Messages in this thread | | | Date | Fri, 24 Oct 2003 19:30:34 -0700 | From | "David S. Miller" <> | Subject | Re: possible bug in tcp_input.c |
| |
On Fri, 24 Oct 2003 18:29:59 +0200 Tomas Szepe <szepe@pinerecords.com> wrote:
> /* tcp_input.c, line 1138 */ > static inline int tcp_head_timedout(struct sock *sk, struct tcp_opt *tp) > { > return tp->packets_out && tcp_skb_timedout(tp, skb_peek(&sk->write_queue)); > } > > The passed NULL (and yes, this is where we are getting one) is dereferenced > immediately in: > > /* tcp_input.c, line 1133 */ > static inline int tcp_skb_timedout(struct tcp_opt *tp, struct sk_buff *skb) > { > return (tcp_time_stamp - TCP_SKB_CB(skb)->when > tp->rto); > }
If tp->packets_out is non-zero (which by definition it is in your case else the right hand side of the "&&" would not be evaluated) then we _MUST_ have some packets in sk->write_queue.
Something is being fiercely corrupted. Probably some piece of netfilter is freeing up an SKB one too many times thus corrupting the TCP write queue list pointers. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |