From owner-freebsd-pf@FreeBSD.ORG  Mon Jun  4 10:25:46 2012
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 64909106564A;
	Mon,  4 Jun 2012 10:25:46 +0000 (UTC)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (106-30.3-213.fix.bluewin.ch
	[213.3.30.106])
	by mx1.freebsd.org (Postfix) with ESMTP id DCDC68FC20;
	Mon,  4 Jun 2012 10:25:45 +0000 (UTC)
Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1])
	by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id q54APi7a005603
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Mon, 4 Jun 2012 12:25:44 +0200 (MEST)
Received: (from dhartmei@localhost)
	by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id q54APiAp030401;
	Mon, 4 Jun 2012 12:25:44 +0200 (MEST)
Date: Mon, 4 Jun 2012 12:25:44 +0200
From: Daniel Hartmeier <daniel@benzedrine.cx>
To: Joerg Pulz <Joerg.Pulz@frm2.tum.de>
Message-ID: <20120604102544.GC13069@insomnia.benzedrine.cx>
References: <201205271830.q4RIU9fA039893@freefall.freebsd.org>
	<20120529064910.GA12508@insomnia.benzedrine.cx>
	<alpine.BSF.2.00.1206011015290.89783@unqrf.nqzva.sez2>
	<20120604065344.GA13069@insomnia.benzedrine.cx>
	<20120604100829.GB13069@insomnia.benzedrine.cx>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20120604100829.GB13069@insomnia.benzedrine.cx>
User-Agent: Mutt/1.5.12-2006-07-14
Cc: bug-followup@freebsd.org, freebsd-pf@freebsd.org
Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad
	fragment handling?)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Jun 2012 10:25:46 -0000

Here's a patch that directly tests this theory.

If correct, it will replace the panics with simple log messages that
show when ipfilter left an m_len==0 mbuf.

Daniel

Index: sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
===================================================================
RCS file: /home/ncvs/src/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c,v
retrieving revision 1.20.4.1
diff -u -r1.20.4.1 ip_fil_freebsd.c
--- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       23 Sep 2011 00:51:37 -0000      1.20.4.1
+++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       4 Jun 2012 10:19:04 -0000
@@ -182,8 +182,18 @@
 static int
 fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
 {
+       int r;
+
        struct ip *ip = mtod(*mp, struct ip *);
-       return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
+       ASSERT_HOST_BYTE_ORDER(*mp);
+       r = fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
+       if (*mp != NULL && (*mp)->m_pkthdr.len >= sizeof(struct ip) &&
+           (*mp)->m_len < sizeof(struct ip)) {
+               printf("fr_check_wrapper: m_len %d fixed\n",
+                   (int)(*mp)->m_len);
+               *mp = m_pullup(*mp, sizeof(struct ip));
+       }
+       return r;
 }

 # ifdef USE_INET6