NetBSD Problem Report #60955

From www@netbsd.org  Mon Nov  2 13:42:31 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BCB9D1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  2 Nov 2026 13:42:31 +0000 (UTC)
Message-Id: <20261102134230.361861A923C@mollari.NetBSD.org>
Date: Mon,  2 Nov 2026 13:42:30 +0000 (UTC)
From: joe@eloisystems.com
Reply-To: joe@eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: packet normalization crashes on stateful rules
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@eloisystems.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60955
>Category:       kern
>Synopsis:       NPF packet normalization crashes on stateful rules
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    joe
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Nov 02 13:45:00 +0000 2026
>Last-Modified:  Mon Nov 02 13:47:23 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
tBSD  11.99.9 NetBSD 11.99.9 (GENERIC) #31: Sun Nov  1 20:57:38 UTC 2026 
>Description:
With npf normalization, setting a maxmss value on a stateful rule crashes the kernel.

stateless rules are fine.


here is a trace.

this was caught in adding more tests for rule procedures.

#4  0xffffffff8023d7fe in trap (frame=0xffffac815525f6e0)
    at /usr/current/src/sys/arch/amd64/amd64/trap.c:325
#5  0xffffffff80234ad4 in alltraps ()
#6  0xffffffff80bb66ea in npf_fetch_tcpopts (npc=npc@entry=0xffffac815525f988, 
    mss=mss@entry=0x0, wscale=wscale@entry=0xffff9022470ad090)
    at /usr/current/src/sys/net/npf/npf_inet.c:294
#7  0xffffffff80bbb30e in npf_tcp_inwindow (npc=0xffffac815525f988, 
    nst=0xffff9022470ad080, flow=NPF_FLOW_FORW)
    at /usr/current/src/sys/net/npf/npf_state_tcp.c:358
#8  npf_state_tcp (npc=npc@entry=0xffffac815525f988, 
    nst=nst@entry=0xffff9022470ad080, flow=flow@entry=NPF_FLOW_FORW)
    at /usr/current/src/sys/net/npf/npf_state_tcp.c:478
#9  0xffffffff80bbad4f in npf_state_init (npc=npc@entry=0xffffac815525f988, 
    nst=nst@entry=0xffff9022470ad080)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/current/src/sys/net/npf/npf_state.c:158
#10 0xffffffff80bb7f18 in npf_conn_establish (
    npc=npc@entry=0xffffac815525f988, di=di@entry=2, global=true)
    at /usr/current/src/sys/net/npf/npf_conn.c:461
#11 0xffffffff80baf5ea in npfk_packet_handler (npf=0xffff902242588800, 
    mp=0xffffac815525fa50, ifp=<optimized out>, di=2)
>How-To-Repeat:
procedure "norm" {
        normalize : "max-mss" 1321
}


group "ext" on wm0 {
        pass stateful out all apply "norm"
}

group default {
        pass all
}
>Fix:

Yes, fix to be submitted soon!

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->joe
Responsible-Changed-By: joe@NetBSD.org
Responsible-Changed-When: Mon, 02 Nov 2026 13:47:23 +0000
Responsible-Changed-Why:
Looking through it


>Unformatted:

Home	PR Database Search