From owner-freebsd-net@FreeBSD.ORG  Thu Apr  4 22:33:11 2013
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id BDD213A5
 for <freebsd-net@freebsd.org>; Thu,  4 Apr 2013 22:33:11 +0000 (UTC)
 (envelope-from rmacklem@uoguelph.ca)
Received: from esa-annu.net.uoguelph.ca (esa-annu.mail.uoguelph.ca
 [131.104.91.36]) by mx1.freebsd.org (Postfix) with ESMTP id 8928F153
 for <freebsd-net@freebsd.org>; Thu,  4 Apr 2013 22:33:11 +0000 (UTC)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqEEAIf+XVGDaFvO/2dsb2JhbABDFoMmgyi9YYEbdIIfAQEoBIEFAgINGQJfiCcMoEeOUpJEgSONRIJogRMDlm6BIIhVhxiDJyCBbA
X-IronPort-AV: E=Sophos;i="4.87,411,1363147200"; d="scan'208";a="22510910"
Received: from erie.cs.uoguelph.ca (HELO zcs3.mail.uoguelph.ca)
 ([131.104.91.206])
 by esa-annu.net.uoguelph.ca with ESMTP; 04 Apr 2013 18:33:10 -0400
Received: from zcs3.mail.uoguelph.ca (localhost.localdomain [127.0.0.1])
 by zcs3.mail.uoguelph.ca (Postfix) with ESMTP id BF39EB402B
 for <freebsd-net@freebsd.org>; Thu,  4 Apr 2013 18:33:10 -0400 (EDT)
Date: Thu, 4 Apr 2013 18:33:10 -0400 (EDT)
From: Rick Macklem <rmacklem@uoguelph.ca>
To: FreeBSD Net <freebsd-net@freebsd.org>
Message-ID: <1043692819.529554.1365114790772.JavaMail.root@erie.cs.uoguelph.ca>
Subject: panic in tcp_do_segment()
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [172.17.91.202]
X-Mailer: Zimbra 6.0.10_GA_2692 (ZimbraWebClient - IE8 (Win)/6.0.10_GA_2692)
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Apr 2013 22:33:11 -0000

Hi,

When pho@ was doing some NFS testing, he got the
following crash, which I can't figure out. (As far
as I can see, INP_WLOCK() is always held when
tp->t_state = TCPS_CLOSED and it is held from before
the test for TCPS_CLOSED in tcp_input() up until
the tcp_do_segment() call. As such, I don't see how
tp->t_state can be TCPS_CLOSED, but that seems to
be what causes the panic?)

The "umount -f" will result in:
  soshutdown(so, SHUT_WR);
  soclose(so);
being done by the krpc on the socket.

Anyone have any ideas on this?
pho@ wrote:
> I continued running the NFS tests and got this "panic: tcp_do_segment:
> TCPS_LISTEN". It's the second time I get this panic with the same test
> scenario, so it seems to be reproducible. The scenario is "umount -f"
> of a mount point that is very active.
>
> http://people.freebsd.org/~pho/stress/log/kostik555.txt

Thanks in advance for any help, rick