diff options
| author | Randall Stewart <rrs@FreeBSD.org> | 2023-04-14 19:42:23 +0000 |
|---|---|---|
| committer | Randall Stewart <rrs@FreeBSD.org> | 2023-04-14 19:42:23 +0000 |
| commit | 3cc7b66732808a5f7f703f4b887fe6c60a3e7d4e (patch) | |
| tree | 8607c54954b67a4423f2fd1e35066a5fd1d6a336 | |
| parent | 5dbd073b045c8e98730c025a4acf2279be26c33e (diff) | |
| download | src-3cc7b66732808a5f7f703f4b887fe6c60a3e7d4e.tar.gz src-3cc7b66732808a5f7f703f4b887fe6c60a3e7d4e.zip | |
tcp: stack unloading crash in rack and bbr
Its possible to induce a crash in either rack or bbr. This would be done
if the rack stack were say the default and bbr was being used by a connection.
If the bbr stack is then unloaded and it was active, we will trigger a MPASS assert
in tcp_hpts since the new stack (default rack) would start a timer, and the old stack
(bbr) would have the inp already in hpts.
Reviewed by: tuexen
Sponsored by: Netflix Inc
Differential Revision:https://reviews.freebsd.org/D39576
| -rw-r--r-- | sys/netinet/tcp_stacks/bbr.c | 3 | ||||
| -rw-r--r-- | sys/netinet/tcp_stacks/rack.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c index 623b65f2c159..bce17b57205c 100644 --- a/sys/netinet/tcp_stacks/bbr.c +++ b/sys/netinet/tcp_stacks/bbr.c @@ -9854,6 +9854,9 @@ bbr_stop_all_timers(struct tcpcb *tp, struct tcp_bbr *bbr) /* We enter in persists, set the flag appropriately */ bbr->rc_in_persist = 1; } + if (tcp_in_hpts(bbr->rc_inp)) { + tcp_hpts_remove(bbr->rc_inp); + } } static void diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index a6a15514ff53..7b97a8e9c5d9 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -8113,6 +8113,9 @@ rack_stop_all_timers(struct tcpcb *tp, struct tcp_rack *rack) /* We enter in persists, set the flag appropriately */ rack->rc_in_persist = 1; } + if (tcp_in_hpts(rack->rc_inp)) { + tcp_hpts_remove(rack->rc_inp); + } } static void |