RHEL6: kernel crash in tcp receive code, in tcp_ack while freeing skb
Issue
- kernel crashes in tcp layer from a call chain of
tcp_rcv_established -> tcp_ack -> __kfree_skb, with various RIP symbols - kernel crash with backtrace similar to the following, with
__kfree_skb+0x1ein the trace
Call Trace:
<IRQ>
[<ffffffff8143cfae>] __kfree_skb+0x1e/0xa0
[<ffffffff814969c4>] tcp_ack+0x3b4/0x1280
[<ffffffff8122aff3>] ? selinux_socket_sock_rcv_skb+0x83/0x220
[<ffffffff81497c6d>] tcp_rcv_established+0x3dd/0x800
[<ffffffff81013783>] ? native_sched_clock+0x13/0x80
[<ffffffff8149fc13>] tcp_v4_do_rcv+0x2e3/0x430
[<ffffffff814a149e>] tcp_v4_rcv+0x4fe/0x8d0
[<ffffffff810f3404>] ? rb_reserve_next_event+0xb4/0x370
[<ffffffff8147f28d>] ip_local_deliver_finish+0xdd/0x2d0
[<ffffffff8147f518>] ip_local_deliver+0x98/0xa0
[<ffffffff8147e9dd>] ip_rcv_finish+0x12d/0x440
[<ffffffff8147ef65>] ip_rcv+0x275/0x350
[<ffffffff8144819b>] __netif_receive_skb+0x4ab/0x750
[<ffffffff814484da>] process_backlog+0x9a/0x100
[<ffffffff8144cd43>] net_rx_action+0x103/0x2f0
[<ffffffff81076fb1>] __do_softirq+0xc1/0x1e0
[<ffffffff8100c1cc>] call_softirq+0x1c/0x30
Environment
- Red Hat Enterprise Linux 6
- Seen on these CPUs / server models / kernel versions:
server model | CPU family, model, id | RIP, kernel version
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1 | tcp_v4_init_sock+351,
| AMD Opteron(TM) 6234 | 2.6.32-279.el6.x86_64
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1 | tcp_v4_init_sock+351
| AMD Opteron(TM) 6238 | 2.6.32-279.el6.x86_64,
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1 | tcp_v4_reqsk_destructor -> kfree+123
| AMD Opteron(TM) 6238 | 2.6.32-279.el6.x86_64,
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1 | tcp_data_queue+2963
| AMD Opteron(TM) 6238 | 2.6.32-358.el6.x86_64,
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1 | skb_release_data+231
| AMD Opteron(TM) 6238 | 2.6.32-358.el6.x86_64,
---------------------|-----------------------|-----------------------------
HP ProLiant DL585 G7 | 0x15, 0x1, | tcp_v4_init_sock+351
| AMD Opteron(TM) 6234 | 2.6.32-279.el6.x86_64,
---------------------|-----------------------|-----------------------------
VMware Virtual | 0x15, 0x1, | tcp_ack+0x11d5
Platform/440BX | AMD Opteron(TM) 6234 | 2.6.32-220.el6.x86_64,
---------------------|-----------------------|-----------------------------
VMware Virtual | 0x15, 0x0, | skb_set_owner_r+0x53/0x70
Platform/440BX | AMD Opteron(TM) 6274 | 2.6.32-358.el6.x86_64
---------------------|-----------------------|-----------------------------
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.