From knotwell@ix.netcom.com  Fri Aug  9 22:10:40 2002
Return-Path: <knotwell@ix.netcom.com>
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5ABD637B400
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  9 Aug 2002 22:10:40 -0700 (PDT)
Received: from smtp6.mindspring.com (smtp6.mindspring.com [207.69.200.110])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0B49C43E77
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  9 Aug 2002 22:10:40 -0700 (PDT)
	(envelope-from knotwell@ix.netcom.com)
Received: from user-2ini87i.dialup.mindspring.com ([165.121.32.242] helo=ix.netcom.com)
	by smtp6.mindspring.com with esmtp (Exim 3.33 #1)
	id 17dOWL-0003E7-00
	for FreeBSD-gnats-submit@freebsd.org; Sat, 10 Aug 2002 01:10:38 -0400
Received: (from knotwell@localhost)
	by ix.netcom.com (8.12.3/8.9.3) id g7A5LXdk000337;
	Fri, 9 Aug 2002 22:21:33 -0700 (PDT)
	(envelope-from knotwell)
Message-Id: <200208100521.g7A5LXdk000337@ix.netcom.com>
Date: Fri, 9 Aug 2002 22:21:33 -0700 (PDT)
From: knotwell@ix.netcom.com
Reply-To: knotwell@ix.netcom.com
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject:
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         41512
>Category:       kern
>Synopsis:       crash dump during TCP operations
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 09 22:20:01 PDT 2002
>Closed-Date:    Mon Aug 19 16:17:41 PDT 2002
>Last-Modified:  Mon Aug 19 16:17:41 PDT 2002
>Originator:     knotwell@ix.netcom.com
>Release:        FreeBSD 4.6-STABLE i386
>Organization:
>Environment:

 System: FreeBSD bradbsd 4.6-STABLE FreeBSD 4.6-STABLE #18: Fri Aug 9 22:03:33 PDT 2002 root@bradbsd:/usr/src/sys/compile/BRAD i386
>Description:

 Crash dump during normal tcp operations in a scaled-down kernel

>How-To-Repeat:

 Pretty much anytime I'd try to initiate a few TCP connections over a
 user-land PPP link, I'd consistently get a crash in the tcp_respond
 code.  Specifically, it was calling m_freem with a NULL pointer.

>Fix:

 Doing this made my system stable, I dunno if it's the right fix or not
 (STABLE as of today's date):

 bradbsd# diff -u tcp_subr.c.orig tcp_subr.c
 --- tcp_subr.c.orig     Fri Aug  9 22:11:56 2002
 +++ tcp_subr.c  Fri Aug  9 22:03:13 2002
 @@ -393,7 +393,8 @@
                 bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
                 flags = TH_ACK;
         } else {
 -               m_freem(m->m_next);
 +               if(m->m_next != 0)
 +                    m_freem(m->m_next);
                 m->m_next = 0;
                 m->m_data = (caddr_t)ipgen;
                 /* m_len is set later */

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: keramida 
State-Changed-When: Mon Aug 19 16:13:03 PDT 2002 
State-Changed-Why:  
This has already been fixed AFAIK. 


Responsible-Changed-From-To: gnats-admin->freebsd-bugs 
Responsible-Changed-By: keramida 
Responsible-Changed-When: Mon Aug 19 16:13:03 PDT 2002 
Responsible-Changed-Why:  
Misfiled PR. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=41512 
>Unformatted:
