Re: panic: tcp_output REXMT

[christos%astron.com@localhost (Christos Zoulas)]

In article <20080830095555.GB2277%antioche.eu.org@localhost>,
Manuel Bouyer  <bouyer%antioche.eu.org@localhost> wrote:
>Hi,
>on a netbsd-3 amd64 server I've got this panic (several times now):
>panic: tcp_output REXMT
>panic() at netbsd:panic+0x1c8
>tcp_segsize() at netbsd:tcp_segsize
>tcp_timer_persist() at netbsd:tcp_timer_persist+0x73
>softclock() at netbsd:softclock+0x2c9
>softintr_dispatch() at netbsd:softintr_dispatch+0x99
>DDB lost frame for netbsd:Xsoftclock+0x2d, trying 0xffffffff8069bcd0
>Xsoftclock() at netbsd:Xsoftclock+0x2d
>
>Does it ring a bell to someone ?
>
>I can't make much sense of the stack trace. The panic is in tcp_setpersist()
>and tcp_timer_persist() is calling tcp_setpersist(); so I guess the
>tcp_segsize() here is wrong (I can't see from where it would be called in
>tcp_timer_persist()).
>Another path would be tcp_timer_persist()->tcp_output()->tcp_segsize()
>but then I don't know where tcp_setpersist() is called from.
>If called from tcp_output(), in both case we either call
>TCP_TIMER_DISARM(tp, TCPT_REXMT) before or check
>TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0. 
>Another theory is that there's a code path arming TCPT_REXMT from
>above splsoftnet().
>
>I didn't see any evidence that this could be fixed in -current.
>
>Any idea ?

I thought that there was a race in the timer reset code that I fixed
a while ago. I never got that particular panic though.

christos