diff options
author | glebius <glebius@FreeBSD.org> | 2013-04-11 18:23:56 +0000 |
---|---|---|
committer | glebius <glebius@FreeBSD.org> | 2013-04-11 18:23:56 +0000 |
commit | d07f9bea4e3bcce2ee00a0cfcf96dec461cf0af5 (patch) | |
tree | d73f8106353c2f2ae83cf3dac30a77b72b03653f /usr.sbin/mptutil | |
parent | 7a7d50bfd47a3b8fd3af162b23baaff832aadad8 (diff) | |
download | FreeBSD-src-d07f9bea4e3bcce2ee00a0cfcf96dec461cf0af5.zip FreeBSD-src-d07f9bea4e3bcce2ee00a0cfcf96dec461cf0af5.tar.gz |
Fix tcp_output() so that tcpcb is updated in the same manner when an
mbuf allocation fails, as in a case when ip_output() returns error.
To achieve that, move large block of code that updates tcpcb below
the out: label.
This fixes a panic, that requires the following sequence to happen:
1) The SYN was sent to the network, tp->snd_nxt = iss + 1, tp->snd_una = iss
2) The retransmit timeout happened for the SYN we had sent,
tcp_timer_rexmt() sets tp->snd_nxt = tp->snd_una, and calls tcp_output().
In tcp_output m_get() fails.
3) Later on the SYN|ACK for the SYN sent in step 1) came,
tcp_input sets tp->snd_una += 1, which leads to
tp->snd_una > tp->snd_nxt inconsistency, that later panics in
socket buffer code.
For reference, this bug fixed in DragonflyBSD repo:
http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/1ff9b7d322dc5a26f7173aa8c38ecb79da80e419
Reviewed by: andre
Tested by: pho
Sponsored by: Nginx, Inc.
PR: kern/177456
Submitted by: HouYeFei&XiBoLiu <lglion718 163.com>
Diffstat (limited to 'usr.sbin/mptutil')
0 files changed, 0 insertions, 0 deletions