Re: Fw: [Bug 5050] New: KERNEL: assertion (cnt <= tp->packets_out) failed at net/ipv4/tcp_input.c (1476)

[Herbert Xu]

On Fri, Aug 12, 2005 at 09:15:44AM -0700, Stephen Hemminger wrote:
> 
> Steps to reproduce: 
> System is running 2 days and after that time produce this message
> 
> KERNEL: assertion (cnt <= tp->packets_out) failed at
> net/ipv4/tcp_input.c (1476) KERNEL: assertion (cnt <= tp->packets_out)
> failed at net/ipv4/tcp_input.c (1476)

We believe that this bug may have been fixed by the following patch
which was applied after rc6.  Please apply only the debugging patch
and let us know what it prints out so that we can confirm that this
is indeed the problem.

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1370,15 +1370,21 @@ int tcp_retransmit_skb(struct sock *sk, 
 
        if (skb->len > cur_mss) {
                int old_factor = tcp_skb_pcount(skb);
-               int new_factor;
+               int diff;
 
                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                        return -ENOMEM; /* We'll try again later. */
 
                /* New SKB created, account for it. */
-               new_factor = tcp_skb_pcount(skb);
-               tp->packets_out -= old_factor - new_factor;
-               tp->packets_out += tcp_skb_pcount(skb->next);
+               diff = old_factor - tcp_skb_pcount(skb) -
+                      tcp_skb_pcount(skb->next);
+               tp->packets_out -= diff;
+
+               if (diff > 0) {
+                       tp->fackets_out -= diff;
+                       if ((int)tp->fackets_out < 0)
+                               tp->fackets_out = 0;
+               }
        }
 
        /* Collapse two adjacent packets if worthwhile and we can. */

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1474,6 +1474,10 @@ static void tcp_mark_head_lost(struct so
        int cnt = packets;
 
        BUG_TRAP(cnt <= tp->packets_out);
+       if (unlikely(cnt <= tp->packets_out)) {
+               printk("packets_out = %d, fackets_out = %d, reordering = %d, 
sack_ok = 0x%x, mss_cache=%d\n", tp->packets_out, tp->fackets_out, 
tp->reordering, tp->rx_opt.sack_ok, tp->mss_cache);
+               dump_stack();
+       }
 
        sk_stream_for_retrans_queue(skb, sk) {
                cnt -= tcp_skb_pcount(skb);