[Bug 185633] [pf] scrubbing bug in transparent mode bug with bigger than MTU UDP packet

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=185633

--- Comment #13 from Olivier Cochard <olivier at freebsd.org> ---
funny, after lot's of printf() for debuging, it seems it's the first suspicious
function that was source of the panic that is corrupting my mbuf/packet:
in bridge_fragment(): M_PREPEND(m0, ETHER_HDR_LEN, M_NOWAIT);

Here is the new output of my debug output:

bridge0: [DEBUG] bridge_pfil() enter, dir: 1(IN:1/OUT:2), frag
:0xfffff8000386e800(m_len: 1514)
pf_normalize_ip: DEBUG branch frag: 0xfffff8000386e800(m_pkthrd.len:1500)
pf_normalize_ip: reass frag 44538 @ 0-1480
pf_fillup_fragment: reass frag 44538 @ 0-1480bridge0: 
[DEBUG] bridge_pfil() enter, dir: 1(IN:1/OUT:2), frag
:0xfffff8000386e700(m_len: 62)
pf_normalize_ip: DEBUG branch frag: 0xfffff8000386e700(m_pkthrd.len:48)
pf_normalize_ip: reass frag 44538 @ 1480-1508
pf_fillup_fragment: reass frag 44538 @ 1480-1508
pf_isfull_fragment: 1508 < 1508?
pf_reassemble: complete: 0xfffff8000386e800(m_pkthrd.len:1528, p_len: 1528)
bridge0: [DEBUG] bridge_pfil() exit, dir: 1(IN:1/OUT:2), frag:
0xfffff8000386e800(m_len: 1542)
bridge0: [DEBUG] bridge_pfil() enter, dir: 2(IN:1/OUT:2), frag
:0xfffff8000386e800(m_len: 1542)
vtnet1: [DEBUG] bridge_fragment() entering, frag:0xfffff8000386e800(m_len:
1528), ether_dhost : 58:9c:fc:02:03:03
vtnet1: [DEBUG] bridge_fragment() after ip_fragment, first mbuf in chain is
frag:0xfffff8000386e800(m_len: 1500), second is 0xfffff80003796c00(m_len: 20)
vtnet1: [DEBUG] bridge_fragment() walking chain, frag
m0:0xfffff8000386e800(m_len: 1500), frag m:0xfffff8000386e800(m_len: 1500)
vtnet1: [DEBUG] bridge_fragment() walking chain after M_PREPEND, frag
m0:0xfffff80003796d00(m_len: 14), frag m:0xfffff8000386e800(m_len: 1500)
vtnet1: [DEBUG] bridge_fragment() walking chain after bcopy, frag
m0:0xfffff80003796d00(m_len: 14), frag m:0xfffff8000386e800(m_len: 1500)
vtnet1: [DEBUG] bridge_fragment() exiting, m_len: 1500
panic: bridge_enqueue: no mbuf packet header!


=> Before calling M_PREPEND, there is a mbuf chain:
- first element is 1500 bytes long
- second element is 20 bytes long
Then we need to add ETHER_HDR_LEN to the begining of the first element:
After M_PREPEND, the 1500 bytes long should be 1514 bytes long… but we obtain a
14 bytes long mbuf!!!!

-- 
You are receiving this mail because:
You are the assignee for the bug.