Re: panics in tcp_ack

[Eric Dumazet <eric.dumazet@gmail.com>]

On Sun, 2013-06-02 at 22:18 -0500, Rob Herring wrote:

> Ah, missed that there are 2 versions of skb_transport_header. So on
> 32-bit it is skb->transport_header.
> 
> Here's the ARM disassembly:
> 
> c040796c <tcp_rcv_established>:
> c040796c:       e92d45f0        push    {r4, r5, r6, r7, r8, sl, lr}
> c0407970:       e1a06002        mov     r6, r2
> c0407974:       e5d023e4        ldrb    r2, [r0, #996]  ; 0x3e4
> c0407978:       e1a05001        mov     r5, r1
> c040797c:       e5901344        ldr     r1, [r0, #836]  ; 0x344
> c0407980:       e24dd014        sub     sp, sp, #20
> c0407984:       e7c0201f        bfc     r2, #0, #1
> c0407988:       e5c023e4        strb    r2, [r0, #996]  ; 0x3e4
> panic>c040798c:       e596200c        ldr     r2, [r6, #12]
> 
> r6 is NULL. r6 came from r2 which is the 3rd function argument.
> 
> The 3rd arg is tcp_hdr(skb) which is skb->transport_header.
> 
> Rob

Interesting. transport header should be set in IP stack before TCP.

What is the driver delivering this packet ?

Do you have commit fda55eca5a33f33ffcd4192c6b2d75179714a52c
("net: introduce skb_transport_header_was_set()")