sbflush_locked panic and tcp_sack

[Andre Oppermann]

Maxim Konovalov wrote:
> On Mon, 19 Sep 2005, 14:23+0200, Andre Oppermann wrote:
> 
> 
>>Maxim Konovalov wrote:
>>
>>>Hi,
>>>
>>>I got a panic at the end of sbflush_locked() on recent -current when
>>>open a large photo gallery with firefox.
>>>
>>>if (sb->sb_cc || sb->sb_mb || sb->sb_mbcnt)
>>>                panic("sbflush_locked: cc %u || mb %p || mbcnt %u",
>>>                sb->sb_cc,
>>>   (void *)sb->sb_mb, sb->sb_mbcnt);
>>>
>>>It seems I can reproduce this panic easily.  Moreover, turning
>>>tcp_sack off eliminates this panic.  Does anybody see that?
>>>
>>>http://maxim.int.ru/stuff/panic/SONNIE
>>>http://maxim.int.ru/stuff/panic/kgdb.typescript
>>>http://maxim.int.ru/stuff/panic/sysctl-a
>>
>>This rings a bell.  Sounds like a problem with delayed header drop in TCP
>>segments.  In tcp_input() have the variable "tlen" examined.
> 
> Well, there is no tcp_input() in the backtrace.

Yes, it must have happend before and left the socket buffer in an inconsistent
state.

-- 
Andre