lkml.org 
[lkml]   [1998]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectMore info on TCP oops
I investigated a little on the TCP oops I get with 2.1.105ac5 (includes
the networking changes).

The oops occurs during TCP connection shutdown:
>>EIP: c011047f <del_timer+13/3c>
Trace: c016108d <tcp_reset_xmit_timer+3d/94>
Trace: c015fa6d <tcp_send_skb+f9/144>
Trace: c01605a9 <tcp_send_fin+1c1/1cc>
Trace: c015c8d1 <tcp_close+175/26c>
Trace: c0169b4e <inet_release+72/7c>
Trace: c0144ae7 <sock_release+1f/50>
Trace: c0144ee3 <sock_close+37/3c>
Trace: c0123426 <__fput+22/50>
Trace: c01234a3 <close_fp+4f/84>
Trace: c01167c0 <do_exit+f8/20c>
...

It seems that tcp timestamps have to be turned off for it to happen -
have got noopps with tcp_timestamps set to 1. But not 100% sure.

The oops seems to happen when I interrupt rsh when the connection is
stalling at the moment. Not every time, the line must be quite busy.

One time I even had a reboot instead of oops in similar situation. Nort
sure this is the same thing, but I did the same tests.

The line where the oops happens is inside del_timer in the macro
detach_timer:

ret = detach_timer(timer);

In detach_timer, the offending line is underlined:
static inline int detach_timer(struct timer_list *timer)
{
struct timer_list *prev = timer->prev;
if (prev) {
struct timer_list *next = timer->next;
prev->next = next;
^^^^^^^^^^^^^^^^^^

It seems that the pointer 'prev' is trashed.
edx that holds the address is 090a1828, eax is 090a11e0 (the data).

The timer in question is probe timer which is reset when setting transmit
timer for the FIN packet.

In struct sock, the timers were preceded by ipv6 stuff when ipv6 was used.
I compiled the kernel with ipv6 support to test wheteher the timers are
left untouched now. So far I haven't succeeded to reproduce the oops, but
it's late and the lines are quite unloaded. Will try it on monday.

---
Meelis Roos (mroos@tartu.cyber.ee)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.032 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site