d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add comment in tcp_discardcb() talking about how we don't, but should,

Browse Source 
address TCP races relating to not calling tcp_drain() on stopped callouts.

Discussed with:	bz
This commit is contained in:
Robert Watson 2010-03-07 14:13:59 +00:00
parent 68b5629bf5
commit 2bf3ce088d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=204829
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/netinet/tcp_subr.c
View File

@ -835,8 +835,19 @@ tcp_discardcb(struct tcpcb *tp)
INP_WLOCK_ASSERT(inp);
/*
* Make sure that all of our timers are stopped before we
* delete the PCB.
* Make sure that all of our timers are stopped before we delete the
* PCB.
*
* XXXRW: Really, we would like to use callout_drain() here in order
* to avoid races experienced in tcp_timer.c where a timer is already
* executing at this point. However, we can't, both because we're
* running in a context where we can't sleep, and also because we
* hold locks required by the timers. What we instead need to do is
* test to see if callout_drain() is required, and if so, defer some
* portion of the remainder of tcp_discardcb() to an asynchronous
* context that can callout_drain() and then continue. Some care
* will be required to ensure that no further processing takes place
* on the tcpcb, even though it hasn't been freed (a flag?).
*/
callout_stop(&tp->t_timers->tt_rexmt);
callout_stop(&tp->t_timers->tt_persist);