Page MenuHomeFreeBSD

tcp_hpts: let tcp_hpts_init() set a random CPU only once
ClosedPublic

Authored by glebius on Dec 7 2023, 1:07 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Apr 30, 9:00 AM
Unknown Object (File)
Sun, Apr 7, 9:20 AM
Unknown Object (File)
Sun, Apr 7, 5:28 AM
Unknown Object (File)
Jan 31 2024, 6:25 AM
Unknown Object (File)
Jan 16 2024, 7:14 PM
Unknown Object (File)
Jan 11 2024, 8:11 PM
Unknown Object (File)
Dec 29 2023, 5:33 PM
Unknown Object (File)
Dec 7 2023, 11:16 PM
Subscribers

Details

Summary

After d2ef52ef3dee the tcp_hpts_init() function can be called multiple
times on a tcpcb if it is switched there and back between two TCP stacks.
First, this makes existing assertion in tcp_hpts_init() incorrect. Second,
it creates possibility to change a randomly set t_hpts_cpu to a different
random value, while a tcpcb is already in the HPTS wheel, triggering other
assertions later in tcp_hptsi().

The best approach here would be to work on the stacks to really clear a
tcpcb out of HPTS wheel in tfb_tcp_fb_fini, draining the IHPTS_MOVING
state. But that's pretty intrusive change, so let's just get back to the
old logic (pre d2ef52ef3dee) where t_hpts_cpu was set to a random value
only once in a CPU lifetime and a newly switched stack inherits t_hpts_cpu
from the previous stack.

Reported-by: syzbot+fab29fe1ab089c52998d@syzkaller.appspotmail.com
Reported-by: syzbot+ca5f2aa0fda15dcfe6d7@syzkaller.appspotmail.com
Fixes: 2b3a77467dd3d74a7170f279fb25f9736b46ef8a

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable