Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 27 Jan 2023 11:10:55 +0000
From:      bugzilla-noreply@freebsd.org
To:        net@FreeBSD.org
Subject:   [Bug 268246] crash and panic using pfsync on 13.1-RELEASE
Message-ID:  <bug-268246-7501-6eGZjl3W3l@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-268246-7501@https.bugs.freebsd.org/bugzilla/>
References:  <bug-268246-7501@https.bugs.freebsd.org/bugzilla/>

next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D268246

--- Comment #34 from Kristof Provost <kp@freebsd.org> ---
(In reply to jjasen from comment #33)
Can you try this patch?=20

diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 61308a35a7e1..54824227da57 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -1734,6 +1738,7 @@ pfsync_defer(struct pf_kstate *st, struct mbuf *m)
        struct pfsync_softc *sc =3D V_pfsyncif;
        struct pfsync_deferral *pd;
        struct pfsync_bucket *b;
+    struct ip *ip;

        if (m->m_flags & (M_BCAST|M_MCAST))
                return (0);
@@ -1751,6 +1756,13 @@ pfsync_defer(struct pf_kstate *st, struct mbuf *m)
                return (0);
        }

+    ip =3D mtod(m, struct ip *);
+    if (ip->ip_v =3D=3D 4) {
+        int len =3D ntohs(ip->ip_len);
+        if (m_length(m, NULL) !=3D len)
+            printf("%s() defer len %d / %d\n", __func__, m_length(m, NULL),
len);
+    }
+
        PFSYNC_BUCKET_LOCK(b);
        PFSYNC_UNLOCK(sc);

That won't fix anything, but if we're looking at an incorrect IP packet that
should trigger a log at least.
I can reproduce your backtrace by setting an incorrect ip_len here.

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-268246-7501-6eGZjl3W3l>