>Number:         26773
>Category:       kern
>Synopsis:       ipf assumes mbufs are always writable
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 27 02:18:01 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release:        NetBSD 2.0G
>Organization:

>Environment:
	
	
System: NetBSD kaeru 2.0G NetBSD 2.0G (build.kaeru) #1626: Thu Aug 26 21:45:21 JST 2004 takashi@kaeru:/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
	ipf have an assumption that mbufs are always writable.
	it sometimes does m_copyback on a shared mbuf and
	triggers an assertion failure ("mlen == 0 || !M_READONLY(m)")
	in m_copyback.

	while 2-0 branch doesn't have the KASSERT, i think that
	the problem itsself exists on the branch as well.

	PR/26433 is about the same problem of pf.
	PR/25761 also has some related info, including a stack trace.

>How-To-Repeat:
	see PR/25761.

>Fix:
	always ensuring that mbufs are writable beforehand
	(in fr_check_wrapper?) might be a short-term fix.

	for long-term, it's better to do some kind of copy-on-write.
>Release-Note:
>Audit-Trail:
>Unformatted: