Skip to content
Commit 4ab2dded authored by Robert Lubos's avatar Robert Lubos Committed by Fabio Baltieri
Browse files

net: tcp: Eliminate race between input thread and TCP work queue



Eliminate race between TCP input thread and TCP work queue, when
dereferencing connection. This normally would not manifest itself during
standard TCP operation, but could be a potential opening for abuse, when
the already closed TCP connection is kept being spammed with packets.
The test scenario involved sending multiple TCP RST packets as a
response to establishing the connection, which could result in system
crash. The following changes in the TCP stack made it stable in such
scenario:

1. Use `tcp_lock` when searching for active connections, to avoid
   potential data corruption when connection is being removed when
  iterating.
2. Avoid memset() during connection dereference, not to destroy mutex
   associated with the connection. The connection context is only
   cleared during allocation now.
3. Lock the connection mutex while releasing connection.
4. In tcp_in(), after locking the mutex, verify the connection state,
   and quit early if the connection has already been dereferenced.
5. When closing connection from the TCP stack as a result of RST or
   malformed packet, verify connection state to make sure it's only done
   once, even if multiple RST packets were received.

Signed-off-by: default avatarRobert Lubos <robert.lubos@nordicsemi.no>
parent aa1ca171
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment