[Bug 185633] [pf] scrubbing bug in transparent mode bug with bigger than MTU UDP packet

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=185633

--- Comment #10 from Olivier Cochard <olivier at freebsd.org> ---
I've rebuild a kernel with all DEBUG enabled.
And generating only first one fragmented ICMP (ping -c 1 -s 1500 10.0.0.3)
generate this kassert panic:

[root at router]~# panic: vtnet_txq_encap: no mbuf packet header!
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00003ab530
vpanic() at vpanic+0x182/frame 0xfffffe00003ab5b0
kassert_panic() at kassert_panic+0x126/frame 0xfffffe00003ab620
vtnet_txq_mq_start_locked() at vtnet_txq_mq_start_locked+0x635/frame
0xfffffe00003ab6e0
vtnet_txq_mq_start() at vtnet_txq_mq_start+0x6f/frame 0xfffffe00003ab720
bridge_enqueue() at bridge_enqueue+0x9a/frame 0xfffffe00003ab760
bridge_forward() at bridge_forward+0x322/frame 0xfffffe00003ab7c0
bridge_input() at bridge_input+0x5f4/frame 0xfffffe00003ab830
ether_nh_input() at ether_nh_input+0x2ab/frame 0xfffffe00003ab870
netisr_dispatch_src() at netisr_dispatch_src+0x80/frame 0xfffffe00003ab8d0
ether_input() at ether_input+0x62/frame 0xfffffe00003ab900
vtnet_rxq_eof() at vtnet_rxq_eof+0x835/frame 0xfffffe00003ab9b0
vtnet_rx_vq_intr() at vtnet_rx_vq_intr+0x4e/frame 0xfffffe00003ab9e0
intr_event_execute_handlers() at intr_event_execute_handlers+0x96/frame
0xfffffe00003aba20
ithread_loop() at ithread_loop+0xa6/frame 0xfffffe00003aba70
fork_exit() at fork_exit+0x84/frame 0xfffffe00003abab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00003abab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 11 tid 100025 ]
Stopped at      kdb_enter+0x3b: movq    $0,kdb_why

-- 
You are receiving this mail because:
You are the assignee for the bug.