linux-kernel - Re: 2.6.25-rc8: WARNING: at net/ipv4/tcp_input.c:2173 tcp_mark_head

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0804052043230.8668@wrl-59.cs.helsinki.fi>
Date:	Sat, 5 Apr 2008 20:52:32 +0300 (EEST)
From:	"Ilpo Järvinen" <ilpo.jarvinen@...sinki.fi>
To:	Soeren Sonnenburg <kernel@....de>
cc:	Linux Kernel <linux-kernel@...r.kernel.org>,
	Netdev <netdev@...r.kernel.org>
Subject: Re: 2.6.25-rc8: WARNING: at net/ipv4/tcp_input.c:2173
 tcp_mark_head_lost+0x11d/0x150()

On Sat, 5 Apr 2008, Soeren Sonnenburg wrote:

> On Fri, 2008-04-04 at 21:51 +0300, Ilpo Järvinen wrote:
> > On Thu, 3 Apr 2008, Soeren Sonnenburg wrote:
> > 
> > > On Thu, 2008-04-03 at 16:26 +0300, Ilpo Järvinen wrote:
> > > > On Thu, 3 Apr 2008, Soeren Sonnenburg wrote:
> > > > 
> > > > > trying to download things, I am seeing this (ignore the tainted, it is
> > > > > from madwifi and although the module is loaded the device was never
> > > > > used)
> > > > > 
> > > > > Could anyone make sense of this please?
> > > > 
> > > > ...I'm just trying to find out who and where invariants of the TCP code
> > > > are broken. These were relatively recently enabled (pre-2.6.24 just didn't 
> > > > care too much). A number of long standing issues plus bugs from my 
> > > > modifications have been fixed because of the more rigid checking :-).
> > > > 
> > > > > ------------[ cut here ]------------
> > > > > WARNING: at net/ipv4/tcp_input.c:2173 tcp_mark_head_lost+0x11d/0x150()
> > > > 
> > > > > ------------[ cut here ]------------
> > > > > WARNING: at net/ipv4/tcp_input.c:1771 tcp_enter_frto+0x267/0x270()
> > > > 
> > > > > ------------[ cut here ]------------
> > > > > WARNING: at net/ipv4/tcp_input.c:2532 tcp_ack+0x1a6f/0x1d60()
> > > > 
> > > > Can you reproduce it? 
> > > 
> > > Yes, by massively downloading things :-) But I have no real recipe to
> > > make it easily reproducible...
> > 
> > Good :-), no need for recipes, just that you can trigger it more often 
> > tha once per month or so :-). I probably couldn't trigger it anyway here 
> > because they're often rather sensitive to network "weather", thus if you 
> > have problems in reproducing, doing tests around the same phase of the 
> > date cycle you saw it the first time might help.
> > 
> > Here's a debug patch which expensively verifies TCP's state in a number
> > of places during ACK to find first spot where the actual bug occurs.
> 
> OK I am getting this now as the first spot:
> 
> P: 4 L: 2 vs 2 S: 0 vs 3 F: 0 vs 0 w: 4023500226-4023505874 (0)
> skb 0 f495c180
> skb 1 f480a180
> skb 2 f4994600
> head 3 f495c780
> skb 4 f5b32480
> TCP wq(s) LL  <
> WARNING: at net/ipv4/tcp_ipv4.c:240 tcp_verify_wq+0x319/0x3c0()
>
> another one:
> WARNING: at net/ipv4/tcp_output.c:1475 __tcp_push_pending_frames+0x70/0x830()
> 
> 
> P: 4 L: 2 vs 2 S: 0 vs 3 F: 0 vs 0 w: 4023500226-4023505874 (0)
> skb 0 f495c180
> skb 1 f480a180
> skb 2 f4994600
> head 3 f495c780
> skb 4 f5b32480
> TCP wq(s) LL  <
> TCP wq(h) +-++<
> l2 s3 f0 p4 seq: su4023500226 hs241530103 sn4023505874
> ------------[ cut here ]------------
> WARNING: at net/ipv4/tcp_ipv4.c:240 tcp_verify_wq+0x319/0x3c0()

Please don't cut the log! It is caught here because 2+3 > 4 :-) but I need 
the full log with stacktraces this time to figure it out.

-- 
 i.