When so_unsplice() is called on a socket that is is starting to be spliced spliced (state == SPLICE_INIT), it gives up and does nothing.
This causes leaked socket reference counts, leading to leaked tcpcb / inpcbs and elevated numbers of connections
stuck in the CLOSED state. This happens when so_splice() fails and tries to tear down its state using so_unsplice.
Fixed by changing the state to SPLICE_EXCEPTION so that so_unsplice() can succeed when called.
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
Remove changes to the so_unsplice() path on SPLICE_INIT splices.. @markj correctly pointed out that codepath is not a problem.
Comment Actions
Looks good, thanks. This should be Fixes: c0c5d01e5374 ("so_splice: Synchronize so_unsplice() with so_splice()")
Comment Actions
- realized that so_unsplice can be called with an so2 that's already been recycled when its called via so_splice(), since we don't hold a reference. So ensure we null out sp_dest and deal with a NULL so2 in so_unsplice