Re: pf: broken RB comparator drops IPv6 fragments

[Alexandr Nedvedicky]

Hello,

On Fri, Apr 10, 2026 at 08:56:33AM +0200, Renaud Allard wrote:
> pf_frag_compare() in sys/net/pf_norm.c uses subtraction to compare
> u_int32_t fragment IDs:
> 
>       if ((diff = a->fr_id - b->fr_id) != 0)
>               return (diff);
> 

</snip>

    I wonder if diff below would work too here...

thanks and
regards
sashan

--------8<---------------8<---------------8<------------------8<--------
diff --git a/sys/net/pf_norm.c b/sys/net/pf_norm.c
index 93b98db1d22..f7daa8a0c41 100644
--- a/sys/net/pf_norm.c
+++ b/sys/net/pf_norm.c
@@ -112,7 +112,7 @@ RB_HEAD(pf_frnode_tree, pf_frnode)  pf_frnode_tree;
 RB_PROTOTYPE(pf_frnode_tree, pf_frnode, fn_entry, pf_frnode_compare);
 RB_GENERATE(pf_frnode_tree, pf_frnode, fn_entry, pf_frnode_compare);
 
-static __inline int     pf_frag_compare(struct pf_fragment *,
+static __inline int64_t         pf_frag_compare(struct pf_fragment *,
                            struct pf_fragment *);
 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
@@ -184,10 +184,10 @@ pf_frnode_compare(struct pf_frnode *a, struct pf_frnode 
*b)
        return (0);
 }
 
-static __inline int
+static __inline int64_t
 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
 {
-       int     diff;
+       int64_t diff;
 
        if ((diff = a->fr_id - b->fr_id) != 0)
                return (diff);