Page MenuHomeFreeBSD

tcp: Two bugs in rack one of which can lead to a panic.
ClosedPublic

Authored by rrs on Sep 22 2021, 7:18 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Jun 25, 11:03 PM
Unknown Object (File)
Sat, Jun 8, 9:00 PM
Unknown Object (File)
Fri, Jun 7, 10:35 PM
Unknown Object (File)
Fri, Jun 7, 10:35 PM
Unknown Object (File)
Fri, Jun 7, 10:23 PM
Unknown Object (File)
Wed, Jun 5, 9:47 PM
Unknown Object (File)
May 25 2024, 11:33 PM
Unknown Object (File)
May 11 2024, 7:58 PM
Subscribers

Details

Summary

In extensive testing in NF we have found two issues inside
the rack stack.

  1. An incorrect offset is being generated by the fast send path when a fast send is initiated on the end of the socket buffer and before the fast send runs, the sb_compress macro adds data to the trailing socket. This fools the fast send code into thinking the sb offset changed and it miscalculates a "updated offset". It should only do that when the mbuf in question got smaller.. i.e. an ack was processed. This can lead to a panic deref'ing a NULL mbuf if that packet is ever retransmitted. At the best case it leads to invalid data being sent to the client which usually terminates the connection. The fix is to have the proper logic (that is in the rsm fast path) to make sure we only update the offset when the mbuf shrinks.
  1. The other issue is more bothersome. The timestamp check in rack needs to use the msec timestamp when comparing the timestamp echo to now. It was using a microsecond timestamp which ends up giving error prone results but causes only small harm in trying to identify which send to use in RTT calculations if its a retransmit.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable