Hi, (kgdb) frame 7 #7 0xc07c6cb0 in sbsndptr (sb=0xc342ede4, off=112, len=113, moff=0xc2f9ca04) at /usr/src/sys/kern/uipc_sockbuf.c:939
This is also interesting. Is this an OffByOne somewhere ? As I said it's just a workaround, and for now it didn't crash anymore :-) I could modify this patch to see what happens exactly, dumpping the mbuf. The workaround I currently use is just skipping and dropping this mbuf: --- sys/kern/uipc_sockbuf.c.orig 2009-04-05 18:01:35.000000000 +0200 +++ sys/kern/uipc_sockbuf.c 2009-04-05 18:01:46.000000000 +0200 @@ -930,6 +930,13 @@ return (sb->sb_mb); } + /* + * Try to avoid some retransmit panics + */ + if (sb->sb_sndptr == NULL && sb->sb_mb == NULL) { + return (NULL); + } + /* Return closest mbuf in chain for current offset. */ *moff = off - sb->sb_sndptroff; m = ret = sb->sb_sndptr ? sb->sb_sndptr : sb->sb_mb; --- sys/netinet/tcp_output.c.orig 2009-04-05 18:01:29.000000000 +0200 +++ sys/netinet/tcp_output.c 2009-04-05 18:04:17.000000000 +0200 @@ -797,6 +797,17 @@ */ mb = sbsndptr(&so->so_snd, off, len, &moff); + + /* + * Avoid panics. Mask the error with ENETDOWN + */ + if (mb == NULL) { + SOCKBUF_UNLOCK(&so->so_snd); + (void) m_free(m); + error = ENETDOWN; + goto out; + } + if (len <= MHLEN - hdrlen - max_linkhdr) { m_copydata(mb, moff, (int)len, mtod(m, caddr_t) + hdrlen); _______________________________________________ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"