Date: Sun, 15 Jun 2008 10:56:20 GMT From: Patrick Lamaiziere <patpr@davenulle.org> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/124609: ipsec 'remainder too big' panic with ping -s 3989 Message-ID: <200806151056.m5FAuKnD033963@www.freebsd.org> Resent-Message-ID: <200806151100.m5FB0AUK023216@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 124609
>Category: kern
>Synopsis: ipsec 'remainder too big' panic with ping -s 3989
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Jun 15 11:00:10 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Patrick Lamaiziere
>Release: 7-STABLE/i386
>Organization:
>Environment:
FreeBSD malpractice.lamaiziere.net 7.0-STABLE FreeBSD 7.0-STABLE #11: Sun Jun 15 03:00:07 CEST 2008 patrick@malpractice.lamaiziere.net:/usr/obj/usr/src/sys/NET5501 i386
>Description:
When IPsec is enabled (esp), doing a 'ping -s 3989' causes a kernel panic.
It's 100% reproductible.
A 'ping -s 3988' works fine.
My IPsec setup is:
----------
setkey
flush;
spdflush;
add 192.168.1.21 192.168.1.200 esp 1011
-E rijndael-cbc "0123456789012345"
-A hmac-sha2-256 "10987654321098765432109876543210";
add 192.168.1.200 192.168.1.21 esp 1012
-E rijndael-cbc "0123456789012345"
-A hmac-sha2-256 "10987654321098765432109876543210";
spdadd 192.168.1.200 192.168.1.21 any -P out ipsec esp/transport//require;
spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require;
-------------------
With ASSERTIONS set in the kernel, the system panics on an ipsec assertion:
panic: remainder too big: 3997
dump : (also on http://user.lamaiziere.net/patrick/ipsec-panic.txt)
---------
Unread portion of the kernel message buffer:
panic: remainder too big: 3997
KDB: enter: panic
Uptime: 51m41s
Physical memory: 503 MB
Dumping 58 MB: 43 27 11
#0 doadump () at /usr/src/sys/kern/kern_shutdown.c:244
244 dumptid = curthread->td_tid;
(kgdb) bt
#0 doadump () at /usr/src/sys/kern/kern_shutdown.c:244
#1 0xc05a80a0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2 0xc05a844c in panic (fmt=) at /usr/src/sys/kern/kern_shutdown.c:572
#3 0xc0763bdc in m_makespace (m0=0xc2cfd100, skip=20, hlen=24, off=0xd61ac900) at /usr/src/sys/netipsec/ipsec_mbuf.c:79
#4 0xc077a933 in esp_output (m=0xc2cfd100, isr=0xc30ffc80, mp=0x0, skip=20, protoff=9)
at /usr/src/sys/netipsec/xform_esp.c:746
#5 0xc0765223 in ipsec4_process_packet (m=0xc2cfd100, isr=0xc30ffc80, flags=32, tunalready=0)
at /usr/src/sys/netipsec/ipsec_output.c:491
#6 0xc0697fe1 in ip_ipsec_output (m=0xd61acaac, inp=0xc3129e10, flags=0xd61acab8, error=0xd61aca70, ro=0xd61acab4,
iproute=0xd61aca54, dst=0xd61aca6c, ia=0xd61aca68, ifp=0xd61aca78) at /usr/src/sys/netinet/ip_ipsec.c:331
#7 0xc0699c51 in ip_output (m=0xc2cfd100, opt=0x0, ro=0xd61aca54, flags=32, imo=0x0, inp=0xc3129e10)
at /usr/src/sys/netinet/ip_output.c:420
#8 0xc069bf41 in rip_output (m=0xc2cfd100, so=0xc309edec, dst=352430272) at /usr/src/sys/netinet/raw_ip.c:336
#9 0xc069cf89 in rip_send (so=0xc309edec, flags=0, m=0xc2cfd100, nam=0xc3093080, control=0x0, td=0xc31c5440)
at /usr/src/sys/netinet/raw_ip.c:806
#10 0xc0612af6 in sosend_generic (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0xc2cfd100, control=0x0, flags=0,
td=0xc31c5440) at /usr/src/sys/kern/uipc_socket.c:1240
#11 0xc0612c3b in sosend (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0x0, control=0x0, flags=0, td=0xc31c5440)
at /usr/src/sys/kern/uipc_socket.c:1286
#12 0xc0617eb2 in kern_sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0, control=0x0, segflg=UIO_USERSPACE)
at /usr/src/sys/kern/uipc_syscalls.c:789
#13 0xc0617d4b in sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0) at /usr/src/sys/kern/uipc_syscalls.c:730
#14 0xc0618053 in sendto (td=0xc31c5440, uap=0xd61accec) at /usr/src/sys/kern/uipc_syscalls.c:841
#15 0xc088e20d in syscall (frame=0xd61acd38) at /usr/src/sys/i386/i386/trap.c:1035
#16 0xc08769b0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#17 0x00000033 in ?? ()
(kgdb) quit
>How-To-Repeat:
setkey
flush;
spdflush;
add 192.168.1.21 192.168.1.200 esp 1011
-E rijndael-cbc "0123456789012345"
-A hmac-sha2-256 "10987654321098765432109876543210";
add 192.168.1.200 192.168.1.21 esp 1012
-E rijndael-cbc "0123456789012345"
-A hmac-sha2-256 "10987654321098765432109876543210";
spdadd 192.168.1.200 192.168.1.21 any -P out ipsec esp/transport//require;
spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require;
ping -s 3989 192.168.1.21
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200806151056.m5FAuKnD033963>