[lkml]   [1998]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[patch] Re: oops in __release_sock() [2.0.35]
On Sun, 4 Oct 1998, Michael L. Galbraith wrote:

>> Aaargh. This problem is much worse than a "harmless __release_sock oops"
>> then. Before the oops is triggered in release_sock, the line
>> sk->dead = 1

Maybe not (see under).

I think that the problem is a destroy_sock() done at a wrong time.

The only destroy_sock() that can harm I have found is the one in the
net_timer (the main sock TCP timer) if the sk->timeout is TIME_DONE (that
timer can be set by tcp_set_state() if the tcp connection is in the
TCP_CLOSE state (our case) and can have a very short timeout (eventually
close to 0)).

The net_timer(TIME_DONE) is able to free the sock if the sock is declared
dead!! and we declare the sock dead a bit before see the Oops (and my
first debugging patch does nothing but it was placed before the dead

This patch seems at least safe to me (but I don' t understand at all the
TCP code to be sure this is the right patch, and now it' s a bit late
so I can be wrong...).

--- linux-2.0.35/net/ipv4/tcp.c~ Sun Oct 4 15:28:36 1998
+++ linux-2.0.35/net/ipv4/tcp.c Tue Oct 6 01:40:49 1998
@@ -2046,11 +2046,12 @@
tcp_reset_msl_timer(sk, TIME_CLOSE, TCP_FIN_TIMEOUT);

- sk->dead = 1;

if(sk->state == TCP_CLOSE)
+ sk->dead = 1;

Andrea[s] Arcangeli

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:44    [W:0.035 / U:0.332 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site