Date: Mon, 4 Jun 2012 12:25:44 +0200 From: Daniel Hartmeier <daniel@benzedrine.cx> To: Joerg Pulz <Joerg.Pulz@frm2.tum.de> Cc: bug-followup@freebsd.org, freebsd-pf@freebsd.org Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?) Message-ID: <20120604102544.GC13069@insomnia.benzedrine.cx> In-Reply-To: <20120604100829.GB13069@insomnia.benzedrine.cx> References: <201205271830.q4RIU9fA039893@freefall.freebsd.org> <20120529064910.GA12508@insomnia.benzedrine.cx> <alpine.BSF.2.00.1206011015290.89783@unqrf.nqzva.sez2> <20120604065344.GA13069@insomnia.benzedrine.cx> <20120604100829.GB13069@insomnia.benzedrine.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
Here's a patch that directly tests this theory.
If correct, it will replace the panics with simple log messages that
show when ipfilter left an m_len==0 mbuf.
Daniel
Index: sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
===================================================================
RCS file: /home/ncvs/src/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c,v
retrieving revision 1.20.4.1
diff -u -r1.20.4.1 ip_fil_freebsd.c
--- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c 23 Sep 2011 00:51:37 -0000 1.20.4.1
+++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c 4 Jun 2012 10:19:04 -0000
@@ -182,8 +182,18 @@
static int
fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
{
+ int r;
+
struct ip *ip = mtod(*mp, struct ip *);
- return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
+ ASSERT_HOST_BYTE_ORDER(*mp);
+ r = fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
+ if (*mp != NULL && (*mp)->m_pkthdr.len >= sizeof(struct ip) &&
+ (*mp)->m_len < sizeof(struct ip)) {
+ printf("fr_check_wrapper: m_len %d fixed\n",
+ (int)(*mp)->m_len);
+ *mp = m_pullup(*mp, sizeof(struct ip));
+ }
+ return r;
}
# ifdef USE_INET6
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120604102544.GC13069>