Page MenuHomeFreeBSD

tcp rack: fix switch to RACK when a FIN has already been sent
ClosedPublic

Authored by tuexen on Jul 6 2022, 1:28 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Jul 6, 11:06 PM
Unknown Object (File)
Sat, Jul 5, 8:56 PM
Unknown Object (File)
Sat, Jul 5, 6:11 AM
Unknown Object (File)
Thu, Jun 26, 6:02 PM
Unknown Object (File)
Thu, Jun 26, 5:46 PM
Unknown Object (File)
Mon, Jun 16, 8:00 AM
Unknown Object (File)
Mon, Jun 16, 7:33 AM
Unknown Object (File)
Mon, Jun 16, 6:09 AM

Details

Summary

Fix the rack sendmap entry in case a FIN has been sent when the stack is switched over to RACK.

This issue was found by syzkaller.

Test Plan

Run the following packetdrill-script:

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

tuexen requested review of this revision.Jul 6 2022, 1:28 PM
sys/netinet/tcp_stacks/rack.c
12613

Should this assignment move into the else block below? rsm->r_end is written to again in the other branch.

sys/netinet/tcp_stacks/rack.c
12613

No. The code below will in a follow-up commit be changed to:

if (tp->snd_una == tp->iss)
    rsm->r_flags |= RACK_HAS_SYN;
rsm->r_start = tp->snd_una;

This is equivalent. I guess one should also add a condition which ensures that there hasn't been a wrap-around and SND.UNA is equal to ISS. This test can be based on the state of the TCP connection.
I plan to do that in a separate review once this change is in.

This revision is now accepted and ready to land.Jul 18 2022, 7:01 PM