CVE-2009-3613: High severity linux kernel vulnerability

Description of problem: (description copied from bug 515857).

The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC.

I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200.

Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed.

Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets).

Version-Release number of selected component (if applicable):

rhel-5.4 with kernel-2.6.18-160.el5

How reproducible:

as described above.

Actual results:

few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes:

PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 <Repeated Many Many Times> PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0

HARDWARE ERROR CPU 0: Machine Check Exception: 7 Bank 4: bc0000000005001b RIP 10:<ffffffff8006b2b0> {defaultidle+0x29/0x50} TSC 10116da2355 ADDR 4000000 MISC c008000001000000 This is not a software problem! Run through mcelog --ascii to decode and contact your hardware vendor Kernel panic - not syncing: Uncorrected machine check <7>APIC error on CPU2: 00(08)

the pinger prints dots on screen(since no reply received) repeatedly.

Expected results:

the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack).

Additional info: