Re: pf: broken RB comparator drops IPv6 fragments

Hello,

On Fri, Apr 10, 2026 at 08:56:33AM +0200, Renaud Allard wrote:
> pf_frag_compare() in sys/net/pf_norm.c uses subtraction to compare
> u_int32_t fragment IDs:
> 
> 	if ((diff = a->fr_id - b->fr_id) != 0)
> 		return (diff);
> 

</snip>

    I wonder if diff below would work too here...

thanks and
regards
sashan

--------8<---------------8<---------------8<------------------8<--------
diff --git a/sys/net/pf_norm.c b/sys/net/pf_norm.c
index 93b98db1d22..f7daa8a0c41 100644
--- a/sys/net/pf_norm.c
+++ b/sys/net/pf_norm.c
@@ -112,7 +112,7 @@ RB_HEAD(pf_frnode_tree, pf_frnode)	pf_frnode_tree;
 RB_PROTOTYPE(pf_frnode_tree, pf_frnode, fn_entry, pf_frnode_compare);
 RB_GENERATE(pf_frnode_tree, pf_frnode, fn_entry, pf_frnode_compare);
 
-static __inline int	 pf_frag_compare(struct pf_fragment *,
+static __inline int64_t	 pf_frag_compare(struct pf_fragment *,
 			    struct pf_fragment *);
 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
@@ -184,10 +184,10 @@ pf_frnode_compare(struct pf_frnode *a, struct pf_frnode *b)
 	return (0);
 }
 
-static __inline int
+static __inline int64_t
 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
 {
-	int	diff;
+	int64_t	diff;
 
 	if ((diff = a->fr_id - b->fr_id) != 0)
 		return (diff);