Date: Fri, 10 Feb 2023 10:05:07 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 268246] crash and panic using pfsync on 13.1-RELEASE Message-ID: <bug-268246-7501-FotWZuEFTD@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-268246-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-268246-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D268246 --- Comment #70 from Kristof Provost <kp@freebsd.org> --- (In reply to jjasen from comment #68) Okay, excellent. I think we've figured out what's going on here. I also think I see why I can't reproduce it yet. It's interpreting the IPv6 header as an IPv4 header (and we didn't notice so far, because the ip_fragment() code overwrites the version field in the header), and it's reading the flow label as length. We're defaulting to a flow label of 0, and that's putting us in a code path that avoids ip_fragment(). (The "If small enough for interface" case in ip_output()) I'm having an argument with some of the test tools to try to get a flow lab= el set so I can make it panic locally. It should be relatively straightforward to fix this, but I'm going to be on poor connectivity for a few days, so it won't be for tomorrow. The pfsync_defer_tmo fix is in stable/13 and will be part of 13.2, but it's= not in releng/13.1 (and never will be). --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-268246-7501-FotWZuEFTD>