Messages in this thread Patch in this message | | | Date | Tue, 6 Oct 1998 02:08:43 +0200 (CEST) | From | Andrea Arcangeli <> | Subject | [patch] Re: oops in __release_sock() [2.0.35] |
| |
On Sun, 4 Oct 1998, Michael L. Galbraith wrote:
>> Aaargh. This problem is much worse than a "harmless __release_sock oops" >> then. Before the oops is triggered in release_sock, the line >> >> sk->dead = 1
Maybe not (see under).
I think that the problem is a destroy_sock() done at a wrong time.
The only destroy_sock() that can harm I have found is the one in the net_timer (the main sock TCP timer) if the sk->timeout is TIME_DONE (that timer can be set by tcp_set_state() if the tcp connection is in the TCP_CLOSE state (our case) and can have a very short timeout (eventually close to 0)).
The net_timer(TIME_DONE) is able to free the sock if the sock is declared dead!! and we declare the sock dead a bit before see the Oops (and my first debugging patch does nothing but it was placed before the dead settings).
This patch seems at least safe to me (but I don' t understand at all the TCP code to be sure this is the right patch, and now it' s a bit late so I can be wrong...).
--- linux-2.0.35/net/ipv4/tcp.c~ Sun Oct 4 15:28:36 1998 +++ linux-2.0.35/net/ipv4/tcp.c Tue Oct 6 01:40:49 1998 @@ -2046,11 +2046,12 @@ tcp_reset_msl_timer(sk, TIME_CLOSE, TCP_FIN_TIMEOUT); } - sk->dead = 1; release_sock(sk); if(sk->state == TCP_CLOSE) tcp_v4_unhash(sk); + + sk->dead = 1; } Andrea[s] Arcangeli
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |