From owner-freebsd-net@FreeBSD.ORG  Mon Oct 10 18:08:39 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id F23871065670
	for <freebsd-net@freebsd.org>; Mon, 10 Oct 2011 18:08:39 +0000 (UTC)
	(envelope-from andre@freebsd.org)
Received: from c00l3r.networx.ch (c00l3r.networx.ch [62.48.2.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 688C88FC16
	for <freebsd-net@freebsd.org>; Mon, 10 Oct 2011 18:08:39 +0000 (UTC)
Received: (qmail 43497 invoked from network); 10 Oct 2011 16:50:15 -0000
Received: from localhost (HELO [127.0.0.1]) ([127.0.0.1])
	(envelope-sender <andre@freebsd.org>)
	by c00l3r.networx.ch (qmail-ldap-1.03) with SMTP
	for <np@FreeBSD.org>; 10 Oct 2011 16:50:15 -0000
Message-ID: <4E9334A6.2050907@freebsd.org>
Date: Mon, 10 Oct 2011 20:08:38 +0200
From: Andre Oppermann <andre@freebsd.org>
User-Agent: Mozilla/5.0 (Windows NT 5.1;
	rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: np@FreeBSD.org
References: <20111010173640.GA79248@hub.freebsd.org>
In-Reply-To: <20111010173640.GA79248@hub.freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-net@freebsd.org
Subject: Re: panic in tcp_drop (and fix for it)
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Oct 2011 18:08:40 -0000

On 10.10.2011 19:36, Navdeep Parhar wrote:
> While stress testing a few systems, I encountered a panic in tcp_drop
> due to NULL tp->t_inpcb.  tcp_drop had been called by tcp_timer_rexmt.
> The problem is that timer_rexmt lets go of the pcbinfo and inp locks and
> the inp could be dropped by the time it re-acquires the locks.
>
> The attached patch fixes the problem.  I've observed the counter in the
> patch go up by 2-3 in 48 hours or so.  If someone can review the patch
> I can push it (without the counter) to head.

Looks good w/o the counter.

> Regards,
> Navdeep
>
> --- a/sys/netinet/tcp_timer.c
> +++ b/sys/netinet/tcp_timer.c
> @@ -439,6 +439,8 @@
>   	CURVNET_RESTORE();
>   }
>
> +static int tcp_rexmt_inpdrop_race = 0;
> +
>   void
>   tcp_timer_rexmt(void * xtp)
>   {
> @@ -495,6 +497,14 @@
>   			CURVNET_RESTORE();
>   			return;
>   		}
> +		if (inp->inp_flags&  INP_DROPPED) {
> +			tcp_rexmt_inpdrop_race++;
> +			INP_WUNLOCK(inp);
> +			INP_INFO_WUNLOCK(&V_tcbinfo);
> +			CURVNET_RESTORE();
> +			return;
> +		}
> +
>   		tp = tcp_drop(tp, tp->t_softerror ?
>   			      tp->t_softerror : ETIMEDOUT);
>   		headlocked = 1;
>
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
>