[oops] tcp_set_skb_tso_segs

[Pawel Sikora]

Hi,

I have two machines:

A: (at home) 2.6.10rc1+cset20041025_0606+pom_ng_snap20040609+ADSL
B: (at work) winxp+putty+DSL

Step 1: I connect from windows system to my PLD-Linux box using putty.
Step 2: I'm getting an oops after random time.

The ooops is caused by divide by zero (line 443: factor /= mss_std;)
It happens when A<->B connection is very lagged.

 430:net/ipv4/tcp_output.c ****
 431:net/ipv4/tcp_output.c **** void tcp_set_skb_tso_segs(
                                     struct sk_buff *skb,
                                     unsigned int mss_std)
 432:net/ipv4/tcp_output.c **** {
 1826                .loc 1 432 0
 1827 0c90 55         pushl %ebp #
 1828               .LCFI28:
 1829 0c91 89E5       movl %esp, %ebp #,
 1830               .LCFI29:
 1831 0c93 53         pushl %ebx #
 1832               .LCFI30:
 1833                .loc 1 432 0
 1834 0c94 8B5D08     movl 8(%ebp), %ebx # skb, skb
 1835 0c97 8B4D0C     movl 12(%ebp), %ecx # mss_std, mss_std
 433:net/ipv4/tcp_output.c ****  if (skb->len <= mss_std) {
 1836                .loc 1 433 0
 1837 0c9a 8B4360     movl 96(%ebx), %eax # <variable>.len, <variable>.len
 1838 0c9d 39C8       cmpl %ecx, %eax # mss_std, <variable>.len
 1839 0c9f 771F       ja .L229 #,
 434:net/ipv4/tcp_output.c ****   /* Avoid the costly divide in the normal
 435:net/ipv4/tcp_output.c ****    * non-TSO case.
 436:net/ipv4/tcp_output.c ****    */
 437:net/ipv4/tcp_output.c ****   skb_shinfo(skb)->tso_segs = 1;
 1840                .loc 1 437 0
 1841 0ca1 8B83B800   movl 184(%ebx), %eax # <variable>.end,
                                             <variable>.end
 1841      0000
 1842 0ca7 66C7400A   movw $1, 10(%eax) #, <variable>.tso_segs
 1842      0100
 438:net/ipv4/tcp_output.c ****   skb_shinfo(skb)->tso_size = 0;
 1843                .loc 1 438 0
 1844 0cad 8B83B800   movl 184(%ebx), %eax # <variable>.end,
                                             <variable>.end
 1844      0000
 1845 0cb3 66C74008   movw $0, 8(%eax) #, <variable>.tso_size
 1845      0000
 439:net/ipv4/tcp_output.c ****  } else {
 440:net/ipv4/tcp_output.c ****   unsigned int factor;
 441:net/ipv4/tcp_output.c ****
 442:net/ipv4/tcp_output.c ****   factor = skb->len + (mss_std - 1);
 443:net/ipv4/tcp_output.c ****   factor /= mss_std;
 444:net/ipv4/tcp_output.c ****   skb_shinfo(skb)->tso_segs = factor;
 445:net/ipv4/tcp_output.c ****   skb_shinfo(skb)->tso_size = mss_std;
 446:net/ipv4/tcp_output.c ****  }
 447:net/ipv4/tcp_output.c **** }
 1846                .loc 1 447 0
 1847 0cb9 5B         popl %ebx #
 1848 0cba 5D         popl %ebp #
 1849 0cbb C3         ret
 1850 0cbc 8D742600   .p2align 4,,7
 1851               .L229:
 1852               .LBB194:
 1853                .loc 1 442 0
 1854 0cc0 8D4408FF   leal -1(%eax,%ecx), %eax #, factor
 1855                .loc 1 443 0
 1856 0cc4 31D2       xorl %edx, %edx # tmp67
 1857 0cc6 F7F1       divl %ecx # mss_std
 1858                .loc 1 444 0
 1859 0cc8 8B93B800   movl 184(%ebx), %edx # <variable>.end,
                                             <variable>.end
 1859      0000
 1860 0cce 6689420A   movw %ax, 10(%edx) # tmp66, <variable>.tso_segs
 1861                .loc 1 445 0
 1862 0cd2 8B83B800   movl 184(%ebx), %eax # <variable>.end,
                                             <variable>.end
 1862      0000
 1863 0cd8 66894808   movw %cx, 8(%eax) # mss_std, <variable>.tso_size
 1864               .LBE194:
 1865                .loc 1 447 0
 1866 0cdc 5B         popl %ebx #
 1867 0cdd 5D         popl %ebp #
 1868 0cde C3         ret

--
/* Copyright (C) 2003, SCO, Inc. This is valuable Intellectual Property. 
*/

                           #define say(x) lie(x)