From owner-freebsd-net@FreeBSD.ORG  Fri Aug  1 20:37:55 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5169137B401
	for <freebsd-net@freebsd.org>; Fri,  1 Aug 2003 20:37:55 -0700 (PDT)
Received: from mail.sandvine.com (sandvine.com [199.243.201.138])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7162843F3F
	for <freebsd-net@freebsd.org>; Fri,  1 Aug 2003 20:37:54 -0700 (PDT)
	(envelope-from don@sandvine.com)
Received: by mail.sandvine.com with Internet Mail Service (5.5.2653.19)
	id <305LHG2H>; Fri, 1 Aug 2003 23:37:53 -0400
Message-ID: <FE045D4D9F7AED4CBFF1B3B813C85337027420F9@mail.sandvine.com>
From: Don Bowman <don@sandvine.com>
To: 'Mike Silbersack' <silby@silby.com>,
	Scot Loach <sloach@sandvine.com>
Date: Fri, 1 Aug 2003 23:37:48 -0400 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
cc: "'freebsd-net@freebsd.org'" <freebsd-net@freebsd.org>
Subject: RE: TCP socket shutdown race condition
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 02 Aug 2003 03:37:55 -0000

> From: Mike Silbersack [mailto:silby@silby.com]
> On Fri, 1 Aug 2003, Scot Loach wrote:
> 
> > Earlier this week one of our FreeBSD 4.7 boxes panic'd.  
> I've posted the
> > stack trace at the end of this message.  Using google, I've 
> found several
> > references to this panic over the past three years, but it 
> seems its never
> > been taken to root cause.
> >
> > The box crashes because the cr_uidinfo pointer in the 
> so_cred structure is
> > null.  However, on closer inspection the so_cred structure 
> is corrupted
> > (cr_ref=3279453304 for example), so I'm guessing it has 
> already been freed.
> > Looking closer at the socket, I see that the SS_NOFDREF 
> flag is set, which
> > supports my theory.  The tcpcb is in the CLOSED state, and 
> has the SENTFIN
> > flag set.
> 
> About how many concurrent connections are you pushing this machine to?
> 
> There's an unfortunate problem with uidinfo in 4.x:
> 
> struct uidinfo {
>         LIST_ENTRY(uidinfo) ui_hash;
>         rlim_t  ui_sbsize;              /* socket buffer 
> space consumed */
>         long    ui_proccnt;             /* number of processes */
>         uid_t   ui_uid;                 /* uid */
>         u_short ui_ref;                 /* reference count */
> };
> 

We are pushing in the ~50-~70K TCP connections to this process.

I think i see what you are suggesting :)

--don