AW: FreeBSD 7.2-BETA1 tcp retransmit crash

[Blapp, Martin]

Hi,

(kgdb) frame 7
#7  0xc07c6cb0 in sbsndptr (sb=0xc342ede4, off=112, len=113, moff=0xc2f9ca04) at /usr/src/sys/kern/uipc_sockbuf.c:939

This is also interesting. Is this an OffByOne somewhere ?

As I said it's just a workaround, and for now it didn't crash anymore :-)

I could modify this patch to see what happens exactly, dumpping the mbuf.
The workaround I currently use is just skipping and dropping this mbuf:

--- sys/kern/uipc_sockbuf.c.orig        2009-04-05 18:01:35.000000000 +0200
+++ sys/kern/uipc_sockbuf.c     2009-04-05 18:01:46.000000000 +0200
@@ -930,6 +930,13 @@
                return (sb->sb_mb);
        }

+       /*
+        * Try to avoid some retransmit panics
+        */
+       if (sb->sb_sndptr == NULL && sb->sb_mb == NULL) {
+               return (NULL);
+       }
+
        /* Return closest mbuf in chain for current offset. */
        *moff = off - sb->sb_sndptroff;
        m = ret = sb->sb_sndptr ? sb->sb_sndptr : sb->sb_mb;
--- sys/netinet/tcp_output.c.orig       2009-04-05 18:01:29.000000000 +0200
+++ sys/netinet/tcp_output.c    2009-04-05 18:04:17.000000000 +0200
@@ -797,6 +797,17 @@
                 */
                mb = sbsndptr(&so->so_snd, off, len, &moff);

+
+               /*
+                * Avoid panics. Mask the error with ENETDOWN
+                */
+               if (mb == NULL) {
+                       SOCKBUF_UNLOCK(&so->so_snd);
+                       (void) m_free(m);
+                       error = ENETDOWN;
+                       goto out;
+               }
+
                if (len <= MHLEN - hdrlen - max_linkhdr) {
                        m_copydata(mb, moff, (int)len,
                            mtod(m, caddr_t) + hdrlen);