[Bug 213232] [tcp] [panic] tcp_output() Panic String: tcp_output: len > IP_MAXPACKET on -head and stable/11

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213232

Hiren Panchasara <hiren at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |glebius at FreeBSD.org

--- Comment #6 from Hiren Panchasara <hiren at FreeBSD.org> ---
Now with r306769, len is int32_t so it can actually have -ve value, I am seeing
panic at


        /*
         * This KASSERT is here to catch edge cases at a well defined place.
         * Before, those had triggered (random) panic conditions further down.
         */
        KASSERT(len >= 0, ("[%s:%d]: len < 0", __func__, __LINE__));

Now, putting a bit of debugs above that I figured that at following path in
'else' case the len becomes -ve

                if (tso) {

                   <blah>

                } else {
                        len = tp->t_maxseg - optlen - ipoptlen;
                        sendalot = 1;
                }

I found that tp-t_maxseg = 2, optlen = 12, ipoptlen = 0 resulting in len = -10.

Clearly, t_maxseg which is supposed to be representing MSS at '2' looks wrong.

I wonder if the changes in
https://svnweb.freebsd.org/base?view=revision&revision=293284 somewhere caused
this.

Still investigating.

-- 
You are receiving this mail because:
You are the assignee for the bug.