c00652628
 
HP Tru64 UNIX - TCP SACK Panics

Tru64 UNIX

Evolving business value

Related links

Systems running with TCP Selective Acknowledgement (SACK) enabled are susceptible to two different panics. The description of the panics follows:

PANIC: "m_copym sanity"

0 boot src/kernel/arch/alpha/machdep.c
1 panic src/kernel/bsd/subr_prf.c
2 event_timeout src/kernel/arch/alpha/cpu.c
3 pmap_update_send src/kernel/arch/alpha/pmap_update.c
4 pmap_tbsync src/kernel/arch/alpha/pmap.c
5 pmap_copy_on_write src/kernel/arch/alpha/pmap.c
6 pmap_page_protect src/kernel/arch/alpha/pmap.c
7 ubc_flush_dirty_age src/kernel/vfs/vfs_ubc.c
8 ubc_flush_dirty src/kernel/vfs/vfs_ubc.c
9 mntflushbuf src/kernel/vfs/vfs_bio.c
10 boot src/kernel/arch/alpha/machdep.c
11 panic src/kernel/bsd/subr_prf.c
12 m_copym src/kernel/bsd/uipc_mbuf.c
13 tcp_output src/kernel/netinet/tcp_output.c
14 tcp_input src/kernel/netinet/tcp_input.c
15 ipintr src/kernel/netinet/ip_input.c
16 netisr_thread src/kernel/net/netisr.c

This panic occurs because the tcp_sack_field in the tcpcb is not updated properly. Two reasons for an improper tcp_sack_field update are:

• sack_index is not reset whenever the number of entries in the sack is zero
• tcp_sack_clean_list is not called when a packet does not contain the sack entries in the tcp header option. When this occurs, header prediction succeeds and goes for the tcp_output without updating the sack entries

PANIC: "Unaligned kernel space access from kernel mode"

0 stop_secondary_cpu src/kernel/arch/alpha/cpu.c
1 panic src/kernel/bsd/subr_prf.c
2 event_timeout src/kernel/arch/alpha/cpu.c
3 xcpu_puts src/kernel/bsd/subr_prf.c
4 printf src/kernel/bsd/subr_prf.c
5 panic src/kernel/bsd/subr_prf.c
6 afault_trap src/kernel/arch/alpha/trap.c
7 _XentUna src/kernel/arch/alpha/locore.s
8 tcp_dooptions src/kernel/netinet/tcp_input.c
9 tcp_input src/kernel/netinet/tcp_input.c
10 ipintr src/kernel/netinet/ip_input.c
11 netisr_thread src/kernel/net/netisr.c

This panic occurs because the sack option does not need to be aligned with a 4 byte boundary. When the receiver assumes alignment on a 4 byte boundary and tries to read it as a 4 byte word, the system panics.

The following versions are affected:

• HP Tru64 UNIX V5.1B-3
• HP Tru64 UNIX V5.1B-2/PK4
• HP Tru64 UNIX V5.1A PK6
• HP Tru64 UNIX V4.0G PK4
• HP Tru64 UNIX V4.0F PK8

HP is releasing the following ERP kits publicly for use by any customer. The kits use dupatch to install and will not install over any Customer Specific Patches (CSPs) that have file intersections with the ERP.

The fixes contained in the ERP kits are scheduled to be available in the following mainstream patch kit:

HP Tru64 UNIX Version 5.1B-4

The kit distributed the following files:

• /sys/BINARY/inet.mod
• /sys/BINARY/net.mod
• /sys/BINARY/ipv6.mod (V5.* only)
• /usr/sys/include/netinet/proto_inet.h
• /usr/sys/include/netinet/tcp_var.h

Early Release Patches

HP Tru64 UNIX version: V5.1B-3:
ERP Kit Name: T64KIT1000426-V51BB26-E-20060301
Kit Location:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1000426-V51BB26-E-20060301

HP Tru64 UNIX version: V5.1B-2/PK4
ERP Kit Name: T64KIT1000425-V51BB25-E-20060301
Kit Location:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1000425-V51BB25-E-20060301

HP Tru64 UNIX version: V5.1A PK6
ERP Kit Name: T64KIT1000536-V51AB24-E-20060418
Kit Location:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1000536-V51AB24-E-20060418

HP Tru64 UNIX version: V4.0G PK4
ERP Kit Name: T64KIT1000535-V40GB22-E-20060418
Kit Location:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=T64KIT1000535-V40GB22-E-20060418

HP Tru64 UNIX version: V4.0F PK8
ERP Kit Name: DUXKIT1000430-V40FB22-E-20060302
Kit Location:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=DUXKIT1000430-V40FB22-E-20060302