git: 11f0c61eecb8 - releng/14.4 - tcp: improve handling of stopped timers

The branch releng/14.4 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=11f0c61eecb83c1b613347243c8aca5c0af2752c

commit 11f0c61eecb83c1b613347243c8aca5c0af2752c
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-07-28 20:15:22 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-13 13:47:11 +0000

    tcp: improve handling of stopped timers
    
    When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
    corresponding t_precisions[], if it is not zero, would result in
    overflows in tcp_timer_next(). To avoid this, skip stopped timers.
    
    The problem was identified while debugging uperf by Lukas Book and
    an initial patch was provided by him. The committed patch was
    suggested by glebius.
    
    The problem can be observed by running netstat -nxptcp and looking for
    negative timer values and by observing very long running timers in
    some cases.
    
    Approved by:            so
    Security:               FreeBSD-EN-26:27.tcp
    Reported by:            Lukas Book <lkbook@outlook.de>
    Reviewed by:            glebius
    Differential Revision:  https://reviews.freebsd.org/D58484
    
    (cherry picked from commit 52b7cbcb78c14e89f6faec8da5acc2caa3d37208)
    (cherry picked from commit 85485a570d4f9c5f9d9b867ee847b8ee5f7d2445)
---
 sys/netinet/tcp_timer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netinet/tcp_timer.c b/sys/netinet/tcp_timer.c
index 1c687e94bb4a..5e01716e7a44 100644
--- a/sys/netinet/tcp_timer.c
+++ b/sys/netinet/tcp_timer.c
@@ -850,6 +850,8 @@ tcp_timer_next(struct tcpcb *tp, sbintime_t *precision)
 	sbintime_t after, before;
 
 	for (i = 0, rv = TT_N, after = before = SBT_MAX; i < TT_N; i++) {
+		if (tp->t_timers[i] == SBT_MAX)
+			continue;
 		if (tp->t_timers[i] < after) {
 			after = tp->t_timers[i];
 			rv = i;