<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I have a program for RTEMS 4.9.2. This works for most applications but we are having some issues right now. We are sending TCP packets to the system running RTEMS, if the tcp port is open and receiving and we are replying etc, everything works fine. But if we stop the tcp receiver, eventually we get a crash in RTEMS. We have had the following few stack dumps:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>CRASH 1<o:p></o:p></p><p class=MsoNormal>0x3A010000 : bsp_ram_size<o:p></o:p></p><p class=MsoNormal>0x0032DED4 : soisconnected<o:p></o:p></p><p class=MsoNormal>0x0035D0F0 : tcp_input<o:p></o:p></p><p class=MsoNormal>0x0031914C : ip_input<o:p></o:p></p><p class=MsoNormal>0x00319C80 : ipintr<o:p></o:p></p><p class=MsoNormal>0x00323124 : rtems_bsdnet_event_receive<o:p></o:p></p><p class=MsoNormal>0x00323298 : soconnsleep<o:p></o:p></p><p class=MsoNormal>0x0036E980 : _Thread_Handler<o:p></o:p></p><p class=MsoNormal>0x0036E904 : _Objects_API_maximum_class<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>CRASH 2<o:p></o:p></p><p class=MsoNormal>0x00334EC8 : _Heap_Block_allocate<o:p></o:p></p><p class=MsoNormal>0x00335B08 : _Protected_heap_Allocate<o:p></o:p></p><p class=MsoNormal>0x003115A4 : malloc<o:p></o:p></p><p class=MsoNormal>0x003233B0 : rtems_bsdnet_malloc<o:p></o:p></p><p class=MsoNormal>0x0035E6C4 : tcp_newtcpcb<o:p></o:p></p><p class=MsoNormal>0x003271B8 : rtems_set_tcp_buffer_sizes<o:p></o:p></p><p class=MsoNormal>0x0032DC38 : sonewconn1<o:p></o:p></p><p class=MsoNormal>0x0035BD90 : tcp_input<o:p></o:p></p><p class=MsoNormal>0x0031914C : ip_input<o:p></o:p></p><p class=MsoNormal>0x00319C80 : ipintr<o:p></o:p></p><p class=MsoNormal>0x00323124 : rtems_bsdnet_event_receive<o:p></o:p></p><p class=MsoNormal>0x00323298 : soconnsleep<o:p></o:p></p><p class=MsoNormal>0x0036E9A4 : _Thread_Handler<o:p></o:p></p><p class=MsoNormal>0x0036E928 : _Objects_API_maximum_class<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>CRASH 3<o:p></o:p></p><p class=MsoNormal>(We got this print out during this crash: Program heap: free of bad pointer 8 -- range 616B80 – 6800000)<o:p></o:p></p><p class=MsoNormal>0x0035F5A0 : tcp_fasttimo<o:p></o:p></p><p class=MsoNormal>0x0032870C : domaininit<o:p></o:p></p><p class=MsoNormal>0x00323198 : rtems_bsdnet_event_receive<o:p></o:p></p><p class=MsoNormal>0x00323298 : soconnsleep<o:p></o:p></p><p class=MsoNormal>0x0036EA38 : _Thread_Handler<o:p></o:p></p><p class=MsoNormal>0x0036E9BC : _Objects_API_maximum_class<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As far as I can tell we are not running out of mbuf space or memory or anything. It seems that we always crash when doing the rtems_bsdnet_event_receive or tcp_input calls. Is there a known bug in this section of the code? Are there any work arounds? What other information do we need to solve this?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben<o:p></o:p></p></div></body></html>