From owner-freebsd-net@freebsd.org Mon Apr 5 09:03:38 2021 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 003175C7C38 for ; Mon, 5 Apr 2021 09:03:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 4FDPpK6FWPz3k3q for ; Mon, 5 Apr 2021 09:03:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id D60915C79C2; Mon, 5 Apr 2021 09:03:37 +0000 (UTC) Delivered-To: net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id D5B755C7AFA for ; Mon, 5 Apr 2021 09:03:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FDPpK5Tgqz3kKV for ; Mon, 5 Apr 2021 09:03:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A4A5A15D56 for ; Mon, 5 Apr 2021 09:03:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 13593bDw051677 for ; Mon, 5 Apr 2021 09:03:37 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 13593biC051676 for net@FreeBSD.org; Mon, 5 Apr 2021 09:03:37 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 254725] [tcp] 13.0-RC4 crash tcp_lro Date: Mon, 05 Apr 2021 09:03:36 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 13.0-STABLE X-Bugzilla-Keywords: panic X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: rscheff@freebsd.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: short_desc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Apr 2021 09:03:38 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D254725 Richard Scheffenegger changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|13.0-RC4 crash tcp_lro |[tcp] 13.0-RC4 crash | |tcp_lro --- Comment #14 from Richard Scheffenegger --- Extracted a more complete set of packet headers belonging to the problematic session from the privately provided core. The session is ECN-enabled At the time of the panic, SENTFIN was set Based on the Timestamp option of the incoming ACKs, serious reordering and spurious retransmissions were going on. The final packet with FIN originally has a payload of 1 byte. (TSopt val ..5625), but that is apparently lost and not received by the client. Susequently (based on TSopt val), just the FIN is retransmitted twice, with TSopt val ..5861 and ..5979 (e.g. when a transmission opportunity would be there, but no new data is available). The RTT appears to be nearly 100ms from the very last round, sRTT is averag= ed at 275ms At the panic, TSval would have been ..5988 This is for retransmitting the final payload byte, as the client only SACKed the 1st FIN retransmission.=20 However, for some reason that byte is no longer available in the send socket buffer, causing the crash. Srv -> clnt F. 9999:10000(1) //dropped Clnt -> Srv E. 1:1(0) ack -26seg (unobserved retransmission Srv->Clnt) Clnt -> Srv E. 1:1(0) ack 9999 Srv -> cnt F. 10000:10000(0) Clnt -> Srv E. 1:1(0) ack 9999 attempt to retransmit 10000:10001(1) -> crash. However, current attempts to recreate this misbehavior were unsuccessful in recreating the panic. --=20 You are receiving this mail because: You are the assignee for the bug.=