Page MenuHomeFreeBSD
Differential D26145

Overrunning array fix
ClosedPublic
Actions

Authored by bret_ketchum_dell.com on Aug 21 2020, 3:22 PM.
Tags
None
Referenced Files
F114221047: D26145.id76061.diff
Wed, Apr 9, 9:28 AM
Unknown Object (File)
Wed, Mar 19, 7:43 PM
Unknown Object (File)
Mon, Mar 17, 2:54 AM
Unknown Object (File)
Sat, Mar 15, 9:06 PM
Unknown Object (File)
Mar 7 2025, 8:46 PM
Unknown Object (File)
Feb 18 2025, 8:40 AM
Unknown Object (File)
Feb 13 2025, 10:44 AM
Unknown Object (File)
Feb 9 2025, 2:06 PM
View All Files
Subscribers
imp

Details

Reviewers
rpokala
vangyzen
Commits
rS364989: jedec_dimm: fix array overrun
Summary

Coverity detected the overrunning of sc->part_str.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
head/
sys/
dev/
jedec_dimm/
2 lines

Diff 76407

View Options

head/sys/dev/jedec_dimm/jedec_dimm.c

Show First 20 Lines • Show All 602 Lines • ▼ Show 20 Lines#ifdef INET6
int isipv6; int isipv6;
#else #else
const void *ip6 = NULL; const void *ip6 = NULL;
#endif /* INET6 */ #endif /* INET6 */
struct tcpopt to; /* options in this segment */ struct tcpopt to; /* options in this segment */
char *s = NULL; /* address and port logging */ char *s = NULL; /* address and port logging */
int ti_locked; int ti_locked;
#define TI_UNLOCKED 1 #define TI_UNLOCKED 1
#define TI_WLOCKED 2 #define TI_RLOCKED 2
#ifdef TCPDEBUG #ifdef TCPDEBUG
/* /*
* The size of tcp_saveipgen must be the size of the max ip header, * The size of tcp_saveipgen must be the size of the max ip header,
* now IPv6. * now IPv6.
*/ */
u_char tcp_saveipgen[IP6_HDR_LEN]; u_char tcp_saveipgen[IP6_HDR_LEN];
struct tcphdr tcp_savetcp; struct tcphdr tcp_savetcp;
▲ Show 20 Lines • Show All 172 Lines • ▼ Show 20 Lines#endif
/* /*
* Locate pcb for segment; if we're likely to add or remove a * Locate pcb for segment; if we're likely to add or remove a
* connection then first acquire pcbinfo lock. There are three cases * connection then first acquire pcbinfo lock. There are three cases
* where we might discover later we need a write lock despite the * where we might discover later we need a write lock despite the
* flags: ACKs moving a connection out of the syncache, ACKs for a * flags: ACKs moving a connection out of the syncache, ACKs for a
* connection in TIMEWAIT and SYNs not targeting a listening socket. * connection in TIMEWAIT and SYNs not targeting a listening socket.
*/ */
if ((thflags & (TH_FIN | TH_RST)) != 0) { if ((thflags & (TH_FIN | TH_RST)) != 0) {
INP_INFO_WLOCK(&V_tcbinfo); INP_INFO_RLOCK(&V_tcbinfo);
ti_locked = TI_WLOCKED; ti_locked = TI_RLOCKED;
} else } else
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
/* /*
* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
*/ */
if ( if (
#ifdef INET6 #ifdef INET6
(isipv6 && (m->m_flags & M_IP6_NEXTHOP)) (isipv6 && (m->m_flags & M_IP6_NEXTHOP))
#ifdef INET #ifdef INET
|| (!isipv6 && (m->m_flags & M_IP_NEXTHOP)) || (!isipv6 && (m->m_flags & M_IP_NEXTHOP))
#endif #endif
#endif #endif
#if defined(INET) && !defined(INET6) #if defined(INET) && !defined(INET6)
(m->m_flags & M_IP_NEXTHOP) (m->m_flags & M_IP_NEXTHOP)
#endif #endif
) )
fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
findpcb: findpcb:
#ifdef INVARIANTS #ifdef INVARIANTS
if (ti_locked == TI_WLOCKED) { if (ti_locked == TI_RLOCKED) {
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
} else { } else {
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
} }
#endif #endif
#ifdef INET6 #ifdef INET6
if (isipv6 && fwd_tag != NULL) { if (isipv6 && fwd_tag != NULL) {
struct sockaddr_in6 *next_hop6; struct sockaddr_in6 *next_hop6;
▲ Show 20 Lines • Show All 131 Lines • ▼ Show 20 Lines#endif
* has tried to free the inpcb, in which case we need to loop back * has tried to free the inpcb, in which case we need to loop back
* and try to find a new inpcb to deliver to. * and try to find a new inpcb to deliver to.
* *
* XXXRW: It may be time to rethink timewait locking. * XXXRW: It may be time to rethink timewait locking.
*/ */
relocked: relocked:
if (inp->inp_flags & INP_TIMEWAIT) { if (inp->inp_flags & INP_TIMEWAIT) {
if (ti_locked == TI_UNLOCKED) { if (ti_locked == TI_UNLOCKED) {
if (INP_INFO_TRY_WLOCK(&V_tcbinfo) == 0) { if (INP_INFO_TRY_RLOCK(&V_tcbinfo) == 0) {
in_pcbref(inp); in_pcbref(inp);
INP_WUNLOCK(inp); INP_WUNLOCK(inp);
INP_INFO_WLOCK(&V_tcbinfo); INP_INFO_RLOCK(&V_tcbinfo);
ti_locked = TI_WLOCKED; ti_locked = TI_RLOCKED;
INP_WLOCK(inp); INP_WLOCK(inp);
if (in_pcbrele_wlocked(inp)) { if (in_pcbrele_wlocked(inp)) {
inp = NULL; inp = NULL;
goto findpcb; goto findpcb;
} }
} else } else
ti_locked = TI_WLOCKED; ti_locked = TI_RLOCKED;
} }
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
if (thflags & TH_SYN) if (thflags & TH_SYN)
tcp_dooptions(&to, optp, optlen, TO_SYN); tcp_dooptions(&to, optp, optlen, TO_SYN);
/* /*
* NB: tcp_twcheck unlocks the INP and frees the mbuf. * NB: tcp_twcheck unlocks the INP and frees the mbuf.
*/ */
if (tcp_twcheck(inp, &to, th, m, tlen)) if (tcp_twcheck(inp, &to, th, m, tlen))
goto findpcb; goto findpcb;
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
return (IPPROTO_DONE); return (IPPROTO_DONE);
} }
/* /*
* The TCPCB may no longer exist if the connection is winding * The TCPCB may no longer exist if the connection is winding
* down or it is in the CLOSED state. Either way we drop the * down or it is in the CLOSED state. Either way we drop the
* segment and send an appropriate response. * segment and send an appropriate response.
*/ */
tp = intotcpcb(inp); tp = intotcpcb(inp);
Show All 14 Lines#endif
* We've identified a valid inpcb, but it could be that we need an * We've identified a valid inpcb, but it could be that we need an
* inpcbinfo write lock but don't hold it. In this case, attempt to * inpcbinfo write lock but don't hold it. In this case, attempt to
* acquire using the same strategy as the TIMEWAIT case above. If we * acquire using the same strategy as the TIMEWAIT case above. If we
* relock, we have to jump back to 'relocked' as the connection might * relock, we have to jump back to 'relocked' as the connection might
* now be in TIMEWAIT. * now be in TIMEWAIT.
*/ */
#ifdef INVARIANTS #ifdef INVARIANTS
if ((thflags & (TH_FIN | TH_RST)) != 0) if ((thflags & (TH_FIN | TH_RST)) != 0)
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
#endif #endif
if (!((tp->t_state == TCPS_ESTABLISHED && (thflags & TH_SYN) == 0) || if (!((tp->t_state == TCPS_ESTABLISHED && (thflags & TH_SYN) == 0) ||
(tp->t_state == TCPS_LISTEN && (thflags & TH_SYN)))) { (tp->t_state == TCPS_LISTEN && (thflags & TH_SYN)))) {
if (ti_locked == TI_UNLOCKED) { if (ti_locked == TI_UNLOCKED) {
if (INP_INFO_TRY_WLOCK(&V_tcbinfo) == 0) { if (INP_INFO_TRY_RLOCK(&V_tcbinfo) == 0) {
in_pcbref(inp); in_pcbref(inp);
INP_WUNLOCK(inp); INP_WUNLOCK(inp);
INP_INFO_WLOCK(&V_tcbinfo); INP_INFO_RLOCK(&V_tcbinfo);
ti_locked = TI_WLOCKED; ti_locked = TI_RLOCKED;
INP_WLOCK(inp); INP_WLOCK(inp);
if (in_pcbrele_wlocked(inp)) { if (in_pcbrele_wlocked(inp)) {
inp = NULL; inp = NULL;
goto findpcb; goto findpcb;
} }
goto relocked; goto relocked;
} else } else
ti_locked = TI_WLOCKED; ti_locked = TI_RLOCKED;
} }
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
} }
#ifdef MAC #ifdef MAC
INP_WLOCK_ASSERT(inp); INP_WLOCK_ASSERT(inp);
if (mac_inpcb_check_deliver(inp, m)) if (mac_inpcb_check_deliver(inp, m))
goto dropunlock; goto dropunlock;
#endif #endif
so = inp->inp_socket; so = inp->inp_socket;
Show All 38 Lines#endif
/* /*
* Check for an existing connection attempt in syncache if * Check for an existing connection attempt in syncache if
* the flag is only ACK. A successful lookup creates a new * the flag is only ACK. A successful lookup creates a new
* socket appended to the listen queue in SYN_RECEIVED state. * socket appended to the listen queue in SYN_RECEIVED state.
*/ */
if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) { if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
/* /*
* Parse the TCP options here because * Parse the TCP options here because
* syncookies need access to the reflected * syncookies need access to the reflected
* timestamp. * timestamp.
*/ */
tcp_dooptions(&to, optp, optlen, 0); tcp_dooptions(&to, optp, optlen, 0);
/* /*
* NB: syncache_expand() doesn't unlock * NB: syncache_expand() doesn't unlock
Show All 35 Lines if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
} }
/* /*
* Socket is created in state SYN_RECEIVED. * Socket is created in state SYN_RECEIVED.
* Unlock the listen socket, lock the newly * Unlock the listen socket, lock the newly
* created socket and update the tp variable. * created socket and update the tp variable.
*/ */
INP_WUNLOCK(inp); /* listen socket */ INP_WUNLOCK(inp); /* listen socket */
inp = sotoinpcb(so); inp = sotoinpcb(so);
INP_WLOCK(inp); /* new connection */ /*
* New connection inpcb is already locked by
* syncache_expand().
jhbUnsubmitted
Not Done
Inline Actions

I think this comment might be helpful in cxgb_listen.c and t4_listen.c as well.

jhb: I think this comment might be helpful in cxgb_listen.c and t4_listen.c as well.
jchAuthorUnsubmitted
Not Done
Inline Actions

Nice catch, fixed.

jch: Nice catch, fixed.
*/
INP_WLOCK_ASSERT(inp);
tp = intotcpcb(inp); tp = intotcpcb(inp);
KASSERT(tp->t_state == TCPS_SYN_RECEIVED, KASSERT(tp->t_state == TCPS_SYN_RECEIVED,
("%s: ", __func__)); ("%s: ", __func__));
#ifdef TCP_SIGNATURE #ifdef TCP_SIGNATURE
if (sig_checked == 0) { if (sig_checked == 0) {
tcp_dooptions(&to, optp, optlen, tcp_dooptions(&to, optp, optlen,
(thflags & TH_SYN) ? TO_SYN : 0); (thflags & TH_SYN) ? TO_SYN : 0);
if (!tcp_signature_verify_input(m, off0, tlen, if (!tcp_signature_verify_input(m, off0, tlen,
▲ Show 20 Lines • Show All 214 Lines • ▼ Show 20 Lines if (so->so_options & SO_DEBUG)
(void *)tcp_saveipgen, &tcp_savetcp, 0); (void *)tcp_saveipgen, &tcp_savetcp, 0);
#endif #endif
tcp_dooptions(&to, optp, optlen, TO_SYN); tcp_dooptions(&to, optp, optlen, TO_SYN);
syncache_add(&inc, &to, th, inp, &so, m, NULL, NULL); syncache_add(&inc, &to, th, inp, &so, m, NULL, NULL);
/* /*
* Entry added to syncache and mbuf consumed. * Entry added to syncache and mbuf consumed.
* Only the listen socket is unlocked by syncache_add(). * Only the listen socket is unlocked by syncache_add().
*/ */
if (ti_locked == TI_WLOCKED) { if (ti_locked == TI_RLOCKED) {
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
} }
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
return (IPPROTO_DONE); return (IPPROTO_DONE);
} else if (tp->t_state == TCPS_LISTEN) { } else if (tp->t_state == TCPS_LISTEN) {
/* /*
* When a listen socket is torn down the SO_ACCEPTCONN * When a listen socket is torn down the SO_ACCEPTCONN
* flag is removed first while connections are drained * flag is removed first while connections are drained
Show All 32 Lines#endif
*/ */
tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos, ti_locked); tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos, ti_locked);
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
return (IPPROTO_DONE); return (IPPROTO_DONE);
dropwithreset: dropwithreset:
TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th); TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th);
if (ti_locked == TI_WLOCKED) { if (ti_locked == TI_RLOCKED) {
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
} }
#ifdef INVARIANTS #ifdef INVARIANTS
else { else {
KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropwithreset " KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropwithreset "
"ti_locked: %d", __func__, ti_locked)); "ti_locked: %d", __func__, ti_locked));
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
} }
#endif #endif
if (inp != NULL) { if (inp != NULL) {
tcp_dropwithreset(m, th, tp, tlen, rstreason); tcp_dropwithreset(m, th, tp, tlen, rstreason);
INP_WUNLOCK(inp); INP_WUNLOCK(inp);
} else } else
tcp_dropwithreset(m, th, NULL, tlen, rstreason); tcp_dropwithreset(m, th, NULL, tlen, rstreason);
m = NULL; /* mbuf chain got consumed. */ m = NULL; /* mbuf chain got consumed. */
goto drop; goto drop;
dropunlock: dropunlock:
if (m != NULL) if (m != NULL)
TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th); TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th);
if (ti_locked == TI_WLOCKED) { if (ti_locked == TI_RLOCKED) {
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
} }
#ifdef INVARIANTS #ifdef INVARIANTS
else { else {
KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropunlock " KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropunlock "
"ti_locked: %d", __func__, ti_locked)); "ti_locked: %d", __func__, ti_locked));
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
} }
Show All 40 Lines#endif
/* /*
* If this is either a state-changing packet or current state isn't * If this is either a state-changing packet or current state isn't
* established, we require a write lock on tcbinfo. Otherwise, we * established, we require a write lock on tcbinfo. Otherwise, we
* allow the tcbinfo to be in either alocked or unlocked, as the * allow the tcbinfo to be in either alocked or unlocked, as the
* caller may have unnecessarily acquired a write lock due to a race. * caller may have unnecessarily acquired a write lock due to a race.
*/ */
if ((thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 || if ((thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 ||
tp->t_state != TCPS_ESTABLISHED) { tp->t_state != TCPS_ESTABLISHED) {
KASSERT(ti_locked == TI_WLOCKED, ("%s ti_locked %d for " KASSERT(ti_locked == TI_RLOCKED, ("%s ti_locked %d for "
"SYN/FIN/RST/!EST", __func__, ti_locked)); "SYN/FIN/RST/!EST", __func__, ti_locked));
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
} else { } else {
#ifdef INVARIANTS #ifdef INVARIANTS
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
else { else {
KASSERT(ti_locked == TI_UNLOCKED, ("%s: EST " KASSERT(ti_locked == TI_UNLOCKED, ("%s: EST "
"ti_locked: %d", __func__, ti_locked)); "ti_locked: %d", __func__, ti_locked));
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
} }
#endif #endif
} }
INP_WLOCK_ASSERT(tp->t_inpcb); INP_WLOCK_ASSERT(tp->t_inpcb);
▲ Show 20 Lines • Show All 155 Lines • ▼ Show 20 Lines if (tlen == 0) {
if (SEQ_GT(th->th_ack, tp->snd_una) && if (SEQ_GT(th->th_ack, tp->snd_una) &&
SEQ_LEQ(th->th_ack, tp->snd_max) && SEQ_LEQ(th->th_ack, tp->snd_max) &&
!IN_RECOVERY(tp->t_flags) && !IN_RECOVERY(tp->t_flags) &&
(to.to_flags & TOF_SACK) == 0 && (to.to_flags & TOF_SACK) == 0 &&
TAILQ_EMPTY(&tp->snd_holes)) { TAILQ_EMPTY(&tp->snd_holes)) {
/* /*
* This is a pure ack for outstanding data. * This is a pure ack for outstanding data.
*/ */
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
TCPSTAT_INC(tcps_predack); TCPSTAT_INC(tcps_predack);
/* /*
* "bad retransmit" recovery. * "bad retransmit" recovery.
*/ */
if (tp->t_rxtshift == 1 && if (tp->t_rxtshift == 1 &&
▲ Show 20 Lines • Show All 86 Lines • ▼ Show 20 Lines#endif
tlen <= sbspace(&so->so_rcv)) { tlen <= sbspace(&so->so_rcv)) {
int newsize = 0; /* automatic sockbuf scaling */ int newsize = 0; /* automatic sockbuf scaling */
/* /*
* This is a pure, in-sequence data packet with * This is a pure, in-sequence data packet with
* nothing on the reassembly queue and we have enough * nothing on the reassembly queue and we have enough
* buffer space to take it. * buffer space to take it.
*/ */
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
/* Clean receiver SACK report if present */ /* Clean receiver SACK report if present */
if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks) if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
tcp_clean_sackreport(tp); tcp_clean_sackreport(tp);
TCPSTAT_INC(tcps_preddat); TCPSTAT_INC(tcps_preddat);
tp->rcv_nxt += tlen; tp->rcv_nxt += tlen;
/* /*
▲ Show 20 Lines • Show All 218 Lines • ▼ Show 20 Lines#endif
* SYN-SENT -> SYN-RECEIVED * SYN-SENT -> SYN-RECEIVED
* SYN-SENT* -> SYN-RECEIVED* * SYN-SENT* -> SYN-RECEIVED*
*/ */
tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN); tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
tcp_timer_activate(tp, TT_REXMT, 0); tcp_timer_activate(tp, TT_REXMT, 0);
tcp_state_change(tp, TCPS_SYN_RECEIVED); tcp_state_change(tp, TCPS_SYN_RECEIVED);
} }
KASSERT(ti_locked == TI_WLOCKED, ("%s: trimthenstep6: " KASSERT(ti_locked == TI_RLOCKED, ("%s: trimthenstep6: "
"ti_locked %d", __func__, ti_locked)); "ti_locked %d", __func__, ti_locked));
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
INP_WLOCK_ASSERT(tp->t_inpcb); INP_WLOCK_ASSERT(tp->t_inpcb);
/* /*
* Advance th->th_seq to correspond to first data byte. * Advance th->th_seq to correspond to first data byte.
* If data, trim to stay within window, * If data, trim to stay within window,
* dropping FIN if necessary. * dropping FIN if necessary.
*/ */
th->th_seq++; th->th_seq++;
▲ Show 20 Lines • Show All 56 Lines • ▼ Show 20 Lines if (thflags & TH_RST) {
* test against last_ack_sent instead of rcv_nxt. * test against last_ack_sent instead of rcv_nxt.
* Note 2: we handle special case of closed window, not * Note 2: we handle special case of closed window, not
* covered by the RFC. * covered by the RFC.
*/ */
if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) && if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) || SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) ||
(tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) { (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) {
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
KASSERT(ti_locked == TI_WLOCKED, KASSERT(ti_locked == TI_RLOCKED,
("%s: TH_RST ti_locked %d, th %p tp %p", ("%s: TH_RST ti_locked %d, th %p tp %p",
__func__, ti_locked, th, tp)); __func__, ti_locked, th, tp));
KASSERT(tp->t_state != TCPS_SYN_SENT, KASSERT(tp->t_state != TCPS_SYN_SENT,
("%s: TH_RST for TCPS_SYN_SENT th %p tp %p", ("%s: TH_RST for TCPS_SYN_SENT th %p tp %p",
__func__, th, tp)); __func__, th, tp));
if (V_tcp_insecure_rst || if (V_tcp_insecure_rst ||
tp->last_ack_sent == th->th_seq) { tp->last_ack_sent == th->th_seq) {
Show All 26 Lines if (thflags & TH_RST) {
goto drop; goto drop;
} }
/* /*
* RFC5961 Section 4.2 * RFC5961 Section 4.2
* Send challenge ACK for any SYN in synchronized state. * Send challenge ACK for any SYN in synchronized state.
*/ */
if ((thflags & TH_SYN) && tp->t_state != TCPS_SYN_SENT) { if ((thflags & TH_SYN) && tp->t_state != TCPS_SYN_SENT) {
KASSERT(ti_locked == TI_WLOCKED, KASSERT(ti_locked == TI_RLOCKED,
("tcp_do_segment: TH_SYN ti_locked %d", ti_locked)); ("tcp_do_segment: TH_SYN ti_locked %d", ti_locked));
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
TCPSTAT_INC(tcps_badsyn); TCPSTAT_INC(tcps_badsyn);
if (V_tcp_insecure_syn && if (V_tcp_insecure_syn &&
SEQ_GEQ(th->th_seq, tp->last_ack_sent) && SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) { SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
tp = tcp_drop(tp, ECONNRESET); tp = tcp_drop(tp, ECONNRESET);
rstreason = BANDLIM_UNLIMITED; rstreason = BANDLIM_UNLIMITED;
} else { } else {
▲ Show 20 Lines • Show All 96 Lines • ▼ Show 20 Lines#endif
} }
/* /*
* If new data are received on a connection after the * If new data are received on a connection after the
* user processes are gone, then RST the other end. * user processes are gone, then RST the other end.
*/ */
if ((so->so_state & SS_NOFDREF) && if ((so->so_state & SS_NOFDREF) &&
tp->t_state > TCPS_CLOSE_WAIT && tlen) { tp->t_state > TCPS_CLOSE_WAIT && tlen) {
KASSERT(ti_locked == TI_WLOCKED, ("%s: SS_NOFDEREF && " KASSERT(ti_locked == TI_RLOCKED, ("%s: SS_NOFDEREF && "
"CLOSE_WAIT && tlen ti_locked %d", __func__, ti_locked)); "CLOSE_WAIT && tlen ti_locked %d", __func__, ti_locked));
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
if ((s = tcp_log_addrs(inc, th, NULL, NULL))) { if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data " log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data "
"after socket was closed, " "after socket was closed, "
"sending RST and removing tcpcb\n", "sending RST and removing tcpcb\n",
s, __func__, tcpstates[tp->t_state], tlen); s, __func__, tcpstates[tp->t_state], tlen);
free(s, M_TCPLOG); free(s, M_TCPLOG);
} }
▲ Show 20 Lines • Show All 484 Lines • ▼ Show 20 Linesprocess_ACK:
/* /*
* In CLOSING STATE in addition to the processing for * In CLOSING STATE in addition to the processing for
* the ESTABLISHED state if the ACK acknowledges our FIN * the ESTABLISHED state if the ACK acknowledges our FIN
* then enter the TIME-WAIT state, otherwise ignore * then enter the TIME-WAIT state, otherwise ignore
* the segment. * the segment.
*/ */
case TCPS_CLOSING: case TCPS_CLOSING:
if (ourfinisacked) { if (ourfinisacked) {
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
tcp_twstart(tp); tcp_twstart(tp);
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
m_freem(m); m_freem(m);
return; return;
} }
break; break;
/* /*
* In LAST_ACK, we may still be waiting for data to drain * In LAST_ACK, we may still be waiting for data to drain
* and/or to be acked, as well as for the ack of our FIN. * and/or to be acked, as well as for the ack of our FIN.
* If our FIN is now acknowledged, delete the TCB, * If our FIN is now acknowledged, delete the TCB,
* enter the closed state and return. * enter the closed state and return.
*/ */
case TCPS_LAST_ACK: case TCPS_LAST_ACK:
if (ourfinisacked) { if (ourfinisacked) {
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
tp = tcp_close(tp); tp = tcp_close(tp);
goto drop; goto drop;
} }
break; break;
} }
} }
step6: step6:
▲ Show 20 Lines • Show All 197 Lines • ▼ Show 20 Lines case TCPS_FIN_WAIT_1:
break; break;
/* /*
* In FIN_WAIT_2 state enter the TIME_WAIT state, * In FIN_WAIT_2 state enter the TIME_WAIT state,
* starting the time-wait timer, turning off the other * starting the time-wait timer, turning off the other
* standard timers. * standard timers.
*/ */
case TCPS_FIN_WAIT_2: case TCPS_FIN_WAIT_2:
INP_INFO_WLOCK_ASSERT(&V_tcbinfo); INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
KASSERT(ti_locked == TI_WLOCKED, ("%s: dodata " KASSERT(ti_locked == TI_RLOCKED, ("%s: dodata "
"TCP_FIN_WAIT_2 ti_locked: %d", __func__, "TCP_FIN_WAIT_2 ti_locked: %d", __func__,
ti_locked)); ti_locked));
tcp_twstart(tp); tcp_twstart(tp);
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
return; return;
} }
} }
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
#ifdef TCPDEBUG #ifdef TCPDEBUG
if (so->so_options & SO_DEBUG) if (so->so_options & SO_DEBUG)
tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen, tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
&tcp_savetcp, 0); &tcp_savetcp, 0);
#endif #endif
Show All 38 Lines if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
rstreason = BANDLIM_RST_OPENPORT; rstreason = BANDLIM_RST_OPENPORT;
goto dropwithreset; goto dropwithreset;
} }
#ifdef TCPDEBUG #ifdef TCPDEBUG
if (so->so_options & SO_DEBUG) if (so->so_options & SO_DEBUG)
tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
&tcp_savetcp, 0); &tcp_savetcp, 0);
#endif #endif
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
tp->t_flags |= TF_ACKNOW; tp->t_flags |= TF_ACKNOW;
(void) tcp_output(tp); (void) tcp_output(tp);
INP_WUNLOCK(tp->t_inpcb); INP_WUNLOCK(tp->t_inpcb);
m_freem(m); m_freem(m);
return; return;
dropwithreset: dropwithreset:
if (ti_locked == TI_WLOCKED) if (ti_locked == TI_RLOCKED)
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
if (tp != NULL) { if (tp != NULL) {
tcp_dropwithreset(m, th, tp, tlen, rstreason); tcp_dropwithreset(m, th, tp, tlen, rstreason);
INP_WUNLOCK(tp->t_inpcb); INP_WUNLOCK(tp->t_inpcb);
} else } else
tcp_dropwithreset(m, th, NULL, tlen, rstreason); tcp_dropwithreset(m, th, NULL, tlen, rstreason);
return; return;
drop: drop:
if (ti_locked == TI_WLOCKED) { if (ti_locked == TI_RLOCKED) {
INP_INFO_WUNLOCK(&V_tcbinfo); INP_INFO_RUNLOCK(&V_tcbinfo);
ti_locked = TI_UNLOCKED; ti_locked = TI_UNLOCKED;
} }
#ifdef INVARIANTS #ifdef INVARIANTS
else else
INP_INFO_UNLOCK_ASSERT(&V_tcbinfo); INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
#endif #endif
/* /*
▲ Show 20 Lines • Show All 618 Lines • Show Last 20 Lines