Date: Wed, 05 Aug 2026 14:06:25 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 288904] [tcp] page fault in tcp_default_output Message-ID: <bug-288904-7501-E9rdOFfH9O@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-288904-7501@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288904 --- Comment #25 from firk@cantconnect.ru --- (In reply to Gleb Smirnoff from comment #11) Looks like it is PR 276761 (tcp_close() vs tcp_discardcb() timers desync). And yes, it was not MFCed to 14.x. The commit bffebc336f4ece4d18774c1ab8f555802cebf961 is related because it fixes a race introduced by PR 276761 fix, but it is not a direct source of these panics. I made a small patch which is expected to fix the problem in 14.x branch. Did not tested it much for now. I don't think it is a good idea to keep supported 14.4 release in unusable state. --- sys/netinet/tcp_subr.c.orig 2026-08-01 23:05:43.997108869 +0300 +++ sys/netinet/tcp_subr.c 2026-08-05 11:51:31.431921701 +0300 @@ -2598,6 +2598,16 @@ tcp_fastopen_decrement_counter(tp->t_tfo_pending); tp->t_tfo_pending = NULL; } + + /* + * tcp_timer_stop() may drop INP_WLOCK internally + * this may lead to racy two-thread closing in rare cases + * so just reset tp->t_timers + * tcp_timer_enter() is aware of this + */ + for (tt_which i = 0; i < TT_N; i++) + tp->t_timers[i] = SBT_MAX; + if (tp->t_fb->tfb_tcp_timer_stop_all != NULL) tp->t_fb->tfb_tcp_timer_stop_all(tp); in_pcbdrop(inp); --- sys/netinet/tcp_timer.c.orig 2026-08-01 23:05:44.001110870 +0300 +++ sys/netinet/tcp_timer.c 2026-08-05 12:17:39.251384522 +0300 @@ -874,6 +874,11 @@ curthread->td_pflags |= TDP_INTCPCALLOUT; which = tcp_timer_next(tp, NULL); + if (which == TT_N) { /* see tcp_close() comment about stoping timers */ + INP_WUNLOCK(inp); + curthread->td_pflags &= ~TDP_INTCPCALLOUT; + return; + } MPASS(which < TT_N); tp->t_timers[which] = SBT_MAX; tp->t_precisions[which] = 0; @@ -909,6 +914,10 @@ #endif INP_WLOCK_ASSERT(inp); + if (tp->t_state == TCPS_CLOSED) { +/* printf("tcp_timer_activate(%p,%d,%u) for TCPS_CLOSED connection, ignoring\n", tp, (int)which, delta);*/ + return; + } if (delta > 0) { what = TT_STARTING; The commented printf() will often print this warnings for TT_REXMT (0) if enabled, but I don't think these silently skipped timer activations will harm (they seems fixed in 15.x in some other place). -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-288904-7501-E9rdOFfH9O>