Change Details

There is one timer which may run when tcp_discardcb() is called, which is TT_2MSL - to later close the session after a timeout. The relative order of the calls to tcp_close() and tcp_discardcb() is turned around when closing a session via TIME-WAIT. Reported-by: syzbot+9a9aa434a14a2b35c3ba@syzkaller.appspotmail.com

When apruptly detaching a tcp session, stop all timers prior of discarding the tcpcb. Reported-by: syzbot+9a9aa434a14a2b35c3ba@syzkaller.appspotmail.com Reported-by: syzbot+e82856782410e895bae7@syzkaller.appspotmail.com

There is one timer which may run whenWhen apruptly detaching a tcp_discardcb() is called, which is TT_2MSL - to later close the session after a timeout session, stop all timers prior of discarding the tcpcb. The relative order of the calls to tcp_close() and tcp_discardcb() is turned around when closing a session via TIME-WAIT. Reported-by: syzbot+9a9aa434a14a2b35c3ba@syzkaller.appspotmail.com Reported-by: syzbot+e82856782410e895bae7@syzkaller.appspotmail.com