Pawel Worach wrote:

(kgdb) print *tw
$1 = {tw_inpcb = 0x0, snd_nxt = 438603527, rcv_nxt = 3383864561,
  iss = 438603320, irs = 3383863898, cc_recv = 0, cc_send = 0,
  last_win = 65534, tw_so_options = 4, tw_cred = 0x0, t_recent = 0,
  t_starttime = 4294952294, tw_time = 0, tw_2msl = {le_next = 0xc24680a8,
    le_prev = 0xc06a827c}}

I poked a bit more and it looks like the dereference happens here in tcp_timer_2msl_tw().

tcp_timer.c:294         INP_LOCK(tw->tw_inpcb);

INP_LOCK macro tries to reference tw->tw_inpcb->inp_mtx while tw->tw_inpcb is null. However I have no idea how it got to this point.

--
Pawel
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to