Bug 529137 (CVE-2009-3613)

Description of problem:
(description copied from bug 515857).

The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC.

I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200.

Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed.

Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets).

Version-Release number of selected component (if applicable):

rhel-5.4 with kernel-2.6.18-160.el5

How reproducible:

as described above.

Actual results:

few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes:

PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
<Repeated Many Many Times>
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0

HARDWARE ERROR
CPU 0: Machine Check Exception:                7 Bank 4: bc0000000005001b
RIP 10:<ffffffff8006b2b0> {default_idle+0x29/0x50}
TSC 10116da2355 ADDR 4000000 MISC c008000001000000 
This is not a software problem!
Run through mcelog --ascii to decode and contact your hardware vendor
Kernel panic - not syncing: Uncorrected machine check
 <7>APIC error on CPU2: 00(08)

the pinger prints dots on screen(since no reply received) repeatedly.

Expected results:

the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack).

Additional info: