[Bug 1030] New: racoon causes oops when implementing IPSec key

[Bug 1030] New: racoon causes oops when implementing IPSec key

[Martin J. Bligh]

http://bugme.osdl.org/show_bug.cgi?id=1030

           Summary: racoon causes oops when implementing IPSec key
    Kernel Version: 2.6.0-test1
            Status: NEW
          Severity: normal
             Owner: acme@conectiva.com.br
         Submitter: jsanchez@cs.ucf.edu


Distribution: SuSE and LFS
Hardware Environment: e100 cards
Software Environment: ipsec-tools 0.2.2 
Problem Description: 

I setkey with a policy to use esp and ah on each box. I start racoon on each box. I punch up a web 
page on one from the other. Insta-oops x 2. 
 
Unable to handle kernel NULL pointer dereference at virtual address 00000000
 printing eip:
c02bbd06
*pde = 00000000
Oops: 0000 [#1]
CPU:    0
EIP:    0060:[<c02bbd06>]     Not tainted
EFLAGS: 00010206
EIP is at memcpy+0x1e/0x39
eax: 00000018   ebx: f6fe8a00   ecx: 00000006   edx: 00000000
esi: 00000000   edi: 00000000   ebp: c0562520   esp: f6fb5ccc
ds: 007b    es: 007b  ss:0068
Process racoon (pid: 418, threadinfo=f6fb4000 task=f6fbb300)
Stack:


Call Trace:
 xfrm_state_update
 pfkey_add
 parse_exthdrs
 pfkey_process
 pfkey_sendmsg
 sock_sendmsg
 verify_iovec
 sys_sendmsg
 sockfd_lookup
 sys_sendto
 sys_getsockname
 __pollwait
 update_process
 sys_send
 sys_socketcall
 syscall_call

Code: f3 a5 a8 02 74 02 66 a5 a8 01 74 01 a4 89 d0 8b 74 24 02 8b
 <0>Kernel panic: Fatal exception in interrupt
In interrupt handler = not syncing


For some of the other numbers that didn't get copied, check 67.9.9.32/oops.jpg. Email me if its 
dead, which it will be after 20 august.

Steps to reproduce:

> From each box:

# !setkey -f
flush;
spdflush;
spdadd $this_box $other_box any -P out  ipsec esp/transport//use ah/transport//use;
spdadd $other_box $this_box any -P in ipsec esp/transport//use ah/transport//use;

Set up racoon (the default config would probably work, here is the gist of mine)

remote anonymous
{
        exchange_mode main;

        my_identifier address;
        peers_identifier address;

        lifetime time 1 min;    # sec,min,hour

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key ;
                dh_group 2;
        }
}

sainfo anonymous
{
        lifetime time 20 min;
        encryption_algorithm 3des ;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate ;
}

Start racoon on each box. 

Open a new connection to cause a key exchange.

Hit the reset button on each box.

Re: [Bug 1030] New: racoon causes oops when implementing IPSec key

[Justin Sanchez]

[-- Attachment #1: Type: text/plain, Size: 1706 bytes --]

Hi. I had this problem on 2.6.0-test1 and -test2 and -test2-bk2, so I'll
try to report it. I'm new to the scene, so I apologize in advance for
this post.

Background. 2 machines. e100 cards on each, if it matters. ipsec-tools
0.2.2. I give each of them directives to use esp and ah in transport
mode. I turn on racoon on each box. I ping. Both panic. Following is
about the message:.

Unable to handle kernel NULL pointer dereference at virtual address
00000000
 printing eip:
c02bbd06
*pde = 00000000
Oops: 0000 [#1]
CPU:    0
EIP:    0060:[<c02bbd06>]     Not tainted
EFLAGS: 00010206
EIP is at memcpy+0x1e/0x39
eax: 00000018   ebx: f6fe8a00   ecx: 00000006   edx: 00000000
esi: 00000000   edi: 00000000   ebp: c0562520   esp: f6fb5ccc
ds: 007b    es: 007b  ss:0068
Process racoon (pid: 418, threadinfo=f6fb4000 task=f6fbb300)
Stack:
Call Trace:
 xfrm_state_update
 pfkey_add
 parse_exthdrs
 pfkey_process
 pfkey_sendmsg
 sock_sendmsg
 verify_iovec
 sys_sendmsg
 sockfd_lookup
 sys_sendto
 sys_getsockname
 __pollwait
 update_process
 sys_send
 sys_socketcall
 syscall_call
Code: f3 a5 a8 02 74 02 66 a5 a8 01 74 01 a4 89 d0 8b 74 24 02 8b
 <0>Kernel panic: Fatal exception in interrupt
In interrupt handler = not syncing

If you want the full text of it, its at 67.9.9.32/oops.jpg.

I'm probably just doing something stupid...

On Sat, 2003-08-02 at 15:20, Francois Romieu wrote:
> Justin Sanchez <jsanchez@cs.ucf.edu> :
> [...]
> > How current? I've just seen it in -test2-bk2.
> 
> Forwarded to davem@redhat.com.
> 
> You may consider posting the data of the bug-report updated to -test2-bk2
> on netdev@oss.sgi.com.
> 
> --
> Ueimor
> 


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]