From nobody Thu Sep 24 03:33:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hqzvL1bZ3z6tSkS for ; Thu, 24 Sep 2026 03:33:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hqzvK6VBYz4mVb for ; Thu, 24 Sep 2026 03:33:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790220813; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IKigrC3Z5NOBcTYgx/mMoH3MTTDXKUIUWHIJw8xF41I=; b=dzc0E2CR9H3gPHCuyFTq/1DAFB0KYRf5FMUE5mFTvAbKcMWKArTrHTPr2saK32wdVCPc2c y2OAKTAu7HnbbPYD+Wf7ezib+F98hERR15oU/seb4og++fbP451O4D1yTKkW+EbiS/Tle4 CNS4p0MbvbvNgcJupXA8vnOBEP9y0hYMMLfhNcQjgQniubPB1Em6Mp734wv0glzIp8ue8u TsBUD84bnJMgMN6NXVAAnN2iyur7hrnHVAeAvGkl/mvB4pwCo1JFb9MVzlH37tIruQpFN8 VFnbb6gouBCi/AITezytFS4odfuVPqMSM4jVFCeMzoK5rSmSfIeyhQ+L81QFzA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790220813; b=J6rRjhZZclr+ZbQPOQvt6kSGob6nwb6UWJcZM6txxzc738IvCZO9nL7nuCByYeaePWKkTq XKdkjQbGSLOIREDuN0eAtAJXj1iOpnxRKQIK0qle9GZf1IqGjMJsGZQCi5/ukp3YNwcrPQ q4PqNPYfMMJwgZWOF6ymLG66HH9wPBQpHe6CfKwFe4wADMByGkjCTbmF+GGjw4qcPt2J8H 2KxGB0qUtl/hIIYvsG6cVzdZh3yNMF+a2r1IdyOU7Rh5ad3w2oQcBDmbv3kygZBcpLv7E2 u44kdsXhZeBWRdY0kMZ6eOzqwSP+CPAFAcpOQ56VAvDDMBLZIyUC4YnqjI1Ixg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790220813; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IKigrC3Z5NOBcTYgx/mMoH3MTTDXKUIUWHIJw8xF41I=; b=XZKz/2QAJVTd24CuXaaUmOAgQBOzY6RyTXIEGhNMS75kkv2A1R492/HFR7k0EvzvWEZlIj fAhAOW2tJZ32Il5TfXIHfHV9YUi6Db0L+D3Mhxs05POQ+2zOrXe5PKrs3oqtkWOiO5KDIv mm5t4TRjQha9mkBO8xOuX1ylLkWMr0WdVXeg6xnfzsE7/IDm/1mNjkQ/NtA8CowLCMzbXP iLFPcNIH7fpss7rqr1TEb0S4i4avuqW6cbojHryfFpIi0w9IcU0jtHKSvCc+DLVBTzELiZ pXgWqsYTLTfRdIjKJA2NMk5a7X0pzKEcdoX+bwv//m9k42dO4wSN2YxDqh5Mcw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hqzvK5Hb1z1LdL for ; Thu, 24 Sep 2026 03:33:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b7c5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 24 Sep 2026 03:33:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gleb Smirnoff Subject: git: 7b4bc013b179 - stable/15 - tcp: fix TCPS_CLOSED state underleak in syncache_socket() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7b4bc013b179ab067e9c6212279078b24c11c60c Auto-Submitted: auto-generated Date: Thu, 24 Sep 2026 03:33:33 +0000 Message-Id: <6ab49a0d.3b7c5.21a369a7@gitrepo.freebsd.org> The branch stable/15 has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=7b4bc013b179ab067e9c6212279078b24c11c60c commit 7b4bc013b179ab067e9c6212279078b24c11c60c Author: Gleb Smirnoff AuthorDate: 2026-09-07 19:09:40 +0000 Commit: Gleb Smirnoff CommitDate: 2026-09-24 03:32:49 +0000 tcp: fix TCPS_CLOSED state underleak in syncache_socket() The syncache entry holds one TCPS_SYN_RECEIVED count that normally is transferred to the the newborn tp. Upon failure syncache_socket() shall not use TCPSTATES_INC/TCPSTATES_DEC (see 5050df3f4aa4 why). But when syncache_socket() fails in_pcbconnect(), it calls tcp_discardcb() to free resources that were just allocated by tcp_newtcpcb() and this tcp_discardcb() would do TCPSTATES_DEC(tp->t_state). The t_state is TCPS_CLOSED at this point. Make tcp_discardcb() symmetrical to tcp_newtcpcb() - not responsible for the TCPSTATES. Make the caller responsible for state count book keeping. Reviewed by: tuexen Fixes: 3703e1a73e0e0367c04f47f793e46495e46e647b Differential Revision: https://reviews.freebsd.org/D59325 (cherry picked from commit b712bb84a7a7dc229324a95170b8a77e0d9c5bec) --- sys/netinet/tcp_subr.c | 1 - sys/netinet/tcp_usrreq.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index d8e58fe3eff1..663042cd8c93 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2447,7 +2447,6 @@ tcp_discardcb(struct tcpcb *tp) STAILQ_FOREACH_FROM_SAFE(m, &tp->t_inqueue, m_stailqpkt, prev) m_freem(m); } - TCPSTATES_DEC(tp->t_state); if (tp->t_fb->tfb_tcp_fb_fini) (*tp->t_fb->tfb_tcp_fb_fini)(tp, 1); diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 4d1a6455d09e..6b2388b9363c 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -208,6 +208,7 @@ tcp_usr_detach(struct socket *so) tp->t_state < TCPS_SYN_SENT, ("%s: inp %p not dropped or embryonic", __func__, inp)); + TCPSTATES_DEC(tp->t_state); tcp_discardcb(tp); in_pcbfree(inp); }