Public bug reported:
With a high MTU (9000) set on the interface, sending packets containing
over ~3000 zero bytes to a network card using the igb driver results in
broken packets or in the worst case for some packet sizes even leads to
kernel panics or full freeze.
So far I observed this for Intel I350 and I210 network cards which use
the igb driver.
This is easy to reproduce:
* set MTU to 9000
* send ping of death: ping -M do -p 00 3016 <ip>
-> kernel panic or complete freeze of system
If the data is not zero, it works fine:
ping -M do -p ff 3016 <ip>
Depending on packet length:
* < 3000: fine
* 3016: panic/freeze
* > 3030: packet not complete
I also tested this with the following kernel versions:
* 5.8.0-63-generic -> OK
* 5.11.0-46-generic -> OK
* 5.13.0-52-generic -> broken
* 5.15.0-41-generic -> broken
* 5.19.5-051905-generic mainline -> broken
We noticed that since we have GigE Vision cameras which send the data
via UDP with packet sizes up to 9000. When we turned off the light (and
hence many bytes in the payload were zero), the packets would not be
complete anymore (checked with tcpdump/wireshark) or even lead to kernel
panics.
ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: linux-image-5.15.0-53-generic 5.15.0-53.59~20.04.1
ProcVersionSignature: Ubuntu 5.15.0-53.59~20.04.1-generic 5.15.64
Uname: Linux 5.15.0-53-generic x86_64
ApportVersion: 2.20.11-0ubuntu27.25
Architecture: amd64
CasperMD5CheckResult: skip
Date: Thu Nov 24 13:16:00 2022
SourcePackage: linux-signed-hwe-5.15
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: linux-signed-hwe-5.15 (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug focal
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-signed-hwe-5.15 in Ubuntu.
https://bugs.launchpad.net/bugs/1997764
Title:
igb driver crashes kernel when receiving jumbo frame UDP packets with
all zeros
Status in linux-signed-hwe-5.15 package in Ubuntu:
New
Bug description:
With a high MTU (9000) set on the interface, sending packets
containing over ~3000 zero bytes to a network card using the igb
driver results in broken packets or in the worst case for some packet
sizes even leads to kernel panics or full freeze.
So far I observed this for Intel I350 and I210 network cards which use
the igb driver.
This is easy to reproduce:
* set MTU to 9000
* send ping of death: ping -M do -p 00 3016 <ip>
-> kernel panic or complete freeze of system
If the data is not zero, it works fine:
ping -M do -p ff 3016 <ip>
Depending on packet length:
* < 3000: fine
* 3016: panic/freeze
* > 3030: packet not complete
I also tested this with the following kernel versions:
* 5.8.0-63-generic -> OK
* 5.11.0-46-generic -> OK
* 5.13.0-52-generic -> broken
* 5.15.0-41-generic -> broken
* 5.19.5-051905-generic mainline -> broken
We noticed that since we have GigE Vision cameras which send the data
via UDP with packet sizes up to 9000. When we turned off the light
(and hence many bytes in the payload were zero), the packets would not
be complete anymore (checked with tcpdump/wireshark) or even lead to
kernel panics.
ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: linux-image-5.15.0-53-generic 5.15.0-53.59~20.04.1
ProcVersionSignature: Ubuntu 5.15.0-53.59~20.04.1-generic 5.15.64
Uname: Linux 5.15.0-53-generic x86_64
ApportVersion: 2.20.11-0ubuntu27.25
Architecture: amd64
CasperMD5CheckResult: skip
Date: Thu Nov 24 13:16:00 2022
SourcePackage: linux-signed-hwe-5.15
UpgradeStatus: No upgrade log present (probably fresh install)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-signed-hwe-5.15/+bug/1997764/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
