sbflush_locked panic and tcp_sack

[Andre Oppermann]

Maxim Konovalov wrote:
> Hi,
> 
> I got a panic at the end of sbflush_locked() on recent -current when
> open a large photo gallery with firefox.
> 
> if (sb->sb_cc || sb->sb_mb || sb->sb_mbcnt)
>                 panic("sbflush_locked: cc %u || mb %p || mbcnt %u", sb->sb_cc,
> 			(void *)sb->sb_mb, sb->sb_mbcnt);
> 
> It seems I can reproduce this panic easily.  Moreover, turning
> tcp_sack off eliminates this panic.  Does anybody see that?
> 
> http://maxim.int.ru/stuff/panic/SONNIE
> http://maxim.int.ru/stuff/panic/kgdb.typescript
> http://maxim.int.ru/stuff/panic/sysctl-a

This rings a bell.  Sounds like a problem with delayed header drop in TCP
segments.  In tcp_input() have the variable "tlen" examined.

-- 
Andre