From owner-freebsd-current@FreeBSD.ORG  Tue Dec 20 14:52:52 2011
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 115FE106567B;
	Tue, 20 Dec 2011 14:52:52 +0000 (UTC) (envelope-from jhb@freebsd.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id D9C868FC18;
	Tue, 20 Dec 2011 14:52:51 +0000 (UTC)
Received: from bigwig.baldwin.cx (bigwig.baldwin.cx [96.47.65.170])
	by cyrus.watson.org (Postfix) with ESMTPSA id 8FF5F46B37;
	Tue, 20 Dec 2011 09:52:51 -0500 (EST)
Received: from jhbbsd.localnet (unknown [209.249.190.124])
	by bigwig.baldwin.cx (Postfix) with ESMTPSA id BC689B998;
	Tue, 20 Dec 2011 09:52:50 -0500 (EST)
From: John Baldwin <jhb@freebsd.org>
To: Pawel Jakub Dawidek <pjd@freebsd.org>
Date: Tue, 20 Dec 2011 09:52:44 -0500
User-Agent: KMail/1.13.5 (FreeBSD/8.2-CBSD-20110714-p8; KDE/4.5.5; amd64; ; )
References: <20111022084931.GD1697@garage.freebsd.pl>
	<201112121100.23567.jhb@freebsd.org>
	<20111217232125.GA1685@garage.freebsd.pl>
In-Reply-To: <20111217232125.GA1685@garage.freebsd.pl>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Message-Id: <201112200952.44690.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7
	(bigwig.baldwin.cx); Tue, 20 Dec 2011 09:52:51 -0500 (EST)
Cc: Kostik Belousov <kostikbel@gmail.com>,
	Lawrence Stewart <lstewart@freebsd.org>,
	freebsd-current@freebsd.org, Andre Oppermann <andre@freebsd.org>,
	freebsd-net@freebsd.org
Subject: Re: 9.0-RC1 panic in tcp_input: negative winow.
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Dec 2011 14:52:52 -0000

On Saturday, December 17, 2011 6:21:27 pm Pawel Jakub Dawidek wrote:
> On Mon, Dec 12, 2011 at 11:00:23AM -0500, John Baldwin wrote:
> > An update.  I've sent Pawel a testing patch to see if my hypothesis is correct
> > (www.freebsd.org/~jhb/patches/tcp_negwin_test.patch).  If it is then I intend
> > to commit www.freebsd.org/~jhb/patches/tcp_negwin2.patch as the fix.
> 
> Unfortunately it paniced today. Take a look at:
> 
> 	http://people.freebsd.org/~pjd/misc/tcp_panic.jpg

Ok, the one use case I was worried about is happening regularly before your
panic, so that is good.  Can you use gdb to figure out which call to
tcp_output() is actually panic'ing?  I wonder if it is this case:

	/*
	 * Return any desired output.
	 */
	if (needoutput || (tp->t_flags & TF_ACKNOW)) {
		(void) tcp_output(tp);
		/* XXX: Debug */
		KASSERT(SEQ_GEQ(tp->rcv_adv, tp->rcv_nxt),
		    ("tcp_input: negative window after ACK"));

And if 'needoutput' is true, but TF_ACKNOW is not set, and tcp_output() decides
to not do anything.  I've updated tcp_negwin_test.patch to not panic if that call
to tcp_output() doesn't actually send a packet.  Please re-test.

-- 
John Baldwin