From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steffen Klassert Subject: Re: ipv6 fragmentation-related panic in netfilter Date: Fri, 1 Nov 2013 09:45:29 +0100 Message-ID: <20131101084529.GL31491@secunet.com> References: <2060a7d2-c307-4e30-b1d4-0bd26c904d6f@gmail.com> <20131030000701.GB25469@macbook.localnet> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Tomas Hlavacek , netdev@vger.kernel.org, netfilter-devel@vger.kernel.org To: Patrick McHardy Return-path: Received: from a.mx.secunet.com ([195.81.216.161]:49716 "EHLO a.mx.secunet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754622Ab3KAIpc (ORCPT ); Fri, 1 Nov 2013 04:45:32 -0400 Content-Disposition: inline In-Reply-To: <20131030000701.GB25469@macbook.localnet> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Wed, Oct 30, 2013 at 12:07:11AM +0000, Patrick McHardy wrote: > > The problem is that the reassembled packet is referenced by the individual > fragments, so we trigger the BUG_ON in pskb_expand_head(). In this > particular case the case we BUG() on is actually OK, but I'm looking at > a way we can fix this without special casing. Hope to have a patch for > testing in the next hours. Just for the record. I'm observing similar, quite reproducable crashes when receiving fragmented icmp echo request packets on an IPsec gateway with nf_conntrack_ipv6. Since git commit 58a317f10 ("netfilter: ipv6: add IPv6 NAT support") netfilter might insert a reassembled ipv6 packet with a shared skb and local_df = 1 to the ok function. In case of xfrm, __xfrm6_output() fragments the packet again and when adjusting the headroom later, we crash because of a shared skb. I can fix it by checking for a shared skb in ip6_fragment() and do slow path fragmentation then. But we never needed such a check in ip6_fragment(), so it's maybe better to fix it in netfilter.