4 ms·

yes we have reported to Apple and they have filed it in their internal system.

otterley 6mo ago
Did you need to make this blog post 20 pages long and have AI write it? Especially in such dramatic style? Remember the golden rule: if you can't be bothered to write it yourself, why should your audience be bothered to read it ourselves?
Aloisius 6mo ago
Might want to update it if you used the blog post explanation because it's incorrect as justinfrankel noted below. From the post: tcp_now = 4,294,960,000 (frozen at pre-overflow value) The mistake in the blog post is timer isn't wrapped, even though it notes it should be: timer = 4,294,960,000 + 30,000 = 4,294,990,000 - MAX_INT = 22,704 Therefore: TSTMP_GEQ(4294960000, 22704) = 4294960000 - 22704 = 4294937296 = 4294937296 >= 0 ? → true! (not false) This is a bug of course, but it would cause sockets in TCP_WAIT state to be reaped anytime tcp_gc() is called, regardless of whether 2*MSL has passed or not. This only happens though if tcp_now gets stuck after 4,294,937,296 ms from boot. A bug similar to what the blog described can happen however if tcp_now gets stuck at least 30 seconds before it it would have wrapped. Since tcp_now is only updated if there is TCP traffic, this can happen if there is no TCP traffic for at least 30 seconds before before it would roll over (MAX_INT ms from boot). It's should be easy to prevent the latter from happening with some TCP traffic, though reaping TCP_WAIT connections early isn't great either.
- e28eta 6mo ago
  Since the code they show and their comment says `uint32_t timer` wraps, but then their math doesn’t wrap it, I wonder how they missed this. It’s also weird that their “smoking gun” example is with active TCP traffic, which (should?) be updating tcp_now and would make them more likely to fall into the “TCP_WAIT is immediately closed” case.
- mhjkl 6mo ago
  But the TSTMP_GEQ macro casts the difference to int, so any number above the signed integer limit (about 2 billion) becomes negative and the comparison returns false as they said

Did you need to make this blog post 20 pages long and have AI write it? Especially in such dramatic style? Remember the golden rule: if you can't be bothered to write it yourself, why should your audience be bothered to read it ourselves?

Aloisius 6mo ago

Might want to update it if you used the blog post explanation because it's incorrect as justinfrankel noted below. From the post: tcp_now = 4,294,960,000 (frozen at pre-overflow value) The mistake in the blog post is timer isn't wrapped, even though it notes it should be: timer = 4,294,960,000 + 30,000 = 4,294,990,000 - MAX_INT = 22,704 Therefore: TSTMP_GEQ(4294960000, 22704) = 4294960000 - 22704 = 4294937296 = 4294937296 >= 0 ? → true! (not false) This is a bug of course, but it would cause sockets in TCP_WAIT state to be reaped anytime tcp_gc() is called, regardless of whether 2*MSL has passed or not. This only happens though if tcp_now gets stuck after 4,294,937,296 ms from boot. A bug similar to what the blog described can happen however if tcp_now gets stuck at least 30 seconds before it it would have wrapped. Since tcp_now is only updated if there is TCP traffic, this can happen if there is no TCP traffic for at least 30 seconds before before it would roll over (MAX_INT ms from boot). It's should be easy to prevent the latter from happening with some TCP traffic, though reaping TCP_WAIT connections early isn't great either.

e28eta 6mo ago
Since the code they show and their comment says `uint32_t timer` wraps, but then their math doesn’t wrap it, I wonder how they missed this. It’s also weird that their “smoking gun” example is with active TCP traffic, which (should?) be updating tcp_now and would make them more likely to fall into the “TCP_WAIT is immediately closed” case.
mhjkl 6mo ago
But the TSTMP_GEQ macro casts the difference to int, so any number above the signed integer limit (about 2 billion) becomes negative and the comparison returns false as they said