Date: Wed, 05 Oct 2016 18:46:04 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 213232] [tcp] [panic] tcp_output() Panic String: tcp_output: len > IP_MAXPACKET (at r306658) Message-ID: <bug-213232-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D213232 Bug ID: 213232 Summary: [tcp] [panic] tcp_output() Panic String: tcp_output: len > IP_MAXPACKET (at r306658) Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: hiren@FreeBSD.org (kgdb) bt #0 __curthread () at ./machine/pcpu.h:221 #1 doadump (textdump=3D492866688) at /d0/hiren/freebsd/sys/kern/kern_shutdown.c:298 #2 0xffffffff80395066 in db_fncall_generic (nargs=3D0, addr=3D<optimized o= ut>, rv=3D<optimized out>, args=3D<optimized out at /d0/hiren/freebsd/sys/ddb/db_command.c:581 #3 db_fncall (dummy1=3D<optimized out>, dummy2=3D<optimized out>, dummy3=3D<optimized out>, dummy4=3D<optimized out>) at /d0/hiren/freebsd/sys/ddb/db_command.c:629 #4 0xffffffff80394bc9 in db_command (last_cmdp=3D<optimized out>, cmd_table=3D<optimized out>, dopager=3D<optimized out> at /d0/hiren/freebsd/sys/ddb/db_command.c:453 #5 0xffffffff80394924 in db_command_loop () at /d0/hiren/freebsd/sys/ddb/db_command.c:506 #6 0xffffffff803979df in db_trap (type=3D<optimized out>, code=3D<optimize= d out>) at /d0/hiren/freebsd/sys/ddb/db_main #7 0xffffffff80a90003 in kdb_trap (type=3D<optimized out>, code=3D<optimiz= ed out>, tf=3D<optimized out>) at /d0/hiren/fr #8 0xffffffff80ec5ce4 in trap (frame=3D0xfffffe201d6090f0) at /d0/hiren/freebsd/sys/amd64/amd64/trap.c:559 #9 <signal handler called> #10 kdb_enter (why=3D0xffffffff813f7eb8 "panic", msg=3D0x80 <error: Cannot = access memory at address 0x80>) at /d0/hiren #11 0xffffffff80a4e41f in vpanic (fmt=3D<optimized out>, ap=3D0xfffffe201d6= 09280) at /d0/hiren/freebsd/sys/kern/kern_sh #12 0xffffffff80a4e276 in kassert_panic (fmt=3D0xffffffff8142a88d "%s: len > IP_MAXPACKET") at /d0/hiren/freebsd/sys/ #13 0xffffffff80c3660a in tcp_output (tp=3D<optimized out>) at /d0/hiren/freebsd/sys/netinet/tcp_output.c:987 #14 0xffffffff80c333a2 in tcp_do_segment (m=3D<optimized out>, th=3D<optimi= zed out>, so=3D<optimized out>, tp=3D<optimized=20 tlen=3D<optimized out>, iptos=3D<optimized out>, ti_locked=3D<error rea= ding variable: Cannot access memory at address at /d0/hiren/freebsd/sys/netinet/tcp_input.c:3169 #15 0xffffffff80c2f690 in tcp_input (mp=3D<optimized out>, offp=3D<optimize= d out>, proto=3D<optimized out>) at /d0/hiren/ #16 0xffffffff80bbc901 in ip_input (m=3D0x4) at /d0/hiren/freebsd/sys/netinet/ip_input.c:809 #17 0xffffffff80b57630 in netisr_dispatch_src (proto=3D1, source=3D0, m=3D0xfffff807bf186300) at /d0/hiren/freebsd/sys/ne #18 0xffffffff80b4183a in ether_demux (ifp=3D<optimized out>, m=3D0x80) at /d0/hiren/freebsd/sys/net/if_ethersubr.c:848 #19 0xffffffff80b42637 in ether_input_internal (ifp=3D<optimized out>, m=3D= 0x80) at /d0/hiren/freebsd/sys/net/if_ethers #20 ether_nh_input (m=3D<optimized out>) at /d0/hiren/freebsd/sys/net/if_ethersubr.c:667 #21 0xffffffff80b57630 in netisr_dispatch_src (proto=3D5, source=3D0, m=3D0xfffff807bf186300) at /d0/hiren/freebsd/sys/ne #22 0xffffffff80b41ba2 in ether_input (ifp=3D<optimized out>, m=3D0x0) at /d0/hiren/freebsd/sys/net/if_ethersubr.c:757 #23 0xffffffff805e2dcb in ixgbe_rx_input (rxr=3D<optimized out>, ifp=3D<opt= imized out>, m=3D0xfffff807bf186300, ptype=3D<op at /d0/hiren/freebsd/sys/dev/ixgbe/ix_txrx.c:1704 #24 ixgbe_rxeof (que=3D<optimized out>) at /d0/hiren/freebsd/sys/dev/ixgbe/ix_txrx.c:1985 #25 0xffffffff805da70c in ixgbe_msix_que (arg=3D0xfffff80114812870) at /d0/hiren/freebsd/sys/dev/ixgbe/if_ix.c:1572 #26 0xffffffff80a147a6 in intr_event_execute_handlers (p=3D<optimized out>, ie=3D<optimized out>) at /d0/hiren/freebsd/ #27 0xffffffff80a14e26 in ithread_execute_handlers (ie=3D<optimized out>, p=3D<optimized out>) at /d0/hiren/freebsd/sys #28 ithread_loop (arg=3D<optimized out>) at /d0/hiren/freebsd/sys/kern/kern_intr.c:1356 #29 0xffffffff80a11eb4 in fork_exit (callout=3D0xffffffff80a14d80 <ithread_= loop>, arg=3D0xfffff801147babe0, frame=3D0xfff at /d0/hiren/freebsd/sys/kern/kern_fork.c:1038 #30 <signal handler called> (kgdb)=20 This box paniced while sitting idle. Just running -head and no special conf= igs. ix0@pci0:4:0:0: class=3D0x020000 card=3D0x061115d9 chip=3D0x10fb8086 rev=3D= 0x01 hdr=3D0x00 vendor =3D 'Intel Corporation' device =3D '82599ES 10-Gigabit SFI/SFP+ Network Connection' class =3D network subclass =3D ethernet tso is on. http://svn.freebsd.org/changeset/base/211317 added the check where its panicing.=20 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D132832 which caused r21= 1317 I've not looked at it into much detail. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-213232-8>