Address issues found by the clang code analyzer.

5 files changed, 48 insertions, 40 deletions

diff --git a/usrsctplib/netinet/sctp_indata.c b/usrsctplib/netinet/sctp_indata.c
index a2ff3db5..42590671 100755
--- a/usrsctplib/netinet/sctp_indata.c
+++ b/usrsctplib/netinet/sctp_indata.c
@@ -32,7 +32,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 298203 2016-04-18 11:39:41Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 298223 2016-04-18 20:16:41Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -432,13 +432,13 @@ sctp_place_control_in_stream(struct sctp_stream_in *strm,
 
 static void
 sctp_abort_in_reasm(struct sctp_tcb *stcb,
-                    struct sctp_stream_in *strm,
                     struct sctp_queued_to_read *control,
                     struct sctp_tmit_chunk *chk,
                     int *abort_flag, int opspot)
 {
 	char msg[SCTP_DIAG_INFO_LEN];
 	struct mbuf *oper;
+
 	if (stcb->asoc.idata_supported) {
 		snprintf(msg, sizeof(msg),
 			 "Reass %x,CF:%x,TSN=%8.8x,SID=%4.4x,FSN=%8.8x,MID:%8.8x",
@@ -449,7 +449,7 @@ sctp_abort_in_reasm(struct sctp_tcb *stcb,
 			 chk->rec.data.fsn_num, chk->rec.data.stream_seq);
 	} else {
 		snprintf(msg, sizeof(msg),
-			 "Reass %x, CI:%x,TSN=%8.8x,SID=%4.4x,FSN=%4.4x, SSN:%4.4x",
+			 "Reass %x,CI:%x,TSN=%8.8x,SID=%4.4x,FSN=%4.4x,SSN:%4.4x",
 			 opspot,
 			 control->fsn_included,
 			 chk->rec.data.TSN_seq,
@@ -627,15 +627,13 @@ sctp_queue_data_to_stream(struct sctp_tcb *stcb,
 		 * to put it on the queue.
 		 */
 		if (sctp_place_control_in_stream(strm, asoc, control)) {
-			char msg[SCTP_DIAG_INFO_LEN];
-			struct mbuf *oper;
 			snprintf(msg, sizeof(msg),
 				 "Queue to str msg_id: %u duplicate",
 				 control->msg_id);
 			clean_up_control(stcb, control);
-			oper = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
+			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
-			sctp_abort_an_association(stcb->sctp_ep, stcb, oper, SCTP_SO_NOT_LOCKED);
+			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 			*abort_flag = 1;
 		}
 	}
@@ -842,7 +840,7 @@ restart:
 					TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
 					control->on_strm_q = 0;
 				}
-				sctp_wakeup_the_read_socket(stcb->sctp_ep);
+				sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 				if ((nc) && (nc->first_frag_seen)) {
 					/* Switch to the new guy and continue */
 					control = nc;
@@ -862,7 +860,7 @@ restart:
 		                  SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
 		strm->pd_api_started = 1;
 		control->pdapi_started = 1;
-		sctp_wakeup_the_read_socket(stcb->sctp_ep);
+		sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 		return (0);
 	} else {
 		return (1);
@@ -871,7 +869,6 @@ restart:
 
 static void
 sctp_inject_old_data_unordered(struct sctp_tcb *stcb, struct sctp_association *asoc,
-			       struct sctp_stream_in *strm,
 			       struct sctp_queued_to_read *control,
 			       struct sctp_tmit_chunk *chk,
 			       int *abort_flag)
@@ -912,7 +909,7 @@ sctp_inject_old_data_unordered(struct sctp_tcb *stcb, struct sctp_association *a
 				 * no way to recover. This really will only happen
 				 * if we can get more TSN's higher before the pd-api-point.
 				 */
-				sctp_abort_in_reasm(stcb, strm, control, chk,
+				sctp_abort_in_reasm(stcb, control, chk,
 						    abort_flag,
 						    SCTP_FROM_SCTP_INDATA + SCTP_LOC_4);
 
@@ -975,7 +972,7 @@ place_chunk:
 				chk->data = NULL;
 			}
 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
-			sctp_abort_in_reasm(stcb, strm, control, chk,
+			sctp_abort_in_reasm(stcb, control, chk,
 			                    abort_flag,
 			                    SCTP_FROM_SCTP_INDATA + SCTP_LOC_5);
 			return;
@@ -1017,7 +1014,6 @@ sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc, s
 	if ((control) &&
 	    (asoc->idata_supported == 0)) {
 		/* Special handling needed for "old" data format */
-		nctl = TAILQ_NEXT(control, next_instrm);
 		if (sctp_handle_old_data(stcb, asoc, strm, control, pd_point)) {
 			goto done_un;
 		}
@@ -1265,7 +1261,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 		if (sctp_place_control_in_stream(strm, asoc, control)) {
 			/* Duplicate SSN? */
 			clean_up_control(stcb, control);
-			sctp_abort_in_reasm(stcb, strm, control, chk,
+			sctp_abort_in_reasm(stcb, control, chk,
 					    abort_flag,
 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_6);
 			return;
@@ -1277,7 +1273,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 			 * up to the cum-ack then its invalid.
 			 */
 			if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
-				sctp_abort_in_reasm(stcb, strm, control, chk,
+				sctp_abort_in_reasm(stcb, control, chk,
 				                    abort_flag,
 				                    SCTP_FROM_SCTP_INDATA + SCTP_LOC_7);
 				return;
@@ -1285,7 +1281,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 		}
 	}
 	if ((asoc->idata_supported == 0) && (unordered == 1)) {
-		sctp_inject_old_data_unordered(stcb, asoc, strm, control, chk, abort_flag);
+		sctp_inject_old_data_unordered(stcb, asoc, control, chk, abort_flag);
 		return;
 	}
 	/*
@@ -1307,7 +1303,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 			 * or they sent two un-ordered chunks that
 			 * were fragmented at the same time in the same stream.
 			 */
-			sctp_abort_in_reasm(stcb, strm, control, chk,
+			sctp_abort_in_reasm(stcb, control, chk,
 			                    abort_flag,
 			                    SCTP_FROM_SCTP_INDATA + SCTP_LOC_8);
 			return;
@@ -1345,7 +1341,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				 */
 				if (SCTP_TSN_GE(control->fsn_included, chk->rec.data.fsn_num)) {
 					/* We have already delivered up to this so its a dup */
-					sctp_abort_in_reasm(stcb, strm, control, chk,
+					sctp_abort_in_reasm(stcb, control, chk,
 							    abort_flag,
 							    SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
 					return;
@@ -1357,7 +1353,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				SCTPDBG(SCTP_DEBUG_XXX,
 					"Duplicate last fsn: %u (top: %u) -- abort\n",
 					chk->rec.data.fsn_num, control->top_fsn);
-				sctp_abort_in_reasm(stcb, strm, control,
+				sctp_abort_in_reasm(stcb, control,
 						    chk, abort_flag,
 						    SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
 				return;
@@ -1375,7 +1371,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 					SCTPDBG(SCTP_DEBUG_XXX,
 						"New fsn: %u is already seen in included_fsn: %u -- abort\n",
 						chk->rec.data.fsn_num, control->fsn_included);
-					sctp_abort_in_reasm(stcb, strm, control, chk,
+					sctp_abort_in_reasm(stcb, control, chk,
 							    abort_flag,
 							    SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
 					return;
@@ -1387,7 +1383,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 					"New fsn: %u is beyond or at top_fsn: %u -- abort\n",
 					chk->rec.data.fsn_num,
 					control->top_fsn);
-				sctp_abort_in_reasm(stcb, strm, control, chk,
+				sctp_abort_in_reasm(stcb, control, chk,
 						    abort_flag,
 						    SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
 				return;
@@ -1427,7 +1423,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				SCTPDBG(SCTP_DEBUG_XXX,
 					"Duplicate to fsn: %u -- abort\n",
 					at->rec.data.fsn_num);
-				sctp_abort_in_reasm(stcb, strm, control,
+				sctp_abort_in_reasm(stcb, control,
 						    chk, abort_flag,
 						    SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
 				return;
@@ -1485,7 +1481,7 @@ sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 	}
 	if ((control->on_read_q) && (cnt_added > 0)) {
 		/* Need to wakeup the reader */
-		sctp_wakeup_the_read_socket(stcb->sctp_ep);
+		sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 	}
 }
 
@@ -1546,7 +1542,6 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
 	if (chtype == SCTP_IDATA) {
 		nch = (struct sctp_idata_chunk *)sctp_m_getptr(*m, offset,
 							     sizeof(struct sctp_idata_chunk), (uint8_t *) &chunk_buf);
-
 		ch = (struct sctp_data_chunk *)nch;
 		clen = sizeof(struct sctp_idata_chunk);
 		tsn = ntohl(ch->dp.tsn);
@@ -1559,7 +1554,6 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
 	} else {
 		ch = (struct sctp_data_chunk *)sctp_m_getptr(*m, offset,
 							     sizeof(struct sctp_data_chunk), (uint8_t *) &chunk_buf);
-
 		tsn = ntohl(ch->dp.tsn);
 		clen = sizeof(struct sctp_data_chunk);
 		fsn = tsn;
@@ -1573,15 +1567,12 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
 		 * Need to send an abort since we had a
 		 * empty data chunk.
 		 */
-		struct mbuf *op_err;
-
 		op_err = sctp_generate_no_user_data_cause(ch->dp.tsn);
 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_14;
 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 		*abort_flag = 1;
 		return (0);
 	}
-	ordered = ((chunk_flags & SCTP_DATA_UNORDERED) == 0);
 	if ((chunk_flags & SCTP_DATA_SACK_IMMEDIATELY) == SCTP_DATA_SACK_IMMEDIATELY) {
 		asoc->send_sack = 1;
 	}
diff --git a/usrsctplib/netinet/sctp_usrreq.c b/usrsctplib/netinet/sctp_usrreq.c
index 1907e605..aaaaaaec 100755
--- a/usrsctplib/netinet/sctp_usrreq.c
+++ b/usrsctplib/netinet/sctp_usrreq.c
@@ -32,7 +32,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_usrreq.c 298132 2016-04-16 21:34:49Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_usrreq.c 298223 2016-04-18 20:16:41Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -396,13 +396,18 @@ void *
 #endif
 sctp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
 {
-	struct ip *outer_ip, *inner_ip;
+#if defined(__FreeBSD__)
+	struct ip *outer_ip;
+#endif
+	struct ip *inner_ip;
 	struct sctphdr *sh;
 	struct icmp *icmp;
 	struct sctp_inpcb *inp;
 	struct sctp_tcb *stcb;
 	struct sctp_nets *net;
+#if defined(__FreeBSD__)
 	struct sctp_init_chunk *ch;
+#endif
 	struct sockaddr_in src, dst;
 
 	if (sa->sa_family != AF_INET ||
@@ -426,7 +431,9 @@ sctp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
 		inner_ip = (struct ip *)vip;
 		icmp = (struct icmp *)((caddr_t)inner_ip -
 		    (sizeof(struct icmp) - sizeof(struct ip)));
+#if defined(__FreeBSD__)
 		outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
+#endif
 		sh = (struct sctphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
 		memset(&src, 0, sizeof(struct sockaddr_in));
 		src.sin_family = AF_INET;
@@ -499,7 +506,7 @@ sctp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
 #if defined(__FreeBSD__) && __FreeBSD_version >= 1000000
 			            ntohs(inner_ip->ip_len),
 #else
-			            ip_inner->ip_len,
+			            inner_ip->ip_len,
 #endif
 			            ntohs(icmp->icmp_nextmtu));
 		} else {
diff --git a/usrsctplib/netinet/sctputil.c b/usrsctplib/netinet/sctputil.c
index 697389da..df6cd0cf 100755
--- a/usrsctplib/netinet/sctputil.c
+++ b/usrsctplib/netinet/sctputil.c
@@ -32,7 +32,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctputil.c 298199 2016-04-18 09:29:14Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctputil.c 298223 2016-04-18 20:16:41Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -4741,9 +4741,15 @@ sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
 }
 
 void
-sctp_wakeup_the_read_socket(struct sctp_inpcb *inp)
+sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
+    struct sctp_tcb *stcb,
+    int so_locked
+#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
+    SCTP_UNUSED
+#endif
+)
 {
-	if (inp && inp->sctp_socket) {
+	if ((inp != NULL) && (inp->sctp_socket != NULL)) {
 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
 			SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
 		} else {
@@ -4946,7 +4952,7 @@ sctp_add_to_readq(struct sctp_inpcb *inp,
 	if (inp_read_lock_held == 0)
 		SCTP_INP_READ_UNLOCK(inp);
 	if (inp && inp->sctp_socket) {
-		sctp_wakeup_the_read_socket(inp);
+		sctp_wakeup_the_read_socket(inp, stcb, so_locked);
 	}
 }
 
diff --git a/usrsctplib/netinet/sctputil.h b/usrsctplib/netinet/sctputil.h
index 2bd5253f..15737063 100755
--- a/usrsctplib/netinet/sctputil.h
+++ b/usrsctplib/netinet/sctputil.h
@@ -32,7 +32,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctputil.h 297662 2016-04-07 09:10:34Z rrs $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctputil.h 298223 2016-04-18 20:16:41Z tuexen $");
 #endif
 
 #ifndef _NETINET_SCTP_UTIL_H_
@@ -107,7 +107,12 @@ void
 sctp_mtu_size_reset(struct sctp_inpcb *, struct sctp_association *, uint32_t);
 
 void
-sctp_wakeup_the_read_socket(struct sctp_inpcb *inp);
+sctp_wakeup_the_read_socket(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
+    int so_locked
+#if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
+    SCTP_UNUSED
+#endif
+);
 
 void
 sctp_add_to_readq(struct sctp_inpcb *inp,
diff --git a/usrsctplib/netinet6/sctp6_usrreq.c b/usrsctplib/netinet6/sctp6_usrreq.c
index 641289e7..045aee77 100644
--- a/usrsctplib/netinet6/sctp6_usrreq.c
+++ b/usrsctplib/netinet6/sctp6_usrreq.c
@@ -32,7 +32,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet6/sctp6_usrreq.c 298132 2016-04-16 21:34:49Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet6/sctp6_usrreq.c 298223 2016-04-18 20:16:41Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -408,7 +408,6 @@ sctp6_notify(struct sctp_inpcb *inp,
 		} else {
 			timer_stopped = 0;
 		}
-		break;
 		/* Update the path MTU. */
 		if (net->mtu > next_mtu) {
 			net->mtu = next_mtu;
@@ -479,7 +478,7 @@ sctp6_ctlinput(int cmd, struct sockaddr *pktdst, void *d)
 		 * verification tag of the SCTP common header.
 		 */
 		if (ip6cp->ip6c_m->m_pkthdr.len <
-		    ip6cp->ip6c_off + offsetof(struct sctphdr, checksum)) {
+		    (int32_t)(ip6cp->ip6c_off + offsetof(struct sctphdr, checksum))) {
 			return;
 		}