Re: kern/60491: arp creates state for invalid messages

["Taylor R Campbell via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60491; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: Manuel Bouyer <bouyer%antioche.eu.org@localhost>, Thomas Klausner <wiz%NetBSD.org@localhost>
Cc: gnats-bugs%NetBSD.org@localhost, netbsd-bugs%NetBSD.org@localhost
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Mon, 9 Nov 2026 17:00:07 +0000

 This is a multi-part message in MIME format.
 --=_HYaBk3sxsYM9QUVHZm9yBVoM/WkTzdlx
 
 Can you please try running with the attached patch to reveal some
 additional information about the mbuf before m_makewritable next time
 it crashes?  Trying to find what initial conditions might lead
 m_makewritable to prepend an empty mbuf link in the chain.
 
 Can you also share dmesg output at boot?  Do you know which NIC driver
 the ethernet frame came in via?
 
 --=_HYaBk3sxsYM9QUVHZm9yBVoM/WkTzdlx
 Content-Type: text/plain; charset="ISO-8859-1"; name="arpmbufdebug"
 Content-Transfer-Encoding: quoted-printable
 Content-Disposition: attachment; filename="arpmbufdebug.patch"
 
 diff -r 346a58589b6e sys/netinet/if_arp.c
 --- a/sys/netinet/if_arp.c	Sun Mar 30 14:17:08 2025 +0000
 +++ b/sys/netinet/if_arp.c	Mon Nov 09 16:51:35 2026 +0000
 @@ -794,11 +794,27 @@ in_arpinput(struct mbuf *m)
  	char ipbuf[INET_ADDRSTRLEN];
  	bool find_source, do_dad;
 =20
 +	int om_lead =3D M_LEADINGSPACE(m);
 +	int om_trail =3D M_TRAILINGSPACE(m);
 +	struct mbuf *om_ptr =3D m, om_snapshot =3D *m, *om =3D &om_snapshot;
  	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
  		goto out;
 +
  	ah =3D mtod(m, struct arphdr *);
  	op =3D ntohs(ah->ar_op);
 -	KASSERT(op =3D=3D ARPOP_REPLY || op =3D=3D ARPOP_REQUEST);
 +	KASSERTMSG(op =3D=3D ARPOP_REPLY || op =3D=3D ARPOP_REQUEST,
 +	    "op=3D0x%04x"
 +	    " om=3D%p"
 +	    " om->m_flags=3D0x%x om->m_data=3D%p om->m_len=3D%d om->m_next=3D%p o=
 m->m_pkthdr.len=3D%d"
 +	    " M_LEADINGSPACE(om)=3D%d M_TRAILINGSPACE(om)=3D%d"
 +	    " m=3D%p"
 +	    " m->m_flags=3D0x%x m->m_data=3D%p m->m_len=3D%d m->m_next=3D%p m->m_=
 pkthdr.len=3D%d"
 +	    " M_LEADINGSPACE(m)=3D%d M_TRAILINGSPACE(m)=3D%d",
 +	    op,
 +	    om_ptr, om->m_flags, om->m_data, om->m_len, om->m_next, om->m_pkthdr.=
 len,
 +	    om_lead, om_trail,
 +	    m, m->m_flags, m->m_data, m->m_len, m->m_next, m->m_pkthdr.len,
 +	    (int)M_LEADINGSPACE(m), (int)M_TRAILINGSPACE(m));
 =20
  	if (ah->ar_pln !=3D sizeof(struct in_addr))
  		goto out;
 
 --=_HYaBk3sxsYM9QUVHZm9yBVoM/WkTzdlx--