Date: Fri, 1 Aug 2003 23:37:48 -0400 From: Don Bowman <don@sandvine.com> To: 'Mike Silbersack' <silby@silby.com>, Scot Loach <sloach@sandvine.com> Cc: "'freebsd-net@freebsd.org'" <freebsd-net@freebsd.org> Subject: RE: TCP socket shutdown race condition Message-ID: <FE045D4D9F7AED4CBFF1B3B813C85337027420F9@mail.sandvine.com>
next in thread | raw e-mail | index | archive | help
> From: Mike Silbersack [mailto:silby@silby.com] > On Fri, 1 Aug 2003, Scot Loach wrote: > > > Earlier this week one of our FreeBSD 4.7 boxes panic'd. > I've posted the > > stack trace at the end of this message. Using google, I've > found several > > references to this panic over the past three years, but it > seems its never > > been taken to root cause. > > > > The box crashes because the cr_uidinfo pointer in the > so_cred structure is > > null. However, on closer inspection the so_cred structure > is corrupted > > (cr_ref=3279453304 for example), so I'm guessing it has > already been freed. > > Looking closer at the socket, I see that the SS_NOFDREF > flag is set, which > > supports my theory. The tcpcb is in the CLOSED state, and > has the SENTFIN > > flag set. > > About how many concurrent connections are you pushing this machine to? > > There's an unfortunate problem with uidinfo in 4.x: > > struct uidinfo { > LIST_ENTRY(uidinfo) ui_hash; > rlim_t ui_sbsize; /* socket buffer > space consumed */ > long ui_proccnt; /* number of processes */ > uid_t ui_uid; /* uid */ > u_short ui_ref; /* reference count */ > }; > We are pushing in the ~50-~70K TCP connections to this process. I think i see what you are suggesting :) --don
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE045D4D9F7AED4CBFF1B3B813C85337027420F9>