Hi Marcelo,

RHEL7.1 is version that I was able to repro internally and customer is using RHEL7.5.
RHEL7.5 is still valid, hence could you please investigate the issue?

I really need confirmation whether this is defect or not first since IETF RFC seems not very specific.

(In reply to jajeon from comment #10)
> Hi Marcelo,
> 
> RHEL7.1 is version that I was able to repro internally and customer is using
> RHEL7.5.
> RHEL7.5 is still valid, hence could you please investigate the issue? 
> 
> I really need confirmation whether this is defect or not first since IETF
> RFC seems not very specific.

It might not say it very specifically, but it's clear that SACK is a control chunk, no matter it's bundled with DATA chunks or not.
The issue is in sctp_packet_bundle_sack() which won't go to the path in c2, we need a fix:

static enum sctp_xmit sctp_packet_bundle_sack(struct sctp_packet *pkt,
                                              struct sctp_chunk *chunk)
{
...
                        sack = sctp_make_sack(asoc);
                        if (sack) {
                                retval = __sctp_packet_append_chunk(pkt, sack);
                                if (retval != SCTP_XMIT_OK) {
                                        sctp_chunk_free(sack);
                                        goto out;
                                }
+                               asoc->stats.octrlchunks++; <--- we need asd
                                asoc->peer.sack_needed = 0;
                                if (del_timer(timer))
                                        sctp_association_put(asoc);
                        }
...

Patch(es) committed on kernel-3.10.0-1069.el7

this bug can be verified on version:kernel-3.10.0-1070.el7.x86_64

https://beaker.engineering.redhat.com/jobs/3725483


:: [ 05:37:30 ] :: [  BEGIN   ] :: Running 'SctpOutCtrlChunks=0'
:: [ 05:37:30 ] :: [   PASS   ] :: Command 'SctpOutCtrlChunks=0' (Expected 0, got 0)
:: [ 05:37:30 ] :: [  BEGIN   ] :: Running 'SctpInCtrlChunks=0'
:: [ 05:37:30 ] :: [   PASS   ] :: Command 'SctpInCtrlChunks=0' (Expected 0, got 0)
:: [ 05:37:52 ] :: [  BEGIN   ] :: Running 'SctpOutCtrlChunks1=30'
:: [ 05:37:52 ] :: [   PASS   ] :: Command 'SctpOutCtrlChunks1=30' (Expected 0, got 0)
:: [ 05:37:52 ] :: [  BEGIN   ] :: Running 'SctpInCtrlChunks1=30'
:: [ 05:37:52 ] :: [   PASS   ] :: Command 'SctpInCtrlChunks1=30' (Expected 0, got 0)
:: [ 05:37:52 ] :: [   PASS   ] :: SctpOutCtrlChunks:30 should be equal to SctpInCtrlChunks:30 (Assert: '30' should equal '30')

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:1016