Re: net/ipv4: division by 0 in tcp_select_window

From: Eric Dumazet
Date: Fri Mar 03 2017 - 13:47:22 EST


On Fri, Mar 3, 2017 at 10:24 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Fri, Mar 3, 2017 at 7:10 PM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> Hello,
>>

> Wonder if this has been causing other crashes like this one?
>
> ------------[ cut here ]------------
> kernel BUG at net/ipv4/tcp_output.c:2748!
> Call Trace:
> <IRQ>
> tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2822
> tcp_retransmit_timer+0x104c/0x2d50 net/ipv4/tcp_timer.c:491
> tcp_write_timer_handler+0x334/0x9d0 net/ipv4/tcp_timer.c:574
> tcp_write_timer+0x164/0x180 net/ipv4/tcp_timer.c:592
> call_timer_fn+0x241/0x820 kernel/time/timer.c:1266
> expire_timers kernel/time/timer.c:1305 [inline]
> __run_timers+0x960/0xcf0 kernel/time/timer.c:1599
> run_timer_softirq+0x21/0x80 kernel/time/timer.c:1612
> __do_softirq+0x31f/0xbe7 kernel/softirq.c:284
> invoke_softirq kernel/softirq.c:364 [inline]
> irq_exit+0x1cc/0x200 kernel/softirq.c:405
> exiting_irq arch/x86/include/asm/apic.h:658 [inline]
> smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:962
> apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:487
>
> if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
> if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
> BUG();

This path uses a socket lock. Probably different problem.