xdp-tcp: bugfix: crash by moving pointed conn in reset queue

diff --git a/src/libknot/xdp/tcp.c b/src/libknot/xdp/tcp.c
index d94b07cdf2ce86cb0ba58888af4a2488f1060996..255e7c602f7c228ad3cd5d48174d5c71ee778f03 100644 (file)
--- a/src/libknot/xdp/tcp.c
+++ b/src/libknot/xdp/tcp.c
@@ -168,27 +168,32 @@ static void del_conn(knot_tcp_conn_t *conn)
        }
 }
 
-static void tcp_table_remove_conn(knot_tcp_conn_t **todel)
-{
-       rem_node(tcp_conn_node(*todel)); // remove from timeout double-linked list
-       *todel = (*todel)->next; // remove from conn-table linked list
-}
-
-static void tcp_table_remove(knot_tcp_conn_t **todel, knot_tcp_table_t *table)
+static void rem_align_pointers(knot_tcp_conn_t *to_rem, knot_tcp_table_t *table)
 {
-       assert(table->usage > 0);
-       if (*todel == table->next_close) {
+       if (to_rem == table->next_close) {
                next_node_ptr(&table->next_close);
        }
-       if (*todel == table->next_ibuf) {
+       if (to_rem == table->next_ibuf) {
                next_ptr_ibuf(&table->next_ibuf);
        }
-       if (*todel == table->next_obuf) {
+       if (to_rem == table->next_obuf) {
                next_ptr_obuf(&table->next_obuf);
        }
-       if (*todel == table->next_resend) {
+       if (to_rem == table->next_resend) {
                next_ptr_obuf(&table->next_resend);
        }
+}
+
+static void tcp_table_remove_conn(knot_tcp_conn_t **todel)
+{
+       rem_node(tcp_conn_node(*todel)); // remove from timeout double-linked list
+       *todel = (*todel)->next; // remove from conn-table linked list
+}
+
+static void tcp_table_remove(knot_tcp_conn_t **todel, knot_tcp_table_t *table)
+{
+       assert(table->usage > 0);
+       rem_align_pointers(*todel, table);
        table->inbufs_total -= (*todel)->inbuf.iov_len;
        table->outbufs_total -= tcp_outbufs_usage((*todel)->outbufs);
        tcp_table_remove_conn(todel);
@@ -299,6 +304,7 @@ int knot_tcp_recv(knot_tcp_relay_t *relays, knot_xdp_msg_t msgs[], uint32_t msg_
                        assert(conn->mss != 0);
                        conn_update(conn, msg);
 
+                       rem_align_pointers(conn, tcp_table);
                        rem_node(tcp_conn_node(conn));
                        add_tail(tcp_table_timeout(tcp_table), tcp_conn_node(conn));