diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2026-07-28 20:15:22 +0000 |
|---|---|---|
| committer | Michael Tuexen <tuexen@FreeBSD.org> | 2026-08-06 09:07:02 +0000 |
| commit | e8d1cee437414dd9bb3c779ff0a0c234fb7d411e (patch) | |
| tree | 09f817f78672cf88fa622e7df5aa71ac51268240 | |
| parent | cad0d577251632bc9c7f808121ea9b0220474dbd (diff) | |
tcp: improve handling of stopped timers
When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.
The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.
The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.
Reported by: Lukas Book <lkbook@outlook.de>
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58484
(cherry picked from commit 52b7cbcb78c14e89f6faec8da5acc2caa3d37208)
| -rw-r--r-- | sys/netinet/tcp_timer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/netinet/tcp_timer.c b/sys/netinet/tcp_timer.c index 57c57666fa3a..56c50faaf4d1 100644 --- a/sys/netinet/tcp_timer.c +++ b/sys/netinet/tcp_timer.c @@ -859,6 +859,8 @@ tcp_timer_next(struct tcpcb *tp, sbintime_t *precision) sbintime_t after, before; for (i = 0, rv = TT_N, after = before = SBT_MAX; i < TT_N; i++) { + if (tp->t_timers[i] == SBT_MAX) + continue; if (tp->t_timers[i] < after) { after = tp->t_timers[i]; rv = i; |