From nobody Mon Sep 07 19:10:06 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hdxTv6kzqz6rtNV for ; Mon, 07 Sep 2026 19:10:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hdxTv4426z47D3 for ; Mon, 07 Sep 2026 19:10:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788808211; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YBfLtPJN2On1K8kKW75E1jxdP5XF+hSLqP9h8HphN08=; b=bpTU/GR/ZEfoYUOTfgxnp8OmbNKjB7BTMdxV+6X+ej9py80nITvbaUNFHxSdLedANktnMN Z/iicdl1EpH0NlWrO48VwUKnbIyO+0pebFnpvGf7m46hiYsUHNIHJcfM+3mQhzoAxbjGez m+5+7/PBQPQ57FNsK0khd16KtkzJsvsLfswLxo00Bcx0yne7JdHuZOx1M7T2IwXSj2IJsu XQMOQ8Lb492YWan9+sXYSJ6uTZworZCx9y8AFr5skyiIoc3XyIbK51WdjOtRRgyG360gO/ adzRwOzCQquO3nQOXZII5FO/7OF950SIAinGKgiAulWsizKRdgUMTzcwp+9SIg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788808211; a=rsa-sha256; cv=none; b=gqykqyEjk3Q/hbNlAxi12jQjj360kJ/u63FrNF0TQmExgkR0QhA3RbqCOuEBjdZpt5yy77 wyfFUmDFENobCAO07B63DDcb8gWOgD7dckm+lg7/CoHUJqSq2cee7U4sbGbB0mANeLPsIW OnNOmqgkPT22/CjqRtCqtLFYlSHsuLxMXnU1yC6CjY+gCqRfER9IFiqTMhTz1ncyDT3FD8 EQcv1xWdKYKwEihXoxHrw8DDcIQ7j2MkGxQNdFTbYic2XPhxzSXquTr/Ffb/zDWcpVMtj7 rQUID5YQFSu8jk4jP4mM++vcnw2Wdp7iDaMOCzLpBvcZYI8ifjxi7L0VzaFHgA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788808211; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YBfLtPJN2On1K8kKW75E1jxdP5XF+hSLqP9h8HphN08=; b=gjJyKkv+xIVF41oVqyCdH6l6e96XojAsF0dzhehiiPDoE/X2RXahzzq8uYveROmm/isEvf 94FelhYE//tsYNw76XJB6bB7qJuDb4k8B1KarV3dRPq1RzFwsBHfLL3rW5BEjoTpVK388m kL9fgLjfUjpIyzGWka20w6iglpNuRV7BB6frkXhYZBhIP84x6hanykAHVs/qngllynfLkW oImfhifx5+sDtvWiy0I+52I9hjC5gWwiPhXAfnOf9M8NKXJW/nSC+LTA1CBNpd4tvNU8x9 0Tpn5ckvK95Xx6BlelRqEBsln0/upIjahIjWoOxsULQ84IsRw59pCCOooqeP/g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hdxTv2xB7zWY1 for ; Mon, 07 Sep 2026 19:10:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b256 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 07 Sep 2026 19:10:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: b712bb84a7a7 - main - tcp: fix TCPS_CLOSED state underleak in syncache_socket() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b712bb84a7a7dc229324a95170b8a77e0d9c5bec Auto-Submitted: auto-generated Date: Mon, 07 Sep 2026 19:10:06 +0000 Message-Id: <6a9f0c0e.3b256.2a536c0d@gitrepo.freebsd.org> The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=b712bb84a7a7dc229324a95170b8a77e0d9c5bec commit b712bb84a7a7dc229324a95170b8a77e0d9c5bec Author: Gleb Smirnoff AuthorDate: 2026-09-07 19:09:40 +0000 Commit: Gleb Smirnoff CommitDate: 2026-09-07 19:09:40 +0000 tcp: fix TCPS_CLOSED state underleak in syncache_socket() The syncache entry holds one TCPS_SYN_RECEIVED count that normally is transferred to the the newborn tp. Upon failure syncache_socket() shall not use TCPSTATES_INC/TCPSTATES_DEC (see 5050df3f4aa4 why). But when syncache_socket() fails in_pcbconnect(), it calls tcp_discardcb() to free resources that were just allocated by tcp_newtcpcb() and this tcp_discardcb() would do TCPSTATES_DEC(tp->t_state). The t_state is TCPS_CLOSED at this point. Make tcp_discardcb() symmetrical to tcp_newtcpcb() - not responsible for the TCPSTATES. Make the caller responsible for state count book keeping. Reviewed by: tuexen Fixes: 3703e1a73e0e0367c04f47f793e46495e46e647b Differential Revision: https://reviews.freebsd.org/D59325 --- sys/netinet/tcp_subr.c | 1 - sys/netinet/tcp_usrreq.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 44288d8f344d..2320d6901fac 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2455,7 +2455,6 @@ tcp_discardcb(struct tcpcb *tp) STAILQ_FOREACH_FROM_SAFE(m, &tp->t_inqueue, m_stailqpkt, prev) m_freem(m); } - TCPSTATES_DEC(tp->t_state); if (tp->t_fb->tfb_tcp_fb_fini) (*tp->t_fb->tfb_tcp_fb_fini)(tp, 1); diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 33f62a73ce2c..ff046c7ad7de 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -209,6 +209,7 @@ tcp_usr_detach(struct socket *so) tp->t_state < TCPS_SYN_SENT, ("%s: inp %p not disconnected or embryonic", __func__, inp)); + TCPSTATES_DEC(tp->t_state); tcp_discardcb(tp); in_pcbfree(inp); }