Skip to content

[net] Fix network hang, leak and race issues in kernel and ktcp - #2809

Merged
ghaerr merged 1 commit into
masterfrom
netfix1
Aug 10, 2026
Merged

[net] Fix network hang, leak and race issues in kernel and ktcp#2809
ghaerr merged 1 commit into
masterfrom
netfix1

Conversation

@ghaerr

@ghaerr ghaerr commented Aug 10, 2026

Copy link
Copy Markdown
Owner

First pass of ELKS networking fixes from recently opened issues. This batch of fixes is based on #2781 and @duzenko's proposed code changes, along with other cleanups.

@duzenko, this should fix a majority of the issues seen in your #2781 issue, eliminating hangs associated with RST's received during socket read or connect in network applications, as well as eliminating the race/deadlock condition sometimes seen during ktcp's processing of accept when heavy inbound and outbound data are also being processed. Ktcp memory leaks during some conditions when an RST is received are also fixed.

Additionally, more PASV port numbers were added to qemu.sh, and the -N 10.0.2.2 option was removed from the /etc/net.cfg default ftpd startup, since by default the slirp gateway of 10.0.2.2 is used without requiring the -N option. This lets ps show ftpd state without wrapping in column 80.

DEBUG_TCP is temporarily set for ktcp to show more details during testing, then will be turned off for much less verbose display.

Technical Summary

  • tcpdev_read()/tcpdev_connect():
    Return -EPIPE or -ECONNREFUSED instead of no reply at all, which would hang the network due to the read/connect being blocked on a single reply buffer in the tcpdev ktcp<->kernel transfer driver. Fixes network stack hangs during read or connect when CB is deallocated through a received RST or any other reason that deallocates an active CB.

  • tcp_established(): decrement tcpcb_need_push when a RST frees a CB that still has unread data to stop continual AVAIL_DATA notifications.

  • tcp_synrecv(): free the cloned CB on RST rather than only resetting state, each half-open RST leaked ~4.5K.

  • net_process_tcpdev() / TDT_ACCEPT:
    Copy accept() result out immediately and and release bufin_sem, which breaks a bufin_sem/bufout_sem deadlock between ktcp and ftpd under load.

Tested on QEMU, although needs more heavy testing with RST and heavy loads.

tcpdev_read()/tcpdev_connect():
Return -EPIPE or -ECONNREFUSED instead of no reply at all, which would hang
the network due to the read/connect being blocked on a single reply buffer
in the tcpdev ktcp<->kernel transfer driver. Fixes network stack hangs during
read or connect when CB is deallocated through a received RST or any other
reason that deallocates an active CB.

tcp_established(): decrement tcpcb_need_push when a RST frees a CB that still
has unread data to stop continual AVAIL_DATA notifications.

tcp_synrecv(): free the cloned CB on RST rather than only resetting state,
each half-open RST leaked ~4.5K.

inet_process_tcpdev() / TDT_ACCEPT:
Copy accept() result out immediately and and release bufin_sem, which
breaks a bufin_sem/bufout_sem deadlock between ktcp and ftpd under load.
@ghaerr
ghaerr merged commit 643d539 into master Aug 10, 2026
1 check passed
@ghaerr
ghaerr deleted the netfix1 branch August 10, 2026 02:01
@ghaerr ghaerr mentioned this pull request Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant