Re: m_copym() panics possibly due to pfil hook?

[Darren Reed <darrenr%netbsd.org@localhost>]

On 5/06/2012 7:05 PM, Daniel Hartmeier wrote:
> Does someone still experience infrequent m_copym panics, like PR #41588?
> 
> This might be related to the pfil hooks and mbufs that don't start with
> a contiguous IP header.
> 
> If so, see http://marc.info/?l=freebsd-net&m=133888532814565 for an
> explanation and simple patch to try.
> 
> Kind regards,
> Daniel

As much as I dislike the patch you created, I can't see any other way
to elegantly solve the problem. The reason that I don't like the change
is that it seems silly to have to put the packet in two different mbufs
after having put it all in one. I'll file this as a workaround for the
code in m_pulldown() being buggy.

The patch below should work for NetBSD.

The greater problem that I see here is what if someone else were to use
m_pulldown in their home-brew code that uses pfil ... from that angle,
there should be a responsibility to make the interfaces more robust but
perhaps that can be achieved with documentation updates.

Darren

*** ip_fil_netbsd.c.orig     26 Jan 2012 06:03:43 -0000      2.55.2.71
--- ip_fil_netbsd.c     5 Jun 2012 12:14:47 -0000
***************
*** 222,230 ****
        rv = fr_check(ip, hlen, ifp, (dir == PFIL_OUT), mp);

        if (rv == 0 && *mp != NULL) {
!               ip = mtod(*mp, struct ip *);
!               HTONS(ip->ip_len);
!               HTONS(ip->ip_off);
        }

        return (rv);
--- 222,238 ----
        rv = fr_check(ip, hlen, ifp, (dir == PFIL_OUT), mp);

        if (rv == 0 && *mp != NULL) {
!               struct mbuf *m = *mp;
!
!               if (m->m_len < hlen) {
!                       m = m_pullup(m, hlen);
!                       *mp = m;
!                       if (m != NULL) {
!                               ip = mtod(m, struct ip *);
!                               HTONS(ip->ip_len);
!                               HTONS(ip->ip_off);
!                       }
!               }
        }

        return (rv);