Re: 2.4.4: Kernel crash, possibly tcp related

[Andrea Arcangeli <andrea@suse.de>]

On Mon, Apr 30, 2001 at 09:00:09PM +0400, kuznet@ms2.inr.ac.ru wrote:
> Hello!
> 
> > My current theory is that tcpblast does something erratic when the
> > error occurs.
> 
> It has buffer size of 32K, so that it faults at enough large chunk sizes.
> 
> Erratic errno is because this applet prints errno on partial write.
> 
> Oops is apparently because I did something wrong in do_fault yet.
> Seems, you were right telling that this place looks dubious. 8)

this is the strict fix:

diff -urN z/net/ipv4/tcp.c z1/net/ipv4/tcp.c
--- z/net/ipv4/tcp.c	Tue May  1 12:14:14 2001
+++ z1/net/ipv4/tcp.c	Tue May  1 12:12:35 2001
@@ -1184,7 +1184,7 @@
 do_fault:
 	if (skb->len==0) {
 		if (tp->send_head == skb) {
-			tp->send_head = skb->prev;
+			tp->send_head = skb->next;
 			if (tp->send_head == (struct sk_buff*)&sk->write_queue)
 				tp->send_head = NULL;
 		}


really the logic can be implemented more efficiently this way:

--- 2.4.4aa3/net/ipv4/tcp.c.~1~	Tue May  1 10:44:57 2001
+++ 2.4.4aa3/net/ipv4/tcp.c	Tue May  1 12:00:25 2001
@@ -1183,11 +1183,8 @@
 
 do_fault:
 	if (skb->len==0) {
-		if (tp->send_head == skb) {
-			tp->send_head = skb->next;
-			if (tp->send_head == (struct sk_buff*)&sk->write_queue)
-				tp->send_head = NULL;
-		}
+		if (tp->send_head == skb)
+			tp->send_head = NULL;
 		__skb_unlink(skb, skb->list);
 		tcp_free_skb(sk, skb);
 	}

Andrea