From nobody Sun Oct 27 18:53:59 2024 X-Original-To: current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Xc5KV4q62z5bKKy for ; Sun, 27 Oct 2024 18:54:22 +0000 (UTC) (envelope-from tuexen@freebsd.org) Received: from drew.franken.de (drew.ipv6.franken.de [IPv6:2001:638:a02:a001:20e:cff:fe4a:feaa]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Certum Domain Validation CA SHA2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Xc5KV01vtz4fKS; Sun, 27 Oct 2024 18:54:22 +0000 (UTC) (envelope-from tuexen@freebsd.org) Authentication-Results: mx1.freebsd.org; none Received: from smtpclient.apple (unknown [IPv6:2a02:8109:1140:c3d:388f:baee:e516:fac3]) (Authenticated sender: macmic) by drew.franken.de (Postfix) with ESMTPSA id 2D22E7220B806; Sun, 27 Oct 2024 19:54:00 +0100 (CET) Content-Type: text/plain; charset=us-ascii List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3818.100.11.1.3\)) Subject: Re: panic: tcp_do_segment: sent too much From: tuexen@freebsd.org In-Reply-To: Date: Sun, 27 Oct 2024 19:53:59 +0100 Cc: rscheff@freebsd.org, current@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <06FF53D8-61BC-4A36-B434-5C015BB841D1@freebsd.org> References: To: Gleb Smirnoff X-Mailer: Apple Mail (2.3818.100.11.1.3) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:680, ipnet:2001:638::/32, country:DE] X-Rspamd-Queue-Id: 4Xc5KV01vtz4fKS X-Spamd-Bar: ---- > On 27. Oct 2024, at 17:38, Gleb Smirnoff wrote: >=20 > Hi, >=20 > I just got this panic on my desktop running latest stabweek snapshot. >=20 > panic: tcp_do_segment: sent too much > db_trace_self_wrapper() at db_trace_self_wrapper+0x2c/frame = 0xfffffe0209deb440 > kdb_backtrace() at kdb_backtrace+0x46/frame 0xfffffe0209deb4f0 > vpanic() at vpanic+0x23d/frame 0xfffffe0209deb630 > panic() at panic+0x4e/frame 0xfffffe0209deb690 > tcp_do_segment() at tcp_do_segment+0x3a6c/frame 0xfffffe0209deb8d0 > tcp_input_with_port() at tcp_input_with_port+0x15db/frame = 0xfffffe0209deba60 > tcp_input() at tcp_input+0x27/frame 0xfffffe0209deba90 > ip_input() at ip_input+0x1131/frame 0xfffffe0209debb00 > netisr_dispatch_src() at netisr_dispatch_src+0x18c/frame = 0xfffffe0209debb70 > netisr_dispatch() at netisr_dispatch+0x21/frame 0xfffffe0209debb90 > ether_demux() at ether_demux+0x2a5/frame 0xfffffe0209debbd0 > ether_input_internal() at ether_input_internal+0x613/frame = 0xfffffe0209debc10 > ether_nh_input() at ether_nh_input+0xb1/frame 0xfffffe0209debc30 > netisr_dispatch_src() at netisr_dispatch_src+0x18c/frame = 0xfffffe0209debca0 > netisr_dispatch() at netisr_dispatch+0x21/frame 0xfffffe0209debcc0 > ether_input() at ether_input+0x16c/frame 0xfffffe0209debd10 >=20 > My kernel is compiled with -O0, which alleviates debugging: Hi Gleb, I am aware of the panic, wlosh@ reported it, and pho@ mentioned that he can trigger it on bare metal using cd src/tools/test/stress2/misc ./all.sh -o tcp.sh I will try to reproduce it, once I have fix another bug reported by pho@ related to SCTP. Best regards Michael >=20 > (kgdb) frame 4 > #4 0xffffffff80ea6c3c in tcp_do_segment (tp=3D0xfffff814a6f96000, = m=3D0xfffff8044d546a00, th=3D0xfffff8044d546a82, drop_hdrlen=3D64, = tlen=3D0,=20 > iptos=3D72 'H') at /usr/src/FreeBSD/sys/netinet/tcp_input.c:2812 > 2812 = KASSERT((tp->t_dupacks =3D=3D 2 && > (kgdb) p tp->t_dupacks > $1 =3D 1 > (kgdb) p tp->snd_limited > $2 =3D 0 '\000' > (kgdb) p/x tp->t_flags=20 > $4 =3D 0x110003e4 > (kgdb) p/x tp->t_flags & 0x00000010 # TF_SENTFIN > $5 =3D 0x0 > (kgdb) p tp->t_flags & 1 # TF_ACKNOW > $15 =3D 0 > (kgdb) p sent > $6 =3D 1507 > (kgdb) p maxseg > $7 =3D 1400 > (kgdb) p oldcwnd > $8 =3D 1400 > (kgdb) p oldsndmax > $9 =3D 2473784830 > (kgdb) p tp->snd_max > $10 =3D 2473786337 > (kgdb) p 2473786337 - 2473784830 > $11 =3D 1507 > (kgdb) p tp->snd_cwnd > $12 =3D 2800 > (kgdb) p avail > $13 =3D 2018 > (kgdb) p tp->snd_nxt - tp->snd_una > $16 =3D 2018 > (kgdb) p so->so_snd.sb_acc > $17 =3D 2018 > (kgdb) p *tp->snd_holes.tqh_first > $22 =3D {start =3D 2473784319, end =3D 2473784358, rxmit =3D = 2473784319, scblink =3D {tqe_next =3D 0x0, tqe_prev =3D = 0xfffff814a6f96350}} >=20 > Apparently tcp_output() has sent more than one segment. I don't know = if this old > assertion is correct, but looks like it started to trigger. >=20 > Could this be related to 440f4ba18e3a? >=20 > --=20 > Gleb Smirnoff