revert the icmp error diff again (r1.167-1.169)

seems to be causing some kind of memory corruption after several
hours of heavy IPsec traffic.  connections start becoming very slow
eventually leading to all IPsec packets being lost.  a reboot solves
the issue for several more hours before it appears again.

1 files changed, 10 insertions, 13 deletions

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 787d6d0a716..9c81e44b583 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_input.c,v 1.170 2009/08/10 15:29:34 henning Exp $	*/
+/*	$OpenBSD: ip_input.c,v 1.171 2009/08/23 20:06:25 david Exp $	*/
 /*	$NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $	*/
 
 /*
@@ -1423,10 +1423,10 @@ ip_forward(m, srcrt)
 	struct ip *ip = mtod(m, struct ip *);
 	struct sockaddr_in *sin;
 	struct rtentry *rt;
-	int error, type = 0, code = 0, destmtu = 0, len;
+	int error, type = 0, code = 0, destmtu = 0;
 	u_int rtableid = 0;
+	struct mbuf *mcopy;
 	n_long dest;
-	struct mbuf mfake, *mcopy = NULL;
 
 	dest = 0;
 #ifdef DIAGNOSTIC
@@ -1472,14 +1472,11 @@ ip_forward(m, srcrt)
 	/*
 	 * Save at most 68 bytes of the packet in case
 	 * we need to generate an ICMP message to the src.
+	 * Pullup to avoid sharing mbuf cluster between m and mcopy.
 	 */
-	bzero(&mfake.m_hdr, sizeof(mfake.m_hdr));
-	mfake.m_type = m->m_type;
-	M_DUP_PKTHDR(&mfake, m);
-	mfake.m_data = mfake.m_pktdat;
-	len = min(min(ntohs(ip->ip_len), 68), MHLEN);
-	m_copydata(m, 0, len, mfake.m_pktdat);
-	mfake.m_pkthdr.len = mfake.m_len = len;
+	mcopy = m_copym(m, 0, min(ntohs(ip->ip_len), 68), M_DONTWAIT);
+	if (mcopy)
+		mcopy = m_pullup(mcopy, min(ntohs(ip->ip_len), 68));
 
 	ip->ip_ttl -= IPTTLDEC;
 
@@ -1528,6 +1525,8 @@ ip_forward(m, srcrt)
 		else
 			goto freecopy;
 	}
+	if (mcopy == NULL)
+		goto freert;
 
 	switch (error) {
 
@@ -1571,9 +1570,7 @@ ip_forward(m, srcrt)
 		goto freecopy;
 	}
 
-	mcopy = m_copym(&mfake, 0, len, M_DONTWAIT);
-	if (mcopy)
-		icmp_error(mcopy, type, code, dest, destmtu);
+	icmp_error(mcopy, type, code, dest, destmtu);
 	goto freert;
 
  freecopy: