off-by-one error in ip_fragment, recently.

[Andre Oppermann]

Andre Oppermann wrote:
> 
> David Gilbert wrote:
> >
> > I just updated a machine that uses GRE to -CURRENT.  Upon rebooting,
> > the debugger stopped at the following:
> >
> > "panic: m_copym, offset > size of mbuf chain"
> 
> There are two possible ways this can happen:  The function m_copym
> was called with off == 0, or off == m->m_len.  Neither is supposed
> to happen (obviously) so the bug must be in ip_fragment.  Lets have
> a look at that next...
> 
> > panic()
> > m_copym()
> > ip_fragment()
> > ip_output()
> > gre_output()
> > ip_output()
> > udp_output()
> > upd_send()
> > sosend()
> > kern_sendit()
> > sendit()
> > sendto()
> > syscall()
> > xint0x80_syscall()
> >
> > ... now I'm not sure that the error is perfectly technically
> > off-by-one, but its something similar.
> 
> Is this panic reproduceable?  What kind of traffic was going on
> at that time?  Or was it right away when you started using the
> GRE tunnel?

Ok, I should read the email again instead of the code.  You said
it happens on booting.  I'm not in the office and my test boxen
are there.  I don't want to panic it from home.  On Monday I'll
look at it in more detail.  Having a full backtrace will help
alot since the ip_fragment code is not that easy to step through.

> Could you please open a PR with this information too?  It helps
> keeping track of the progress.

-- 
Andre