From 755c1f07c8da67ce8a07c759f4ce7445958d9e28 Mon Sep 17 00:00:00 2001
From: Andras Olah <olah@FreeBSD.org>
Date: Wed, 5 Apr 1995 10:32:14 +0000
Subject: [PATCH] Fix a bug in tcp_input reported by Rick Jones
 <raj@hpisrdq.cup.hp.com>.

If a goto findpcb occurred during the processing of a segment, the TCP and
IP headers were dropped twice from the mbuf which resulted in data acked
by TCP but not delivered to the user.
Reviewed by:	davidg
---
 sys/netinet/tcp_input.c | 19 ++++++++-----------
 sys/netinet/tcp_reass.c | 19 ++++++++-----------
 2 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index c35f03843f16..d9f287df2414 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	From: @(#)tcp_input.c	8.5 (Berkeley) 4/10/94
- *	$Id: tcp_input.c,v 1.16 1995/03/16 18:15:04 bde Exp $
+ *	$Id: tcp_input.c,v 1.17 1995/03/27 07:12:24 davidg Exp $
  */
 
 #ifndef TUBA_INCLUDE
@@ -323,6 +323,12 @@ tcp_input(m, iphlen)
 	NTOHS(ti->ti_win);
 	NTOHS(ti->ti_urp);
 
+	/*
+	 * Drop TCP, IP headers and TCP options.
+	 */
+	m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
+	m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
+
 	/*
 	 * Locate pcb for segment.
 	 */
@@ -515,11 +521,8 @@ findpcb:
 			tcpstat.tcps_rcvpack++;
 			tcpstat.tcps_rcvbyte += ti->ti_len;
 			/*
-			 * Drop TCP, IP headers and TCP options then add data
-			 * to socket buffer.
+			 * Add data to socket buffer.
 			 */
-			m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-			m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 			sbappend(&so->so_rcv, m);
 			sorwakeup(so);
 			/*
@@ -537,12 +540,6 @@ findpcb:
 		}
 	}
 
-	/*
-	 * Drop TCP, IP headers and TCP options.
-	 */
-	m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-	m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-
 	/*
 	 * Calculate amount of space in receive window,
 	 * and then do TCP input processing.
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index c35f03843f16..d9f287df2414 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	From: @(#)tcp_input.c	8.5 (Berkeley) 4/10/94
- *	$Id: tcp_input.c,v 1.16 1995/03/16 18:15:04 bde Exp $
+ *	$Id: tcp_input.c,v 1.17 1995/03/27 07:12:24 davidg Exp $
  */
 
 #ifndef TUBA_INCLUDE
@@ -323,6 +323,12 @@ tcp_input(m, iphlen)
 	NTOHS(ti->ti_win);
 	NTOHS(ti->ti_urp);
 
+	/*
+	 * Drop TCP, IP headers and TCP options.
+	 */
+	m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
+	m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
+
 	/*
 	 * Locate pcb for segment.
 	 */
@@ -515,11 +521,8 @@ findpcb:
 			tcpstat.tcps_rcvpack++;
 			tcpstat.tcps_rcvbyte += ti->ti_len;
 			/*
-			 * Drop TCP, IP headers and TCP options then add data
-			 * to socket buffer.
+			 * Add data to socket buffer.
 			 */
-			m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-			m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 			sbappend(&so->so_rcv, m);
 			sorwakeup(so);
 			/*
@@ -537,12 +540,6 @@ findpcb:
 		}
 	}
 
-	/*
-	 * Drop TCP, IP headers and TCP options.
-	 */
-	m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-	m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
-
 	/*
 	 * Calculate amount of space in receive window,
 	 * and then do TCP input processing.