panic in tcp_do_segment()

[Rick Macklem]

Hi,

When pho@ was doing some NFS testing, he got the
following crash, which I can't figure out. (As far
as I can see, INP_WLOCK() is always held when
tp->t_state = TCPS_CLOSED and it is held from before
the test for TCPS_CLOSED in tcp_input() up until
the tcp_do_segment() call. As such, I don't see how
tp->t_state can be TCPS_CLOSED, but that seems to
be what causes the panic?)

The "umount -f" will result in:
  soshutdown(so, SHUT_WR);
  soclose(so);
being done by the krpc on the socket.

Anyone have any ideas on this?
pho@ wrote:
> I continued running the NFS tests and got this "panic: tcp_do_segment:
> TCPS_LISTEN". It's the second time I get this panic with the same test
> scenario, so it seems to be reproducible. The scenario is "umount -f"
> of a mount point that is very active.
>
> http://people.freebsd.org/~pho/stress/log/kostik555.txt

Thanks in advance for any help, rick