CVS: cvs.openbsd.org: src
Alexandr Nedvedicky <[email protected]>
| Newsgroups | gmane.os.openbsd.cvs |
|---|---|
| Message-ID | <[email protected]> |
CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/08/19 01:54:41 Modified files: sys/net : pf.c Log message: pf(4): connection counter for source track must use atomic_{inc,_dec}() The connection counter is advanced when on state transition from SYN_SENT to ESTABLISHED. That code in pf(4) currently runs with no locks. If two packets happen to share the same source tracking node, the race may occur. Two packets try to advance connection counter simultaneously but only one operation is observed. There is similar race between packet and timer that removes expired state entry, the timer drops the connection count for the source tracking entry while packet does opposite. The result of those races may lead to connection counter underflow. The issue was investigated and kindly reported by Janak Trivedi <janakktrivedi _at_ gmail _dot_ com> Feedback and suggestions by bluhm@ OK @bluhm