From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
To: Neal Cardwell <ncardwell@google.com>
Cc: Netdev <netdev@vger.kernel.org>,
Yuchung Cheng <ycheng@google.com>,
Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: Crash when receiving FIN-ACK in TCP_FIN_WAIT1 state
Date: Sun, 20 Oct 2019 20:45:25 -0600 [thread overview]
Message-ID: <2279a8988c3f37771dda5593b350d014@codeaurora.org> (raw)
In-Reply-To: <CADVnQy=SDgiFH57MUv5kNHSjD2Vsk+a-UD0yXQKGNGY-XLw5cw@mail.gmail.com>
> FIN-WAIT1 just means the local application has called close() or
> shutdown() to shut down the sending direction of the socket, and the
> local TCP stack has sent a FIN, and is waiting to receive a FIN and an
> ACK from the other side (in either order, or simultaneously). The
> ASCII art state transition diagram on page 22 of RFC 793 (e.g.
> https://tools.ietf.org/html/rfc793#section-3.2 ) is one source for
> this, though the W. Richard Stevens books have a much more readable
> diagram.
>
> There may still be unacked and SACKed data in the retransmit queue at
> this point.
>
Thanks for the clarification.
> Thanks, that is a useful data point. Do you know what particular value
> tp->sacked_out has? Would you be able to capture/log the value of
> tp->packets_out, tp->lost_out, and tp->retrans_out as well?
>
tp->sacket_out varies per crash instance - 55, 180 etc.
However the other values are always the same - tp->packets_out is 0,
tp->lost_out is 1 and tp->retrans_out is 1.
> Yes, one guess would be that somehow the skbs in the retransmit queue
> have been freed, but tp->sacked_out is still non-zero and
> tp->highest_sack is still a dangling pointer into one of those freed
> skbs. The tcp_write_queue_purge() function is one function that fees
> the skbs in the retransmit queue and leaves tp->sacked_out as non-zero
> and tp->highest_sack as a dangling pointer to a freed skb, AFAICT, so
> that's why I'm wondering about that function. I can't think of a
> specific sequence of events that would involve tcp_write_queue_purge()
> and then a socket that's still in FIN-WAIT1. Maybe I'm not being
> creative enough, or maybe that guess is on the wrong track. Would you
> be able to set a new bit in the tcp_sock in tcp_write_queue_purge()
> and log it in your instrumentation point, to see if
> tcp_write_queue_purge() was called for these connections that cause
> this crash?
Sure, I can try this out.
--
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
next prev parent reply other threads:[~2019-10-21 2:45 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-20 20:25 Crash when receiving FIN-ACK in TCP_FIN_WAIT1 state Subash Abhinov Kasiviswanathan
2019-10-20 22:16 ` Neal Cardwell
2019-10-20 23:15 ` Subash Abhinov Kasiviswanathan
2019-10-21 1:20 ` Neal Cardwell
2019-10-21 2:45 ` Subash Abhinov Kasiviswanathan [this message]
2019-10-21 11:47 ` Neal Cardwell
2019-10-22 0:04 ` Subash Abhinov Kasiviswanathan
2019-10-22 1:28 ` Neal Cardwell
2019-10-29 1:36 ` Subash Abhinov Kasiviswanathan
2019-10-30 17:13 ` Neal Cardwell
2019-10-30 18:27 ` Subash Abhinov Kasiviswanathan
2019-10-30 21:48 ` Josh Hunt
2019-10-31 1:27 ` Eric Dumazet
2019-11-27 5:30 ` Eric Dumazet
2019-11-30 2:51 ` subashab
2019-11-30 5:39 ` Avinash Patil
2019-12-02 2:23 ` Eric Dumazet
[not found] ` <0101016eba38455f-e79cd85a-a807-4309-bf3b-8a788135f3f2-000000@us-west-2.amazonses.com>
2019-12-03 17:24 ` Josh Hunt
2019-10-31 0:38 ` Eric Dumazet
2019-10-31 1:17 ` Subash Abhinov Kasiviswanathan
2019-10-21 14:17 ` Eric Dumazet
2019-10-21 17:40 ` Subash Abhinov Kasiviswanathan
2019-10-21 18:10 ` Josh Hunt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2279a8988c3f37771dda5593b350d014@codeaurora.org \
--to=subashab@codeaurora.org \
--cc=eric.dumazet@gmail.com \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=ycheng@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).