Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/frag6.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/frag6.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.10
retrieving revision 1.10.4.2
diff -u -p -r1.10 -r1.10.4.2
--- src/sys/netinet6/frag6.c	2000/02/06 12:49:42	1.10
+++ src/sys/netinet6/frag6.c	2003/02/11 15:56:40	1.10.4.2
@@ -1,4 +1,4 @@
-/*	$NetBSD: frag6.c,v 1.10 2000/02/06 12:49:42 itojun Exp $	*/
+/*	$NetBSD: frag6.c,v 1.10.4.2 2003/02/11 15:56:40 msaitoh Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -66,6 +66,7 @@ static void frag6_insque __P((struct ip6
 static void frag6_remque __P((struct ip6q *));
 static void frag6_freef __P((struct ip6q *));
 
+/* XXX we eventually need splreass6, or some real semaphore */
 int frag6_doing_reass;
 u_int frag6_nfragpackets;
 struct	ip6q ip6q;	/* ip6 reassemble queue */
@@ -205,6 +206,8 @@ frag6_input(mp, offp, proto)
 	/* offset now points to data portion */
 	offset += sizeof(struct ip6_frag);
 
+	frag6_doing_reass = 1;
+
 	for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next)
 		if (ip6f->ip6f_ident == q6->ip6q_ident &&
 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
@@ -216,7 +219,6 @@ frag6_input(mp, offp, proto)
 		 * the first fragment to arrive, create a reassembly queue.
 		 */
 		first_frag = 1;
-		frag6_nfragpackets++;
 
 		/*
 		 * Enforce upper bound on number of fragmented packets
@@ -224,11 +226,11 @@ frag6_input(mp, offp, proto)
 		 * If maxfrag is 0, never accept fragments.
 		 * If maxfrag is -1, accept all fragments without limitation.
 		 */
-		if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets) {
-			ip6stat.ip6s_fragoverflow++;
-			in6_ifstat_inc(dstifp, ifs6_reass_fail);
-			frag6_freef(ip6q.ip6q_prev);
-		}
+		if (ip6_maxfragpackets < 0)
+			;
+		else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
+			goto dropfrag;
+		frag6_nfragpackets++;
 		q6 = (struct ip6q *)malloc(sizeof(struct ip6q), M_FTABLE,
 			M_DONTWAIT);
 		if (q6 == NULL)
@@ -273,6 +275,7 @@ frag6_input(mp, offp, proto)
 			icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
 				    offset - sizeof(struct ip6_frag) +
 					offsetof(struct ip6_frag, ip6f_offlg));
+			frag6_doing_reass = 0;
 			return(IPPROTO_DONE);
 		}
 	}
@@ -280,6 +283,7 @@ frag6_input(mp, offp, proto)
 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
 			    offset - sizeof(struct ip6_frag) +
 				offsetof(struct ip6_frag, ip6f_offlg));
+		frag6_doing_reass = 0;
 		return(IPPROTO_DONE);
 	}
 	/*
@@ -392,18 +396,24 @@ frag6_input(mp, offp, proto)
 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
 			- ip6af->ip6af_off;
 		if (i > 0) {
+#if 0				/* suppress the noisy log */
 			log(LOG_ERR, "%d bytes of a fragment from %s "
 			    "overlaps the previous fragment\n",
 			    i, ip6_sprintf(&q6->ip6q_src));
+#endif
+			free(ip6af, M_FTABLE);
 			goto dropfrag;
 		}
 	}
 	if (af6 != (struct ip6asfrag *)q6) {
 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
 		if (i > 0) {
+#if 0				/* suppress the noisy log */
 			log(LOG_ERR, "%d bytes of a fragment from %s "
 			    "overlaps the succeeding fragment",
 			    i, ip6_sprintf(&q6->ip6q_src));
+#endif
+			free(ip6af, M_FTABLE);
 			goto dropfrag;
 		}
 	}
@@ -524,6 +534,7 @@ insert:
 	in6_ifstat_inc(dstifp, ifs6_reass_fail);
 	ip6stat.ip6s_fragdropped++;
 	m_freem(m);
+	frag6_doing_reass = 0;
 	return IPPROTO_DONE;
 }
 
@@ -643,7 +654,8 @@ frag6_slowtimo()
 	 * (due to the limit being lowered), drain off
 	 * enough to get down to the new limit.
 	 */
-	while (frag6_nfragpackets > (u_int)ip6_maxfragpackets) {
+	while (frag6_nfragpackets > (u_int)ip6_maxfragpackets &&
+	    ip6q.ip6q_prev) {
 		ip6stat.ip6s_fragoverflow++;
 		/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
 		frag6_freef(ip6q.ip6q_prev);