kern/124609: ipsec 'remainder too big' panic with ping -s 3989

[Patrick Lamaiziere]

>Number:         124609
>Category:       kern
>Synopsis:       ipsec 'remainder too big' panic with ping -s 3989
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jun 15 11:00:10 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Patrick Lamaiziere
>Release:        7-STABLE/i386
>Organization:
>Environment:
FreeBSD malpractice.lamaiziere.net 7.0-STABLE FreeBSD 7.0-STABLE #11: Sun Jun 15 03:00:07 CEST 2008    patrick at malpractice.lamaiziere.net:/usr/obj/usr/src/sys/NET5501  i386

>Description:
When IPsec is enabled (esp), doing a 'ping -s 3989' causes a kernel panic.
It's 100% reproductible.

A 'ping -s 3988' works fine.

My IPsec setup is:
----------
setkey
flush;
spdflush;
add 192.168.1.21 192.168.1.200 esp 1011
        -E rijndael-cbc "0123456789012345"
        -A hmac-sha2-256 "10987654321098765432109876543210";
add 192.168.1.200 192.168.1.21 esp 1012
        -E rijndael-cbc "0123456789012345"
        -A hmac-sha2-256 "10987654321098765432109876543210";
spdadd 192.168.1.200 192.168.1.21  any -P out ipsec esp/transport//require;
spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require;
-------------------

With ASSERTIONS set in the kernel, the system panics on an ipsec assertion:
panic: remainder too big: 3997

dump : (also on http://user.lamaiziere.net/patrick/ipsec-panic.txt)
---------
Unread portion of the kernel message buffer:
panic: remainder too big: 3997
KDB: enter: panic
Uptime: 51m41s
Physical memory: 503 MB
Dumping 58 MB: 43 27 11

#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:244
244		dumptid = curthread->td_tid;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:244
#1  0xc05a80a0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc05a844c in panic (fmt=) at /usr/src/sys/kern/kern_shutdown.c:572
#3  0xc0763bdc in m_makespace (m0=0xc2cfd100, skip=20, hlen=24, off=0xd61ac900) at /usr/src/sys/netipsec/ipsec_mbuf.c:79
#4  0xc077a933 in esp_output (m=0xc2cfd100, isr=0xc30ffc80, mp=0x0, skip=20, protoff=9)
    at /usr/src/sys/netipsec/xform_esp.c:746
#5  0xc0765223 in ipsec4_process_packet (m=0xc2cfd100, isr=0xc30ffc80, flags=32, tunalready=0)
    at /usr/src/sys/netipsec/ipsec_output.c:491
#6  0xc0697fe1 in ip_ipsec_output (m=0xd61acaac, inp=0xc3129e10, flags=0xd61acab8, error=0xd61aca70, ro=0xd61acab4, 
    iproute=0xd61aca54, dst=0xd61aca6c, ia=0xd61aca68, ifp=0xd61aca78) at /usr/src/sys/netinet/ip_ipsec.c:331
#7  0xc0699c51 in ip_output (m=0xc2cfd100, opt=0x0, ro=0xd61aca54, flags=32, imo=0x0, inp=0xc3129e10)
    at /usr/src/sys/netinet/ip_output.c:420
#8  0xc069bf41 in rip_output (m=0xc2cfd100, so=0xc309edec, dst=352430272) at /usr/src/sys/netinet/raw_ip.c:336
#9  0xc069cf89 in rip_send (so=0xc309edec, flags=0, m=0xc2cfd100, nam=0xc3093080, control=0x0, td=0xc31c5440)
    at /usr/src/sys/netinet/raw_ip.c:806
#10 0xc0612af6 in sosend_generic (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0xc2cfd100, control=0x0, flags=0, 
    td=0xc31c5440) at /usr/src/sys/kern/uipc_socket.c:1240
#11 0xc0612c3b in sosend (so=0xc309edec, addr=0xc3093080, uio=0xd61acbc8, top=0x0, control=0x0, flags=0, td=0xc31c5440)
    at /usr/src/sys/kern/uipc_socket.c:1286
#12 0xc0617eb2 in kern_sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0, control=0x0, segflg=UIO_USERSPACE)
    at /usr/src/sys/kern/uipc_syscalls.c:789
#13 0xc0617d4b in sendit (td=0xc31c5440, s=3, mp=0xd61acc50, flags=0) at /usr/src/sys/kern/uipc_syscalls.c:730
#14 0xc0618053 in sendto (td=0xc31c5440, uap=0xd61accec) at /usr/src/sys/kern/uipc_syscalls.c:841
#15 0xc088e20d in syscall (frame=0xd61acd38) at /usr/src/sys/i386/i386/trap.c:1035
#16 0xc08769b0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#17 0x00000033 in ?? ()
(kgdb) quit
>How-To-Repeat:
setkey
flush;
spdflush;
add 192.168.1.21 192.168.1.200 esp 1011
        -E rijndael-cbc "0123456789012345"
        -A hmac-sha2-256 "10987654321098765432109876543210";
add 192.168.1.200 192.168.1.21 esp 1012
        -E rijndael-cbc "0123456789012345"
        -A hmac-sha2-256 "10987654321098765432109876543210";
spdadd 192.168.1.200 192.168.1.21  any -P out ipsec esp/transport//require;
spdadd 192.168.1.21 192.168.1.200 any -P in ipsec esp/transport//require;

ping -s 3989 192.168.1.21
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: