Page MenuHomeFreeBSD

tcp: in tcp_close() call tcp_timer_stop() after pcb has been dropped
AbandonedPublic

Authored by glebius on May 31 2024, 6:21 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Jul 14, 10:42 AM
Unknown Object (File)
Sat, Jul 6, 8:38 PM
Unknown Object (File)
Sat, Jun 22, 8:05 AM
Unknown Object (File)
Jun 6 2024, 3:43 AM
Unknown Object (File)
Jun 2 2024, 6:42 PM
Subscribers

Details

Reviewers
tuexen
rscheff
rrs
jtl
Group Reviewers
transport
Summary

The tcp_timer_stop() is designed to be called when the pcb belongs solely
to the calling thread and can't be looked up via in_pcblookup(). The
function may release lock which creates a race if used on a pcb that can
be found by an other thread.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 57975
Build 54863: arc lint + arc unit

Event Timeline

This revision is now accepted and ready to land.May 31 2024, 6:24 PM

If the summary is true, wouldn't it be good to KASSERT that (inp->inp_flags & INP_DROPPED) != 0 after we have removed the two calls of tcp_timer_stop() from the RACK code? Willing to work on it...

This doesn't fix anything.