[Bug 254725] 13.0-RC4 crash tcp_lro

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254725

--- Comment #10 from Richard Scheffenegger <rscheff at freebsd.org> ---
received the core and kernel.debug symbols.

The panic is likely a off-by-one related to the FIN bit, but not with the
rescue retransmission, but rather PRR.

The TCP state indicates, that only the last data byte, and the final FIN bit
are unacknowledged. 

frame 11:
(kgdb) p *tp->sackhint.nexthole
$48 = {start = 935342315, end = 935342316, rxmit = 935342315, scblink =
{tqe_next = 0x0, tqe_prev = 0xfffffe013eac0618}}
(kgdb) p tp->snd_max
$49 = 935342317
(kgdb) p tp->snd_una
$50 = 935342315

(kgdb) p/x tp->t_flags
$6 = 0x603003f4  ====> TF_SENTFIN is set.

Now, the FIN bit occupys the last Seq# (..317).
The SACK hole should therefore be a valid 1 byte hole, which hasn't been
retransmitted...

The incoming SACK appears to be SACKing the FIN bit?

(kgdb) p/x *(struct sackblk *)to.to_sacks
$53 = {start = 0xec30c037, end = 0xed30c037}
(kgdb) p 0x37c030ec
$54 = 935342316
(kgdb) p 0x37c030ed
$55 = 935342317

-- 
You are receiving this mail because:
You are the assignee for the bug.