef authored by Vlad Yasevich's avatar Vlad Yasevich Committed by David S. Miller

sctp: Mark the tsn as received after all allocations finish

If we don't have the buffer space or memory allocations fail,
the data chunk is dropped, but TSN is still reported as received.
This introduced a data loss that can't be recovered.  We should
only mark TSNs are received after memory allocations finish.
The one exception is the invalid stream identifier, but that's
due to user error and is reported back to the user.

This was noticed by Michael Tuexen.
Signed-off-by: default avatarVlad Yasevich <>
Signed-off-by: default avatarDavid S. Miller <>
parent 6e43829b
......@@ -5899,12 +5899,6 @@ static int sctp_eat_data(const struct sctp_association *asoc,
/* If definately accepting the DATA chunk, record its TSN, otherwise
* wait for renege processing.
if (SCTP_CMD_CHUNK_ULP == deliver)
sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
chunk->data_accepted = 1;
/* Note: Some chunks may get overcounted (if we drop) or overcounted
......@@ -5924,6 +5918,9 @@ static int sctp_eat_data(const struct sctp_association *asoc,
* and discard the DATA chunk.
if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
/* Mark tsn as received even though we drop it */
sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
......@@ -710,6 +710,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
if (!skb)
goto fail;
/* Now that all memory allocations for this chunk succeeded, we
* can mark it as received so the tsn_map is updated correctly.
sctp_tsnmap_mark(&asoc->peer.tsn_map, ntohl(chunk->subh.data_hdr->tsn));
/* First calculate the padding, so we don't inadvertently
* pass up the wrong length to the user.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment