From nobody Fri Jun 10 22:18:57 2022 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id BC44283B72B for ; Fri, 10 Jun 2022 22:18:58 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LKb35708Jz3kxS for ; Fri, 10 Jun 2022 22:18:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 549F720DC9 for ; Fri, 10 Jun 2022 22:18:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 25AMIvGL013003 for ; Fri, 10 Jun 2022 22:18:57 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 25AMIvUE013002 for net@FreeBSD.org; Fri, 10 Jun 2022 22:18:57 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 264257] [tcp] Panic: Fatal trap 12: page fault while in kernel mode (if_io_tqg_4) - m_copydata ... at /usr/src/sys/kern/uipc_mbuf.c:659 Date: Fri, 10 Jun 2022 22:18:57 +0000 X-Bugzilla-Reason: CC AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 13.1-RELEASE X-Bugzilla-Keywords: crash, needs-qa X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: rscheff@freebsd.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? maintainer-feedback? maintainer-feedback- maintainer-feedback? mfc-stable13? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1654899538; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jtx6dtuj5cQyu3Pd0q/6jt2A7RygeBs8QzP4pzmxTh8=; b=yxawuyKhR0jV1rjtvKxTpy7+4WLUvIUARVUeo5Mx8Y5ax8pBNbeoS7Qb1TDioWZ2GQqoC0 Ramtu5I4wHAGDJAumE60wKxhTsFpn4azstfXIdd2vKvX7U/RhmCaCp/SBhpXoqbG1IjJgd xWL2fw20E1CrOj4C4BV4mfFngS51YqcPhi0LgXRm17yGoXDJ+NUUOdwb6NhnCDQl7CN4y/ 4hvpH1X2z5tsYSOTtjF+SGOTyBDTWX6+FPRrxFEdb4urTssZvZslQGnTIDwdxaM8xT5IIS zzmljFjNJP1nq/xRUVkAB5PGMb/AJMkzDo4ssUwZW9PjK62cQWL2Wpfkv2GymQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1654899538; a=rsa-sha256; cv=none; b=Osy+xc6vYYafL0zQYftqhEO5b/mFzk45tw+bS/HykO/6oZrht+1tqOa5XH9oqCG7QBKENw dBw4KGWiStyX10mXs4IJ8qi/4gI6bcuXjBO7xxMTI8MWzTGBocfI9F5xfkIpf5495PyXKy 50QnFFKAvwswjwvECyCfFyIV9EkFk62XcIUDT22oo18wanmhuO/WE84MGdzzFEl+2RmTcg SZmKqWbJO69FDecnSDD1idlhLQTKIK6ZrQkThPWhmEKp9BLtG0l7B9WL6f8gCXUd/YozJK oNuIw+x25k8o8oHAu+jJdkYj78a1mnp7RJGA5hp8K5COWn9L2otpo+1WmK51LQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D264257 --- Comment #24 from Richard Scheffenegger --- The current thinking is, that SACK rescue retransmissions (in FBSD13 this is gated by net.inet.tcp.rfc6675_pipe=3D1) very rarely creates an entry, which apparently is beyond the valid data range.=20 While under most common circumstances, a final FIN bit in the sequence spac= e is taken care of, it seems that there may be some double-counting for the FIN = bit. In most of the inspected cores, we found: TCP state: LAST_ACK (FIN received and also FIN sent) SACK loss recovery triggered A cumulative ACK before all outstanding data was received The remote cliet "disappears" for a significant amount of time (7 to 12 retransmission timeouts), but may re-appear again just prior. snd_max consistently 2 counts above the last data, instead of the expected 1 (for the FIN bit). However, it is still unclear under what circumstances this double-counting happens, possibly when the persist timer triggers, and a few other conditio= ns are also fulfilled - maybe a race condition between normal packet processing and a timer firing. In short: disabling rfc6675 enhanced SACK features (more correct pipeline accounting, rescue retransmissions) should address the cause of the panic, while not addressing the root cause of when/why there is the double-account= ing of the FIN bit... Would you be willing to run an intrumented kernel, which either panics (full core dump), or spews out various state, when inconsistencies are detected in this space - while ignoring/addressing them "on the fly" without panicing? --=20 You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.=