From owner-freebsd-net@FreeBSD.ORG  Sat Jan 10 09:47:06 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 943FE16A4D2; Sat, 10 Jan 2004 09:47:06 -0800 (PST)
Received: from sizone.org (mortar.sizone.org [65.126.154.242])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 8D0A743D48; Sat, 10 Jan 2004 09:47:05 -0800 (PST)
	(envelope-from dgilbert@daveg.ca)
Received: by sizone.org (Postfix, from userid 66)
	id CAE63307BD; Sat, 10 Jan 2004 12:47:04 -0500 (EST)
Received: by canoe.dclg.ca (Postfix, from userid 101)
	id 6A7941D1F65; Sat, 10 Jan 2004 12:35:46 -0500 (EST)
From: David Gilbert <dgilbert@dclg.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <16384.14322.83258.940369@canoe.dclg.ca>
Date: Sat, 10 Jan 2004 12:35:46 -0500
To: freebsd-net@freebsd.org, freebsd-current@freebsd.org
X-Mailer: VM 7.17 under 21.4 (patch 14) "Reasonable Discussion" XEmacs Lucid
Subject: off-by-one error in ip_fragment, recently.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 10 Jan 2004 17:47:06 -0000

I just updated a machine that uses GRE to -CURRENT.  Upon rebooting,
the debugger stopped at the following:

"panic: m_copym, offset > size of mbuf chain"

panic()
m_copym()
ip_fragment()
ip_output()
gre_output()
ip_output()
udp_output()
upd_send()
sosend()
kern_sendit()
sendit()
sendto()
syscall()
xint0x80_syscall()

... now I'm not sure that the error is perfectly technically
off-by-one, but its something similar.

Dave.

-- 
============================================================================
|David Gilbert, Independent Contractor.       | Two things can only be     |
|Mail:       dave@daveg.ca                    |  equal if and only if they |
|http://daveg.ca                              |   are precisely opposite.  |
=========================================================GLO================