opnsense-src/sys/netinet
Randall Stewart 8818f0f112 TCP: Fix a rack bug that skyzall found which results in a crash.
So when we call the fast_rsm retransmit path, we should always move
snd_nxt back up to snd_max. In fact during ack-processing if snd_nxt
falls behind it should be moved up there as well. Otherwise what
can happen is we have an incorrect mark on snd_nxt and incorrectly
calculate the offset when we go through the  front path (which is
what skzyall was able to do) then when we go to clean up the
send the offset is all wrong and we crash.

Special thanks to Gleb for pointing out the problem and the email
that had the reproducer so I could find the issue.

Reported-by: syzbot+f5061a372f74f021ec02@syzkaller.appspotmail.com
Sponsored by: Netflix Inc
2023-10-04 15:16:01 -04:00
..
cc sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
khelp sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
libalias sys: Remove $FreeBSD$: one-line bare tag 2023-08-16 11:55:17 -06:00
netdump netdump: Check the return value of ifunit_ref() 2023-10-02 08:09:26 -04:00
tcp_stacks TCP: Fix a rack bug that skyzall found which results in a crash. 2023-10-04 15:16:01 -04:00
accf_data.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
accf_dns.c sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
accf_http.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
dccp.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
icmp6.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
icmp_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
if_ether.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
if_ether.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
igmp.c igmp: do not upgrade IGMP version beyond net.inet.igmp.default_version 2023-08-30 09:22:05 +02:00
igmp.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
igmp_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in_cksum.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_debug.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_fib.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_fib.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
in_fib_algo.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_fib_dxr.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_gif.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_jail.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_kdtrace.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_kdtrace.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
in_mcast.c mcast: fix memory leak in imf_purge() 2023-08-31 12:16:20 +02:00
in_pcb.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_pcb.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in_pcb_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in_prot.c Fix 'security.bsd.see_jail_proc' by using cr_bsd_visible() 2023-09-28 11:59:08 -03:00
in_proto.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_rmx.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
in_rss.c sys: Remove $FreeBSD$: two-line .c pattern 2023-08-16 11:54:30 -06:00
in_rss.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
in_systm.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
in_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip6.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
ip_carp.c carp: Explicitly mark tunnable net.inet.carp.allow with CTLFLAG_NOFETCH 2023-09-09 16:10:32 +08:00
ip_carp.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
ip_carp_nl.h carp: allow commands to use interface name rather than index 2023-03-31 11:29:58 +02:00
ip_divert.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_divert.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
ip_dummynet.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
ip_ecn.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_ecn.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
ip_encap.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_encap.h sys: Remove $FreeBSD$: one-line .c comment pattern 2023-08-16 11:54:24 -06:00
ip_fastfwd.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_fw.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
ip_gre.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_icmp.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_icmp.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip_id.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_input.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_mroute.c ip_mroute: Fix sysctl knobs 2023-09-28 00:23:22 +08:00
ip_mroute.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
ip_options.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_options.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
ip_output.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_reass.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
ip_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
pim.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
pim_var.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
raw_ip.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
sctp.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_asconf.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_asconf.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_auth.c sctp: cleanup locking for notifications 2023-09-08 16:20:51 +02:00
sctp_auth.h sctp: cleanup SCTP AUTH related notification 2023-09-08 13:13:43 +02:00
sctp_bsd_addr.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_bsd_addr.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_cc_functions.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_constants.h sctp: make sure all SCTP RESET notifications use sctp_ulp_notify() 2023-09-08 14:19:56 +02:00
sctp_crc32.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
sctp_crc32.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_header.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_indata.c sctp: improve handling of socket shutdown for reading 2023-08-24 15:52:55 +02:00
sctp_indata.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_input.c sctp: make sure all SCTP RESET notifications use sctp_ulp_notify() 2023-09-08 14:19:56 +02:00
sctp_input.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_kdtrace.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
sctp_kdtrace.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_lock_bsd.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_module.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
sctp_os.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_os_bsd.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_output.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_output.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_pcb.c sctp: cleanup handling of graceful shutdown of the peer 2023-08-19 12:35:49 +02:00
sctp_pcb.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_peeloff.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_peeloff.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_ss_functions.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_structs.h sctp: cleanup handling of graceful shutdown of the peer 2023-08-19 12:35:49 +02:00
sctp_syscalls.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
sctp_sysctl.c sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_sysctl.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_timer.c sctp: cleanup 2023-08-25 17:26:58 +02:00
sctp_timer.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_uio.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctp_usrreq.c sctp: further improve shutting down the read side of a socket 2023-09-13 13:02:51 +02:00
sctp_var.h sctp: cleanup cdefs.h include 2023-08-18 15:25:34 +02:00
sctputil.c sctp: don't call sctp_ulp_notify() recursively 2023-09-08 21:19:59 +02:00
sctputil.h sctp: make sure all SCTP RESET notifications use sctp_ulp_notify() 2023-09-08 14:19:56 +02:00
siftr.c siftr: flush pkt_nodes to the log file in batch 2023-09-11 11:23:27 -04:00
tcp.h tcp_info: Add and export more FreeBSD-specific fields 2023-08-22 20:34:01 +02:00
tcp_accounting.h Move access to tcp's t_logstate into inline functions and provide new tracepoint and bbpoint capabilities. 2023-03-16 11:43:16 -04:00
tcp_ecn.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_ecn.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcp_fastopen.c tcp: Initialize the maximum number of entries in a client cookie cache bucket 2023-09-03 04:34:07 +08:00
tcp_fastopen.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_fsm.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcp_hostcache.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_hpts.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_hpts.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_input.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_log_buf.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_log_buf.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_lro.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_lro.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_offload.c tcp_fill_info(): Change lock assertion on INPCB to locked only 2023-08-22 20:33:49 +02:00
tcp_offload.h tcp_fill_info(): Change lock assertion on INPCB to locked only 2023-08-22 20:33:49 +02:00
tcp_output.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_pcap.c sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_pcap.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00
tcp_ratelimit.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_ratelimit.h sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_reass.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_sack.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_seq.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcp_stats.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_subr.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_syncache.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_syncache.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcp_timer.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_timer.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcp_timewait.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
tcp_usrreq.c tcp_info: Add and export more FreeBSD-specific fields 2023-08-22 20:34:01 +02:00
tcp_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
tcpip.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
toecore.c tcp_fill_info(): Change lock assertion on INPCB to locked only 2023-08-22 20:33:49 +02:00
toecore.h tcp_fill_info(): Change lock assertion on INPCB to locked only 2023-08-22 20:33:49 +02:00
udp.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
udp_usrreq.c sys: Remove $FreeBSD$: one-line .c pattern 2023-08-16 11:54:36 -06:00
udp_var.h sys: Remove $FreeBSD$: one-line .h pattern 2023-08-16 11:54:18 -06:00
udplite.h sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16 11:54:11 -06:00