OpenConnect VPN (ocserv): general protection fault in ocserv-worker when a client tries to connect

[Hussein Abdallah]

ocserv 1.1.3-1 included in Ubuntu 22.04 with the latest updates does not work properly: when a VPN client tries to connect to the ocserv VPN server, this error message appears in the log:

May 23 23:28:31 my.vpn.server ocserv[15825]: The futex facility returned an unexpected error code.
May 23 23:28:31 my.vpn.server kernel: traps: ocserv-worker[15825] general protection fault ip:7fb8f835e898 sp:7ffeaaa84850 error:0 in libc.so.6[7fb8f835e000+195000]

Expected result: the OpenConnect client is successfully connected to the VPN.

It is possible to reproduce this bug since I see this error message every time a client tries to connect to the VPN.

Uninstalling the ocserv jammy package and compiling the latest ocsrv version 1.1.6 from source (https://www.infradead.org/ocserv/download/ocserv-1.1.6.tar.xz) solves this issue.

The ocserv changelog for version 1.1.6 says that "Added futex() to the accepted list of seccomp. It is required by Fedora 36’s libc." Maybe it is related to the futex error message seen in Ubuntu.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[ubnt0 (ubnt0)]

I am able to reproduce this.

[王万霖 (dgideas)]

I have this problem too, I use the same method to configure ocserv in Ubuntu 20.04 and 22.04, 20.04 is okay, but I got these error message in 22.04:

Oct 15 23:14:34 {HOSTNAME} ocserv[1518]: The futex facility returned an unexpected error code.

[dmitry volynkin (saturn-team)]

I have the same problem on ocserv 1.1.3, but ocserv 0.12.6 works fine

[Andreas Kemper (a-kemper)]

I can confirm the error with ocserv 1.1.3 on Ubuntu 22.04. For me the easiest workaround was to use the 1.1.6 package from Ubuntu Kinetic / 22.10 release, but still would prefer to switch back to an updated LTS package.

[houstonbofh (leesharp)]

Almost a year later and no fix on an LTS? That is disturbing... And the prior fix is problematic. Only 1.1.6-3 is available and it had dependency issues. I had to go to a Japanese mirror to find 1.1.6-2 that would still work. Not good for the latest LTS and a server program.