Messages in this thread | | | Date | Sat, 13 Jun 1998 23:32:38 +0300 (EEST) | From | Meelis Roos <> | Subject | More info on TCP oops |
| |
I investigated a little on the TCP oops I get with 2.1.105ac5 (includes the networking changes).
The oops occurs during TCP connection shutdown: >>EIP: c011047f <del_timer+13/3c> Trace: c016108d <tcp_reset_xmit_timer+3d/94> Trace: c015fa6d <tcp_send_skb+f9/144> Trace: c01605a9 <tcp_send_fin+1c1/1cc> Trace: c015c8d1 <tcp_close+175/26c> Trace: c0169b4e <inet_release+72/7c> Trace: c0144ae7 <sock_release+1f/50> Trace: c0144ee3 <sock_close+37/3c> Trace: c0123426 <__fput+22/50> Trace: c01234a3 <close_fp+4f/84> Trace: c01167c0 <do_exit+f8/20c> ...
It seems that tcp timestamps have to be turned off for it to happen - have got noopps with tcp_timestamps set to 1. But not 100% sure.
The oops seems to happen when I interrupt rsh when the connection is stalling at the moment. Not every time, the line must be quite busy.
One time I even had a reboot instead of oops in similar situation. Nort sure this is the same thing, but I did the same tests.
The line where the oops happens is inside del_timer in the macro detach_timer:
ret = detach_timer(timer);
In detach_timer, the offending line is underlined: static inline int detach_timer(struct timer_list *timer) { struct timer_list *prev = timer->prev; if (prev) { struct timer_list *next = timer->next; prev->next = next; ^^^^^^^^^^^^^^^^^^
It seems that the pointer 'prev' is trashed. edx that holds the address is 090a1828, eax is 090a11e0 (the data).
The timer in question is probe timer which is reset when setting transmit timer for the FIN packet.
In struct sock, the timers were preceded by ipv6 stuff when ipv6 was used. I compiled the kernel with ipv6 support to test wheteher the timers are left untouched now. So far I haven't succeeded to reproduce the oops, but it's late and the lines are quite unloaded. Will try it on monday.
--- Meelis Roos (mroos@tartu.cyber.ee)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |