netdev
[Top] [All Lists]

Re: 2.4.x crashes due to an IPv6 packet with invalid length

To: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx>
Subject: Re: 2.4.x crashes due to an IPv6 packet with invalid length
From: Andi Kleen <ak@xxxxxx>
Date: Sun, 8 Apr 2001 09:39:30 +0200
Cc: netdev@xxxxxxxxxxx
In-reply-to: <Pine.LNX.4.33.0104061309410.21090-100000@xxxxxxxxxxxxxxxxx>; from kadlec@xxxxxxxxxxxxxxxxx on Fri, Apr 06, 2001 at 01:10:46PM +0200
References: <Pine.LNX.4.33.0104061309410.21090-100000@xxxxxxxxxxxxxxxxx>
Sender: owner-netdev@xxxxxxxxxxx
On Fri, Apr 06, 2001 at 01:10:46PM +0200, Jozsef Kadlecsik wrote:
>   Echo Request (1st fragment) is:
> 
>         IPv6 Header
>             Version            = 6
>             Traffic Class      = 0
>             FlowLabel          = 0
>             PayloadLength      = 527 (not multiple of 8 octets)
>             NextHeader         = 56 (Fragment Header)  

44 would be fragment header, 56 is TLSP (whatever that is)


>             SourceAddress      = Tester Link Local Address
>             DestinationAddress = Target Link Local Address
> 
>         Fragment Header
>             NextHeader         = 58 (ICMP)
>             FragmentOffset     = 0 (1st fragment)
>             MFlag              = 1 (more fragment)
> 
> The last messages before the oops are:
> 
> Warning: kfree_skb passed an skb still on a list (from xxxxxx)
> 
> and it is from the kfree_skb called from ip6_frag_queue in reassemmbly.c
> 
> I hope this helps to find the bug (2.2.19 is OK).

I tried to reproduce it on 2.4.0, but didn't succeed. Could you send me the 
decoded
oops you get and a tcpdump binary dump of the packet? Also what compiler are 
you using? 

-Andi

<Prev in Thread] Current Thread [Next in Thread>