ouroboros/src, branch be

ipcpd: Refactor dt stats

2026-06-03T06:02:34+00:00

Use relaxed atomics in hot path to bump stats via dt_stat_inc/dt_stat_load. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Reclaim aged leaked ssm pool blocks

2026-06-03T06:02:34+00:00

The reclaim_pid_from_sc() function reaped any block allocated with refcount from a dead PID, but cross-process hand-offs can leave a block briefly allocated by the producer while a live consumer still holds it. This skips reclaim within SSM_POOL_RECLAIM_AGE_S (default 60s) so in-flight hand-offs survive a producer crash. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix overflow in ssm_flow_set_notify

2026-06-03T06:02:34+00:00

ssm_flow_set_notify wrote past the fqueue because of a missing bound check, corrupting adjacent memory under burst. Drop redundant FLOW_PKT when full and reserve the last slot for control events so they aren't starved by data-plane traffic. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Send stream FIN in the window

2026-06-01T05:43:48+00:00

The stream FIN was not gated on the flow control window, potentially causing a seqno overrun if the windows was full. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix missing newlines in hash.c

2026-06-01T05:43:48+00:00

Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix FRCT seqno leak on rxm alloc failure

2026-06-01T05:43:48+00:00

The seqno was committed before calling rxm_arm, whose malloc could fail and silently leave the seqno without a retransmission entry. None of the recovery paths (RTO timer, RACK, SACK-driven, NACK-driven) can repair a slot with NULL rxm, so the gap persists until the receiver's keepalive marks the flow dead. This fix splits rxm_arm into rxm_alloc plus rxm_arm (post-state install). sack_rxm_snd follows the same alloc-then-arm shape. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix double pool_remove on tx-path failure

2026-06-01T05:43:43+00:00

The flow_tx_spb function consumed the spb on every failure path via ssm_pool_remove, while its caller ipcp_flow_write left the spb to its caller on early outs, causing ssm_pool_remove to be called twice. In Debug builds this aborts at the old_ref == 0 check. This aligns flow_tx_spb with np1_flow_write and dt_write_packet: spb consumed on success, retained on failure. External callers already release on failure, so no caller-side changes outside of dev.c are needed. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Fully gate fa/dt RIB ops on IPCP_FLOW_STATS

2026-05-27T13:55:08+00:00

The previous shape registered no-op _rib_read / _rib_readdir / _rib_getattr handlers when IPCP_FLOW_STATS was off, and there was a bug where *buf was not set in the no-op causing free on an uninitialized pointer. IPCP_FLOW_STATS was referenced by config.h.in but the declaration was lost during the CMake refactor. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Drain mainloop before component shutdown

2026-05-27T13:55:08+00:00

Worker mid fa_dealloc could still try to read from fa.psched because stop_components() ran before ipcp_stop()/tpm_stop(). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Close dt stat_used race vs rib readdir

2026-05-27T13:55:08+00:00

The stat_used function updated dt.stat[fd].stamp under the per-stat mutex, released it, then took dt.lock wrlock to bump dt.n_flows. A concurrent dt_rib_readdir holding dt.lock rdlock between those two critical sections saw the new stamp but the old n_flows. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders