From owner-freebsd-bugs@FreeBSD.ORG Sun Jun 15 11:00:16 2008 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8822E1065672 for ; Sun, 15 Jun 2008 11:00:16 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 378618FC16 for ; Sun, 15 Jun 2008 11:00:11 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m5FB0AcS023217 for ; Sun, 15 Jun 2008 11:00:10 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m5FB0AUK023216; Sun, 15 Jun 2008 11:00:10 GMT (envelope-from gnats) Resent-Date: Sun, 15 Jun 2008 11:00:10 GMT Resent-Message-Id: <200806151100.m5FB0AUK023216@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Patrick Lamaiziere Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E22A1106566B for ; Sun, 15 Jun 2008 10:56:20 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id CABF38FC0A for ; Sun, 15 Jun 2008 10:56:20 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m5FAuKNP033972 for ; Sun, 15 Jun 2008 10:56:20 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id m5FAuKnD033963; Sun, 15 Jun 2008 10:56:20 GMT (envelope-from nobody) Message-Id: <200806151056.m5FAuKnD033963@www.freebsd.org> Date: Sun, 15 Jun 2008 10:56:20 GMT From: Patrick Lamaiziere To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/124609: ipsec 'remainder too big' panic with ping -s 3989 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Jun 2008 11:00:16 -0000 >Number: 124609 >Category: kern >Synopsis: ipsec 'remainder too big' panic with ping -s 3989 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Jun 15 11:00:10 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Patrick Lamaiziere >Release: 7-STABLE/i386 >Organization: >Environment: FreeBSD malpractice.lamaiziere.net 7.0-STABLE FreeBSD 7.0-STABLE #11: Sun Jun 15 03:00:07 CEST 2008 patrick@malpractice.lamaiziere.net:/usr/obj/usr/src/sys/NET5501 i386 >Description: When IPsec is enabled (esp), doing a 'ping -s 3989' causes a kernel panic. It's 100% reproductible. A 'ping -s 3988' works fine. My IPsec setup is: ---------- setkey flush; spdflush; add 192.168.1.21 192.168.1.200 esp 1011 -E rijndael-cbc "0123456789012345" -A hmac-sha2-256 "10987654321098765432109876543210"; add 192.168.1.200 192.168.1.21 esp 1012 -E rijndael-cbc "0123456789012345" -A hmac-sha2-256 "10987654321098765432109876543210"; spdadd 192.168.1.200 192.168.1.21 any -P out ipsec esp/transport//require; spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require; ------------------- With ASSERTIONS set in the kernel, the system panics on an ipsec assertion: panic: remainder too big: 3997 dump : (also on http://user.lamaiziere.net/patrick/ipsec-panic.txt) --------- Unread portion of the kernel message buffer: panic: remainder too big: 3997 KDB: enter: panic Uptime: 51m41s Physical memory: 503 MB Dumping 58 MB: 43 27 11 #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:244 244 dumptid = curthread->td_tid; (kgdb) bt #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:244 #1 0xc05a80a0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418 #2 0xc05a844c in panic (fmt=) at /usr/src/sys/kern/kern_shutdown.c:572 #3 0xc0763bdc in m_makespace (m0=0xc2cfd100, skip=20, hlen=24, off=0xd61ac900) at /usr/src/sys/netipsec/ipsec_mbuf.c:79 #4 0xc077a933 in esp_output (m=0xc2cfd100, isr=0xc30ffc80, mp=0x0, skip=20, protoff=9) at /usr/src/sys/netipsec/xform_esp.c:746 #5 0xc0765223 in ipsec4_process_packet (m=0xc2cfd100, isr=0xc30ffc80, flags=32, tunalready=0) at /usr/src/sys/netipsec/ipsec_output.c:491 #6 0xc0697fe1 in ip_ipsec_output (m=0xd61acaac, inp=0xc3129e10, flags=0xd61acab8, error=0xd61aca70, ro=0xd61acab4, iproute=0xd61aca54, dst=0xd61aca6c, ia=0xd61aca68, ifp=0xd61aca78) at /usr/src/sys/netinet/ip_ipsec.c:331 #7 0xc0699c51 in ip_output (m=0xc2cfd100, opt=0x0, ro=0xd61aca54, flags=32, imo=0x0, inp=0xc3129e10) at /usr/src/sys/netinet/ip_output.c:420 #8 0xc069bf41 in rip_output (m=0xc2cfd100, so=0xc309edec, dst=352430272) at /usr/src/sys/netinet/raw_ip.c:336 #9 0xc069cf89 in rip_send (so=0xc309edec, flags=0, m=0xc2cfd100, nam=0xc3093080, control=0x0, td=0xc31c5440) at /usr/src/sys/netinet/raw_ip.c:806 #10 0xc0612af6 in sosend_generic (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0xc2cfd100, control=0x0, flags=0, td=0xc31c5440) at /usr/src/sys/kern/uipc_socket.c:1240 #11 0xc0612c3b in sosend (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0x0, control=0x0, flags=0, td=0xc31c5440) at /usr/src/sys/kern/uipc_socket.c:1286 #12 0xc0617eb2 in kern_sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0, control=0x0, segflg=UIO_USERSPACE) at /usr/src/sys/kern/uipc_syscalls.c:789 #13 0xc0617d4b in sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0) at /usr/src/sys/kern/uipc_syscalls.c:730 #14 0xc0618053 in sendto (td=0xc31c5440, uap=0xd61accec) at /usr/src/sys/kern/uipc_syscalls.c:841 #15 0xc088e20d in syscall (frame=0xd61acd38) at /usr/src/sys/i386/i386/trap.c:1035 #16 0xc08769b0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196 #17 0x00000033 in ?? () (kgdb) quit >How-To-Repeat: setkey flush; spdflush; add 192.168.1.21 192.168.1.200 esp 1011 -E rijndael-cbc "0123456789012345" -A hmac-sha2-256 "10987654321098765432109876543210"; add 192.168.1.200 192.168.1.21 esp 1012 -E rijndael-cbc "0123456789012345" -A hmac-sha2-256 "10987654321098765432109876543210"; spdadd 192.168.1.200 192.168.1.21 any -P out ipsec esp/transport//require; spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require; ping -s 3989 192.168.1.21 >Fix: >Release-Note: >Audit-Trail: >Unformatted: