This is a multi-part message in MIME format.
--------------090601010602050409060207
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Argh, fat fingers deleted one "{" too many.

Please try the attached and ignore the previous.

Thanks,
Darren

Darren Reed wrote:
> 6bone@6bone.informatik.uni-leipzig.de wrote:
>> Hello Darren,
>>
>> I have applied your patch and rebuilt the kernel. After booting with 
>> the new one I got a kernel trace. You can download it from 
>> http://6bone.informatik.uni-leipzig.de/netbsd/trace.jpg
>
> Can you please reverse out the previous patch and try this one?
>
> I've tested it as far as ifconfig (that produced those panics) and 
> believe
> the logic is much better now.
>
> Thanks,
> Darren
>


--------------090601010602050409060207
Content-Type: text/plain;
 name="ipf.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="ipf.patch"

Index: ip_fil_netbsd.c
===================================================================
RCS file: /devel/CVS/IP-Filter/ip_fil_netbsd.c,v
retrieving revision 2.55.2.56
diff -c -r2.55.2.56 ip_fil_netbsd.c
*** ip_fil_netbsd.c	27 Oct 2007 23:17:26 -0000	2.55.2.56
--- ip_fil_netbsd.c	5 Nov 2007 09:55:11 -0000
***************
*** 1871,1877 ****
  int len;
  {
  	int out = fin->fin_out, dpoff, ipoff;
! 	mb_t *m = xmin;
  	char *ip;
  
  	if (m == NULL)
--- 1875,1881 ----
  int len;
  {
  	int out = fin->fin_out, dpoff, ipoff;
! 	mb_t *m = xmin, *n;
  	char *ip;
  
  	if (m == NULL)
***************
*** 1888,1899 ****
  		dpoff = 0;
  
  	if (M_LEN(m) < len) {
! #ifdef MHLEN
  		/*
  		 * Assume that M_PKTHDR is set and just work with what is left
  		 * rather than check..
  		 * Should not make any real difference, anyway.
  		 */
  		if (len > MHLEN)
  #else
  		if (len > MLEN)
--- 1892,1918 ----
  		dpoff = 0;
  
  	if (M_LEN(m) < len) {
! 		mb_t *ms = m;
! 
! 		n = *fin->fin_mp;
  		/*
  		 * Assume that M_PKTHDR is set and just work with what is left
  		 * rather than check..
  		 * Should not make any real difference, anyway.
  		 */
+ 		if (m != n) {
+ 			/*
+ 			 * Record the mbuf that points to the mbuf that we're
+ 			 * about to go to work on so that we can update the
+ 			 * m_next appropriately later.
+ 			 */
+ 			for (; n->m_next != m; n = n->m_next)
+ 				;
+ 		} else {
+ 			n = NULL;
+ 		}
+ 
+ #ifdef MHLEN
  		if (len > MHLEN)
  #else
  		if (len > MLEN)
***************
*** 1905,1922 ****
  #else
  			FREE_MB_T(*fin->fin_mp);
  			m = NULL;
  #endif
  		} else
  		{
  			m = m_pullup(m, len);
  		}
! 		*fin->fin_mp = m;
  		if (m == NULL) {
  			fin->fin_m = NULL;
  			ATOMIC_INCL(frstats[out].fr_pull[1]);
  			return NULL;
  		}
  
  		while (M_LEN(m) == 0) {
  			m = m->m_next;
  		}
--- 1924,1956 ----
  #else
  			FREE_MB_T(*fin->fin_mp);
  			m = NULL;
+ 			n = NULL;
  #endif
  		} else
  		{
  			m = m_pullup(m, len);
  		}
! 		if ((ms != n) && (n != NULL))
! 			n->m_next = m;
  		if (m == NULL) {
+ 			/*
+ 			 * When n is non-NULL, it indicates that m pointed to
+ 			 * a sub-chain (tail) of the mbuf and that the head
+ 			 * of this chain has not yet been free'd.
+ 			 */
+ 			if ((ms != n) && (n != NULL)) {
+ 				FREE_MB_T(*fin->fin_mp);
+ 			}
+ 
+ 			*fin->fin_mp = NULL;
  			fin->fin_m = NULL;
  			ATOMIC_INCL(frstats[out].fr_pull[1]);
  			return NULL;
  		}
  
+ 		if (ms == n || n == NULL)
+ 			*fin->fin_mp = m;
+ 
  		while (M_LEN(m) == 0) {
  			m = m->m_next;
  		}

--------------090601010602050409060207--