From nobody Mon Sep 07 19:10:06 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hdxTp5kGsz6rtHs for ; Mon, 07 Sep 2026 19:10:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hdxTp52rSz4754 for ; Mon, 07 Sep 2026 19:10:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788808206; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YBfLtPJN2On1K8kKW75E1jxdP5XF+hSLqP9h8HphN08=; b=GliI4WwG+P38SZhxU6ohgVXRR6sjT97BXNtWXQgIAa/caWe1w3fIKp6tyCmz7Zv0ru13Rr LoN167e5z4nYfBFMMXhTU7YWSGUiGcXTFDYAeXvoLX8WeKkNITdvNfO8bj8xmiB89QPWCq +u2aG1534UJAmS3wfBI8rwAmkboU3MvnGump0DXf+7S4EH+w32aak0/KRCJJYS1CVogCwT TKjp6t0bT8JOE1Xresn9Skpfq7kSa5hi9zxZI8AThwVDS82mno1eRHliRMb4ch67kf1rcp ie28AW25SEQ8pCcBD2svp1QDK6bP10xu4DcXhLn2kLq4zmt6Tg6uLfBZa7AuDA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788808206; a=rsa-sha256; cv=none; b=gSCek5ecQAeJ9uk65Pb32QoBBSem+g1mpLp5nTE6KRgY+543HjbOTRcROU7OGkU0fB7t8k GdyrTXK5wgxIxIBBbRXqj/D/oPzIzGt1kriQA7vLBRnNvGRwn9sXfWNns4hB05lrKuhGeC tHsdp6jaXuyRSeJJGM8YyyWtnDUuYBsVJq28exrJ96mj1D/xLb1Y81/bZB8/j5bf2uWrzk LbF1z6n72+u4uUQT6jy3PiVMjC2j+9WRTs6v9fELir11v7TP+0RA9T09PbDTpAUyAHMH8A ixstr3K09Y+3GSVz82aveC84vwiaeFEjWcgdZnEMqvjx8QCLNI+jKhdzcMe0Xw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788808206; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YBfLtPJN2On1K8kKW75E1jxdP5XF+hSLqP9h8HphN08=; b=lNvww7OgH/pcOVwodcSRsM9F1VG7g9GztuRVqi+d1/pPMsw+qCN8VU5TpOIYWRW9rDhiJL tRE/Bhn4lbJl9NIUpAG3rguc8PO7z85xsZI6C9tqFrsF/0qIO/fCTqAK4tlc1iEW4UZLnG vQTzgDxoOwMR4JYT1ekMv08pmGF4D8YTbS7GEKgvmHc/XFJM7qjq8D5quuw5is1M+LrwXI ukZRbXfTo4lFIls+tyEIGiGr+6007lZBlHT6ykyrqhpg4nrgSVMw+uovSAt2vSWhu9ruLU GxW6CWr2s15xZ2nGowYw2slbDprgbyECX5XsoiWeZY1yYni3RTu2cZH16MCj8A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hdxTp3XKtzWr9 for ; Mon, 07 Sep 2026 19:10:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b256 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 07 Sep 2026 19:10:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: b712bb84a7a7 - main - tcp: fix TCPS_CLOSED state underleak in syncache_socket() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b712bb84a7a7dc229324a95170b8a77e0d9c5bec Auto-Submitted: auto-generated Date: Mon, 07 Sep 2026 19:10:06 +0000 Message-Id: <6a9f0c0e.3b256.2a536c0d@gitrepo.freebsd.org> The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=b712bb84a7a7dc229324a95170b8a77e0d9c5bec commit b712bb84a7a7dc229324a95170b8a77e0d9c5bec Author: Gleb Smirnoff AuthorDate: 2026-09-07 19:09:40 +0000 Commit: Gleb Smirnoff CommitDate: 2026-09-07 19:09:40 +0000 tcp: fix TCPS_CLOSED state underleak in syncache_socket() The syncache entry holds one TCPS_SYN_RECEIVED count that normally is transferred to the the newborn tp. Upon failure syncache_socket() shall not use TCPSTATES_INC/TCPSTATES_DEC (see 5050df3f4aa4 why). But when syncache_socket() fails in_pcbconnect(), it calls tcp_discardcb() to free resources that were just allocated by tcp_newtcpcb() and this tcp_discardcb() would do TCPSTATES_DEC(tp->t_state). The t_state is TCPS_CLOSED at this point. Make tcp_discardcb() symmetrical to tcp_newtcpcb() - not responsible for the TCPSTATES. Make the caller responsible for state count book keeping. Reviewed by: tuexen Fixes: 3703e1a73e0e0367c04f47f793e46495e46e647b Differential Revision: https://reviews.freebsd.org/D59325 --- sys/netinet/tcp_subr.c | 1 - sys/netinet/tcp_usrreq.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 44288d8f344d..2320d6901fac 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2455,7 +2455,6 @@ tcp_discardcb(struct tcpcb *tp) STAILQ_FOREACH_FROM_SAFE(m, &tp->t_inqueue, m_stailqpkt, prev) m_freem(m); } - TCPSTATES_DEC(tp->t_state); if (tp->t_fb->tfb_tcp_fb_fini) (*tp->t_fb->tfb_tcp_fb_fini)(tp, 1); diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 33f62a73ce2c..ff046c7ad7de 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -209,6 +209,7 @@ tcp_usr_detach(struct socket *so) tp->t_state < TCPS_SYN_SENT, ("%s: inp %p not disconnected or embryonic", __func__, inp)); + TCPSTATES_DEC(tp->t_state); tcp_discardcb(tp); in_pcbfree(inp); }