Differential D25486

Improve error path in BBR
ClosedPublic
Actions

Authored by tuexen on Jun 27 2020, 1:56 PM.

Tags

None

Referenced Files

	F125480897: D25486.diff
	Fri, Aug 8, 6:11 AM

	F125455539: D25486.id73760.diff
	Fri, Aug 8, 12:09 AM

	Unknown Object (File)
	Tue, Jul 22, 2:25 PM

	Unknown Object (File)
	Tue, Jul 22, 2:25 PM

	Unknown Object (File)
	Tue, Jul 22, 2:25 PM

	Unknown Object (File)
	Tue, Jul 22, 2:25 PM

	Unknown Object (File)
	Jun 29 2025, 4:42 AM

	Unknown Object (File)
	Jun 17 2025, 6:14 AM

View All 53 Files

Subscribers

Details

Reviewers

rrs
rscheff

Group Reviewers

Commits

rS362846: Fix the cleanup handling in a error path for TCP BBR.

Summary

syzkaller found a bug in the BBR code. On an error path, the socket buffer was not unlocked. Free also on this path the allocated mbuf.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 32009

Event Timeline

tuexen created this revision.Jun 27 2020, 1:56 PM

Herald added a reviewer: transport. · View Herald TranscriptJun 27 2020, 1:56 PM

Herald added subscribers: melifaro, imp. · View Herald Transcript

tuexen requested review of this revision.Jun 27 2020, 1:56 PM

Harbormaster completed remote builds in B32009: Diff 73760.Jun 27 2020, 1:57 PM

tuexen edited the summary of this revision. (Show Details)Jun 27 2020, 1:57 PM

This mechanical change looks good to me. Just wondering is similar missing sbunlock would be in RACK or elsewhere in BBR. (but didn't spot anything obvious just now)

This revision is now accepted and ready to land.Jun 27 2020, 3:04 PM

In D25486#562860, @rscheff wrote:

This mechanical change looks good to me. Just wondering is similar missing sbunlock would be in RACK or elsewhere in BBR. (but didn't spot anything obvious just now)

syzkaller triggered the condition. I looked for other cases, but did not spot any. That doesn't mean that they don't exist... Maybe syzkaller will find other issue, I don't know. That is the reason why it it constantly running...

Closed by commit rS362846: Fix the cleanup handling in a error path for TCP BBR. (authored by tuexen). · Explain WhyJul 1 2020, 5:17 PM

This revision was automatically updated to reflect the committed changes.

tuexen added a commit: rS362846: Fix the cleanup handling in a error path for TCP BBR..

Revision Contents
Changeset List

Path

Size

sys/

netinet/

tcp_stacks/

2 lines

Diff 73760

sys/netinet/tcp_stacks/bbr.c

Loading...