misc/78893: Fast forward will carsh the system in 5.x.

[LiangYi]

>Number:         78893
>Category:       misc
>Synopsis:       Fast forward will carsh the system in 5.x.
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 15 18:30:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     LiangYi
>Release:        5.3
>Organization:
lingzhou network Inc
>Environment:
FreeBSD 5.3-RELEASE
>Description:
      It seems there is a bug in ip_fastfwd.c which will crash the system when it runs in fast forward mode occasionally. The crash enviroment will like this: 
      net.inet.ip.fastforwarding = 1
      Do a over MTU ping on a busy interface 
>How-To-Repeat:
      same as above.
>Fix:
      Look at ip_fastfwd.c, function ip_fastforward, line 499. if_output will free the mbuf when it is failed. So if an error is occured 'm' will be freed, and the loop will break. Current code will free m twice which will crash the system later.
      Fix:
      update line 586 from: 
         "for (; m; m = m0) {"
      to
         "for (; m = m0; ) {"


>Release-Note:
>Audit-Trail:
>Unformatted: