Re: icmp6 + ipf packet of death

[M Graff <explorer%flame.org@localhost>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

More info on this:  It seems to be when I send a large (4096 byte) ping
with fragmentation, or reply to one.  It also seems to be in the output
path as well as the input path.

- --Michael

M Graff wrote:
| I am afraid we might have an icmp6 packet of death problem.  I don't
| know what the packet is yet...  but I received two crashes recently, one
| on a very current OS version, and one several months old.  This is a
| frequent crash, although I do not know the actual trigger yet.
|
| Here is the trace from the older machine:
|
| NetBSD 4.99.38 (GENERIC) #0: Sat Dec  1 03:52:04 UTC 2007
|
| fr_makefrip(28,cadd8030,ccee78d4,2068880,f7aa9d99) at
| netbsd:fr_makefrip+0x132
| fr_checkicmp6matchingstate(1900,850b,6fbe5514,4,c02e1919) at
| netbsd:fr_checkicmp6matchingstate+0xc8
| fr_stlookup(ccee7b74,cadd8028,ccee7b28,c1851500,c1c8ad00) at
| netbsd:fr_stlookup+0x27c
| fr_checkstate(ccee7b74,ccee7c1c,ccee7b74,c16282c0,ccee7b8c) at
| netbsd:fr_checkstate+0x463
| fr_check(c1c8add0,28,c160d04c,1,ccee7c8c) at netbsd:fr_check+0x650
| fr_check_wrapper6(0,ccee7c8c,c160d04c,2,0) at
netbsd:fr_check_wrapper6+0x40
| pfil_run_hooks(c0a8fe40,ccee7e14,c160d04c,2,0) at
| netbsd:pfil_run_hooks+0x91
| ip6_output(c1c8ad00,0,ccee7ddc,4,0) at netbsd:ip6_output+0xd34
| icmp6_reflect(c1c8ad00,28,1,ccee7f1c,408) at netbsd:icmp6_reflect+0x287
| icmp6_error(c20b9900,3,1,0,c0a54f20) at netbsd:icmp6_error+0x2c9
| frag6_freef(3,1,c07a0430,c01450b8,c07a1140) at netbsd:frag6_freef+0x6a
| frag6_slowtimo(47aca08e,c343208e,73288405,c0a05d60,4) at
| netbsd:frag6_slowtimo+0x7d
| pfslowtimo(0,c160c000,c160c16c,c0a9fea0,c0a05d60) at
netbsd:pfslowtimo+0x39
| callout_softclock(0,3,c160d04c,0,0) at netbsd:callout_softclock+0x21d
| softintr_dispatch(0,ca83fbfc,1040028,0,0) at netbsd:softintr_dispatch+0x3f
| DDB lost frame for netbsd:Xsoftclock+0x35, trying 0xccee7ff4
| Xsoftclock() at netbsd:Xsoftclock+0x35
|
|
| The newer machine I don't have a serial console on, and it doesn't save
| core, but here are the typed-in-from-a-photo details:
|
| NetBSD 4.99.53 (GENERIC) #0: Thu Feb  7 11:39:43 UTC 2008
|
| fr_makefrip() +0x132
| fr_checkicmp6matchingstate() + 0xc8
| fr_stlookup() + 0x6dc
| fr_checkstate() + 0x463
| fr_check() + 0x650
| fr_check_wrapper6() + 0x40
| pfil_run_hooks() + 0x91
| ip6_input() + 0x349
| ip6intr() + 0x3f
| softint_dispatch() + 0x79
|

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHrxr+uzMQWQwZDN0RAkJnAJ9eY/ihfQf76AsT9J6MQ7nPRPj1IgCeOk5+
op1ABk0EbEofjXUkJ8jBeaQ=
=PX7j
-----END PGP SIGNATURE-----