(Sorry for spamming people directly; my list message didn't get a
reply and it's a serious bug in some circumstances.)
I've discovered a bug in Linux 2.2 that allows TCP sockets to get
stuck in FIN_WAIT1 with no timeout or retransmissions. Code to
demonstrate the problem, plus a tcpdump of it happening, is
attached. There are more details about what's going on, as I
understand it, in the headers.
I suspect there is a mishandling of sk->nonagle==2 in tcp_send_test(),
but I have not yet puzzled out the code enough to say exactly what it
is. I think basically the handling of a closing socket that still has
corks set is broken.
You might argue that this is a security bug because it allows local
users to consume arbitrarily large (?) kernel resources, and in some
cases the resources cannot be released without a reboot. (Or perhaps
a spoofed RST packet would fix it too.)
--
Martin
corked_demo.c
Description: Text Data
corked_tcpdump.txt
Description: Text document
corked-out-20020917-2009
Description: Text document
|