Re: crash in in6_cksum

[Tatoku Ogaito <tacha%tack.fukui-med.ac.jp@localhost>]

>> In Message <080226083754.M0226599%mirage.ceres.dti.ne.jp@localhost>
 at Tue, 26 Feb 2008 08:37:54 +0900
 Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost> wrote:

 > plunky%rya-online.net@localhost wrote:
 > 
 > > Another suggestion might be which hardware are you using?  If it was the
 > > interface driver that was creating the packet bad in the first place, that
 > > might explain why some people see this and some do not..
 > 
 > I also see the same panic with re(4) on i386 and I'm using
 > in6_cksum.c rev 1.22. (though I don't use ipv6)

In my case, I use ath(4) at cardbus and wm(4) at pci on i386.

A bunch of KASSERTs reveal the assertion fails at the second
KASSERT in the following piece of code, which begins with the 
line 346 in revision 1.113.
# In my kernel, I set PFIL_HOOKS and FAST_IPSEC.
-------------------------------------------------------------------------
#ifdef PFIL_HOOKS
        /*
         * Run through list of hooks for input packets.  If there are any
         * filters which require that additional packets in the flow are
         * not fast-forwarded, they must clear the M_CANFASTFWD flag.
         * Note that filters must _never_ set this flag, as another filter
         * in the list may have previously cleared it.
         */
        /*
         * let ipfilter look at packet on the wire,
         * not the decapsulated packet.
         */
KASSERT(m->m_len >= sizeof(struct ip6_hdr));
#ifdef IPSEC
        if (!ipsec_getnhist(m))
#elif defined(FAST_IPSEC)
        if (!ipsec_indone(m))
#else
        if (1)
#endif
        {
                struct in6_addr odst;

                odst = ip6->ip6_dst;
                if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif,
                                   PFIL_IN) != 0)
                        return;
                if (m == NULL)
                        return;
                ip6 = mtod(m, struct ip6_hdr *);
                srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
        }
KASSERT(m->m_len >= sizeof(struct ip6_hdr));
#endif /* PFIL_HOOKS */
-------------------------------------------------------------------------

HTH.

Tacha