Red Hat Bugzilla – Bug 151044
Kernel crashes when generating ICMP Frag Needed if the packet is denied by the IPSEC SPD
Last modified: 2015-01-04 17:17:47 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041111 Firefox/1.0
Description of problem:
When sending a packet through IPSEC, the packet obviously grows as it is encrypted. If the encrypted packet exceeds the MTU and has the DF flag set, the kernel generates an ICMP Frag Needed. If that frag needed packet is denied by the SPD then the kernel locks up hard. Admittedly, the policies are in error in this case and the network wouldn't work properly. However, it shouldn't cause the kernel to lock up. I have discussed this on the NetDev mailing list and Herbert Xu has written a patch (attached) which I have confirmed corrects the problem.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Set SPD policies which deny a locally generated packet
2. Send a near-MTU sized packet through IPSEC
Actual Results: The packet exceeds MTU size when encrypted, the kernel generates a frag needed response but this gets caught by the policy (correctly). However, this results in a hard lockup of the kernel.
Expected Results: Frag needed packet should be dropped cleanly.
Discussed on the NetDev mailing list here: http://oss.sgi.com/projects/netdev/archive/2005-03/msg00790.html
Created attachment 111975 [details]
Patch to resolve the bug
This patch was written and signed off by Herbert Xu (NetDev mailing list)
An update has been released for Fedora Core 3 (kernel-2.6.12-1.1372_FC3) which
may contain a fix for your problem. Please update to this new kernel, and
report whether or not it fixes your problem.
If you have updated to Fedora Core 4 since this bug was opened, and the problem
still occurs with the latest updates for that release, please change the version
field of this bug to 'fc4'.
This bug has been automatically closed as part of a mass update.
It had been in NEEDINFO state since July 2005.
If this bug still exists in current errata kernels, please reopen this bug.
There are a large number of inactive bugs in the database, and this is the only
way to purge them.