oops in tcp_ipv4.c

oops in tcp_ipv4.c

[Chitrapu_Kishore]

[-- Attachment #1: Type: text/plain, Size: 3164 bytes --]

I have a panic on machines which have very high rate of incoming TCP
connections. 
This panic occurs with 2.4.19 with SuSE patches applied to it. Specs:
Pentium III (Coppermine), 1GHz, with memory = 515356 kB

cat /proc/modules gives the following:
ppp_generic            20576   0
slhc                    6724   0 [ppp_generic]
af_packet              11432   0 (autoclean)
eepro100               22136   3 (autoclean)
ipt_state               1112  14 (autoclean)
ip_conntrack           21176   1 (autoclean) [ipt_state]
ipt_LOG                 4280   8 (autoclean)
iptable_filter          2444   1 (autoclean)
ip_tables              14720   3 [ipt_state ipt_LOG iptable_filter]
rtc                     8684   0 (autoclean)

Following is the output from ksymoops:
------------
Unable to handle kernel paging request at virtual address 0013c1da
c01f8bcd
*pde = 00000000
Oops: 0000 2.4.19-prod-sles-ded8470bc8d929ffca7ec0daf42b93d6 #1 Thu Oct 9
05:10:58 EDT 2003
CPU: 0
EIP: 0010:[<c01f8bcd>]  Tainted: P
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010246
eax: 03049a34   ebx:      0013c192     ecx: 0013c192       edx:  00000000
esi: c3007e98   edi:      00000c00     ebp: 00000096       esp:  c3007e64
ds:  0018       es: 0018      ss: 0018
Process netstat (pid: 11340, stackpage=c3007000)
Stack: 0013c192 c3007e98 c01f8fa1 0013c192 c3007e98 0000000e 00000000
00000c00
       c0128bf0 00000960 00003ca5 0000000e 0000012c 33312020 3030202a
42303430
       303a3037 20303031 36303030 34324431 3630303a 44442035 30303020
30303030
Call Trace: [<c01f8fa1>] [<c0128bf0>] [<c01303c4>] [<c01561b4>] [<c0136d46>]
[<c0108933>]
Code: 8b 59 48 29 c3 0f b7 41 08 0f 48 da 86 c4 0f b7 51 22 86 d6


>>EIP; c01f8bcd <get_timewait_sock+d/70>   <=====

>>esi; c3007e98 <[ip_conntrack].bss.end+83306d/eaf235>
>>esp; c3007e64 <[ip_conntrack].bss.end+833039/eaf235>

Trace; c01f8fa1 <tcp_get_info+371/440>
Trace; c0128bf0 <filemap_nopage+0/210>
Trace; c01303c4 <__alloc_pages+74/2e0>
Trace; c01561b4 <proc_file_read+94/1c0>
Trace; c0136d46 <sys_read+96/f0>
Trace; c0108933 <system_call+33/38>

Code;  c01f8bcd <get_timewait_sock+d/70>
00000000 <_EIP>:
Code;  c01f8bcd <get_timewait_sock+d/70>   <=====
   0:   8b 59 48                  mov    0x48(%ecx),%ebx   <=====
Code;  c01f8bd0 <get_timewait_sock+10/70>
   3:   29 c3                     sub    %eax,%ebx
Code;  c01f8bd2 <get_timewait_sock+12/70>
   5:   0f b7 41 08               movzwl 0x8(%ecx),%eax
Code;  c01f8bd6 <get_timewait_sock+16/70>
   9:   0f 48 da                  cmovs  %edx,%ebx
Code;  c01f8bd9 <get_timewait_sock+19/70>
   c:   86 c4                     xchg   %al,%ah
Code;  c01f8bdb <get_timewait_sock+1b/70>
   e:   0f b7 51 22               movzwl 0x22(%ecx),%edx
Code;  c01f8bdf <get_timewait_sock+1f/70>
  12:   86 d6                     xchg   %dl,%dh

 <0> Kernel panic: Aiee, killing interrupt handler!
----------------------

Looks tcp_ehash[i+tcp_ehash_size] which accomodates all the timewait socks
has been corrupted by the time procfs read happens.

Is this panic already reported if so is there patch available for this.

Thanks,
-KC

PS: Please copy me as I am not the list.



[-- Attachment #2: Type: text/html, Size: 8110 bytes --]

Re: oops in tcp_ipv4.c

[David S. Miller]

Try to reproduce with more recent kernels (2.4.22 would be fine)
and in particular without the vendor patches applied.