9.0-RC1 panic in tcp_input: negative winow.

[John Baldwin]

On Saturday, December 17, 2011 6:21:27 pm Pawel Jakub Dawidek wrote:
> On Mon, Dec 12, 2011 at 11:00:23AM -0500, John Baldwin wrote:
> > An update.  I've sent Pawel a testing patch to see if my hypothesis is correct
> > (www.freebsd.org/~jhb/patches/tcp_negwin_test.patch).  If it is then I intend
> > to commit www.freebsd.org/~jhb/patches/tcp_negwin2.patch as the fix.
> 
> Unfortunately it paniced today. Take a look at:
> 
> 	http://people.freebsd.org/~pjd/misc/tcp_panic.jpg

Ok, the one use case I was worried about is happening regularly before your
panic, so that is good.  Can you use gdb to figure out which call to
tcp_output() is actually panic'ing?  I wonder if it is this case:

	/*
	 * Return any desired output.
	 */
	if (needoutput || (tp->t_flags & TF_ACKNOW)) {
		(void) tcp_output(tp);
		/* XXX: Debug */
		KASSERT(SEQ_GEQ(tp->rcv_adv, tp->rcv_nxt),
		    ("tcp_input: negative window after ACK"));

And if 'needoutput' is true, but TF_ACKNOW is not set, and tcp_output() decides
to not do anything.  I've updated tcp_negwin_test.patch to not panic if that call
to tcp_output() doesn't actually send a packet.  Please re-test.

-- 
John Baldwin