Date: Fri, 1 Aug 2003 23:37:48 -0400 From: Don Bowman <don@sandvine.com> To: 'Mike Silbersack' <silby@silby.com>, Scot Loach <sloach@sandvine.com> Cc: "'freebsd-net@freebsd.org'" <freebsd-net@freebsd.org> Subject: RE: TCP socket shutdown race condition Message-ID: <FE045D4D9F7AED4CBFF1B3B813C85337027420F9@mail.sandvine.com>
index | next in thread | raw e-mail
> From: Mike Silbersack [mailto:silby@silby.com]
> On Fri, 1 Aug 2003, Scot Loach wrote:
>
> > Earlier this week one of our FreeBSD 4.7 boxes panic'd.
> I've posted the
> > stack trace at the end of this message. Using google, I've
> found several
> > references to this panic over the past three years, but it
> seems its never
> > been taken to root cause.
> >
> > The box crashes because the cr_uidinfo pointer in the
> so_cred structure is
> > null. However, on closer inspection the so_cred structure
> is corrupted
> > (cr_ref=3279453304 for example), so I'm guessing it has
> already been freed.
> > Looking closer at the socket, I see that the SS_NOFDREF
> flag is set, which
> > supports my theory. The tcpcb is in the CLOSED state, and
> has the SENTFIN
> > flag set.
>
> About how many concurrent connections are you pushing this machine to?
>
> There's an unfortunate problem with uidinfo in 4.x:
>
> struct uidinfo {
> LIST_ENTRY(uidinfo) ui_hash;
> rlim_t ui_sbsize; /* socket buffer
> space consumed */
> long ui_proccnt; /* number of processes */
> uid_t ui_uid; /* uid */
> u_short ui_ref; /* reference count */
> };
>
We are pushing in the ~50-~70K TCP connections to this process.
I think i see what you are suggesting :)
--don
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE045D4D9F7AED4CBFF1B3B813C85337027420F9>