Change Details

When sending IPv6 fragmented packets and a fragment is lost before the network device is freed, the mbuf making up the fragment will remain in the temporary hashed fragment list and cause a panic when it times out due to accessing a freed network interface structure. Fix this issue by clearing the fragment lists before freeing the domain specific data in if_detach_internal(). The pr_drain() domain function now accepts a network interface pointer to limit the scope of the drain operation. Backtrace: panic() icmp6_reflect() hlim = ND_IFINFO(m->m_pkthdr.rcvif)->chlim; ^^^^ rcvif->if_afdata[AF_INET6] is NULL. icmp6_error() frag6_freef() frag6_slowtimo() pfslowtimo() softclock_call_cc() softclock() ithread_loop() Sponsored by: Mellanox Technologies MFC after: 1 week

When sending IPv6 fragmented packets and a fragment is lost before the network device is freed, the mbuf making up the fragment will remain in the temporary hashed fragment list and cause a panic when it times out due to accessing a freed network interface structure. Make sure that when network devices are departing, all IPv4 and IPv6 fragments belonging to it are freed. Backtrace: panic() icmp6_reflect() hlim = ND_IFINFO(m->m_pkthdr.rcvif)->chlim; ^^^^ rcvif->if_afdata[AF_INET6] is NULL. icmp6_error() frag6_freef() frag6_slowtimo() pfslowtimo() softclock_call_cc() softclock() ithread_loop() Sponsored by: Mellanox Technologies MFC after: 1 week

When sending IPv6 fragmented packets and a fragment is lost before the network device is freed, the mbuf making up the fragment will remain in the temporary hashed fragment list and cause a panic when it times out due to accessing a freed network interface structure. Fix this issue by clearing the fragment lists before freeing the domain specific data in if_detach_internal(). The pr_drain() domain function now accepts a network interface pointer to limit the scope of the drain operationMake sure that when network devices are departing, all IPv4 and IPv6 fragments belonging to it are freed. Backtrace: panic() icmp6_reflect() hlim = ND_IFINFO(m->m_pkthdr.rcvif)->chlim; ^^^^ rcvif->if_afdata[AF_INET6] is NULL. icmp6_error() frag6_freef() frag6_slowtimo() pfslowtimo() softclock_call_cc() softclock() ithread_loop() Sponsored by: Mellanox Technologies MFC after: 1 week