Page MenuHomeFreeBSD

tcp_hpts: let tcp_hpts_init() set a random CPU only once
ClosedPublic

Authored by glebius on Dec 7 2023, 1:07 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Nov 17, 6:27 PM
Unknown Object (File)
Wed, Nov 13, 3:47 PM
Unknown Object (File)
Tue, Nov 12, 8:30 PM
Unknown Object (File)
Tue, Nov 12, 8:19 PM
Unknown Object (File)
Sun, Nov 10, 2:02 PM
Unknown Object (File)
Sun, Nov 10, 10:32 AM
Unknown Object (File)
Sat, Nov 9, 1:50 AM
Unknown Object (File)
Thu, Oct 31, 3:29 PM
Subscribers

Details

Summary

After d2ef52ef3dee the tcp_hpts_init() function can be called multiple
times on a tcpcb if it is switched there and back between two TCP stacks.
First, this makes existing assertion in tcp_hpts_init() incorrect. Second,
it creates possibility to change a randomly set t_hpts_cpu to a different
random value, while a tcpcb is already in the HPTS wheel, triggering other
assertions later in tcp_hptsi().

The best approach here would be to work on the stacks to really clear a
tcpcb out of HPTS wheel in tfb_tcp_fb_fini, draining the IHPTS_MOVING
state. But that's pretty intrusive change, so let's just get back to the
old logic (pre d2ef52ef3dee) where t_hpts_cpu was set to a random value
only once in a CPU lifetime and a newly switched stack inherits t_hpts_cpu
from the previous stack.

Reported-by: syzbot+fab29fe1ab089c52998d@syzkaller.appspotmail.com
Reported-by: syzbot+ca5f2aa0fda15dcfe6d7@syzkaller.appspotmail.com
Fixes: 2b3a77467dd3d74a7170f279fb25f9736b46ef8a

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable