Arnaldo, I think this is another piece of fallout
from the struct sock splitup you did ages ago.
I think it's dereferencing inet_sk(sk) for a time-wait
socket, so we probably need a TCP_TIME_WAIT test plus
some additional logic here? Better check tcp_ipv6.c too.
Begin forwarded message:
Date: Wed, 8 Oct 2003 16:04:09 -0400
From: Dan Merillat <dmerillat@xxxxxxxxxxx>
To: linux-kernel@xxxxxxxxxxxxxxx
Subject: Nasty Oops in 2.6.0-test6 bind/SO_REUSEADDR
I can't provide a stacktrace because it hardlocks the system, but it's
trivial to reproduce.
Swap back and forth between apache2 and apache a few times, and it
hardlocks at bind.
From what I copied down and backtraced we crash at tcp_v4_get_port +
0x378/390, which is in tcp_ipv4.c:194 (inline tcp_bind_conflict)
struct inet_opt *inet2 = inet_sk(sk2);
if (!inet2->rcv_saddr || !inet->rcv_saddr ||
inet2->rcv_saddr == inet->rcv_saddr)
break;
468: 0f b6 40 49 movzbl 0x49(%eax),%eax
46c: 83 e0 20 and $0x20,%eax
46f: 84 c0 test %al,%al
In fact, I believe the problem to be with SO_REUSEADDR. It only
manifests if the port has gotten traffic and there's sockets in
TIME_WAIT.
I suppose a trivial test would be to bind to a port, connect to it,
disconnect, close the socket, create a socket with SO_REUSEADDR and
rebind to it. Pow.
I can't get UML 2.6.0 working so I can't test very well, but it's a
helluva showstopper.
The strace of apache starting up when it crashed:
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
fcntl64(3, F_DUPFD, 15) = 20
close(3) = 0
setsockopt(20, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(20, SOL_SOCKET, SO_KEEPALIVE, [1], 4
(oopsed in bind so strace never saw it)
--Dan
00000002.mimetmp
Description: PGP signature
|