pppd on new Precise HWE kernels fails, but works on 3.2

[Simon Déziel]

Connecting to an IPsec/L2TP tunnel works when using the 3.2 kernel shipped with Precise 12.04 but fails with the most recent HWE kernel (3.8 from 12.04.3).

With the 3.8 kernel here is how pppd dies:

Oct 25 11:31:24 l2tp-udesktop pppd[2758]: Plugin pppol2tp.so loaded.
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: pppd options in effect:
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: debug debug#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: nodetach#011#011# (from command line)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: idle 72000#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: ktune#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: dump#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: plugin pppol2tp.so#011#011# (from command line)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: noauth#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: refuse-chap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: refuse-mschap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: refuse-mschap-v2#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: refuse-eap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: name myname#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: password ??????#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop pppd[2758]: remotename #011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 11:31:24 l2tp-udesktop kernel: [ 246.621763] pppd[2758]: segfault at 0 ip 000000000041f1d0 sp 00007fff1da9bf10 error 4 in pppd[400000+49000]

Information about the affected system:

root@l2tp-udesktop:~# lsb_release -rd
Description: Ubuntu 12.04.3 LTS
Release: 12.04

root@l2tp-udesktop:~# apt-cache policy ppp
ppp:
  Installed: 2.4.5-5ubuntu1
  Candidate: 2.4.5-5ubuntu1
  Version table:
 *** 2.4.5-5ubuntu1 0
        500 http://ca.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages
        100 /var/lib/dpkg/status

root@l2tp-udesktop:~# dpkg -l| grep linux-image
ii linux-image-3.2.0-54-virtual 3.2.0-54.82 Linux kernel image for version 3.2.0 on 64 bit x86 Virtual Guests
ii linux-image-3.8.0-30-generic 3.8.0-30.44~precise1 Linux kernel image for version 3.8.0 on 64 bit x86 SMP
ii linux-image-generic-lts-raring 3.8.0.30.30 Generic Linux kernel image
ii linux-image-virtual 3.2.0.54.64 Linux kernel image for virtual machines

[Michael Richardson (mcr-sandelman)]

I rebuilt the ppp 2.4.5 ubuntu1 package from source, same result.
I grabbed the ubuntu2 (quantal) patches and applied them, thinking that this is a kernel interface issue, that got the same result.
I then cp'ed if_pppol2tp.h from /lib/modules/.../build into the ppp/include/linux dir, noting that it brought it's own copy
of that file, and rebuilt, and there was no change.

I wonder if it is a 64-bit issue. Under all of the l2tp deamons, it's a bit hard to get a core dump, but that's my next step.

[Michael Richardson (mcr-sandelman)]

I got a core dump, and determined that somehow this isn't about the kernel, but clearly something about the newer kernel
triggers a bug.
In pppd/utils.c, the vslprintf() trips up for a few reasons.
One is that pppd/options.c, print_option() seems to use printer()
with the wrong number of arguments. I protected the dereference
of the char **, but that wasn't it, the result was also still NULL.

- if ((opt->flags & OPT_STATIC) == 0)
- p = *(char **)p;
- printer("%q", p);
+ if ((opt->flags & OPT_STATIC) == 0) {
+ if(p != NULL) {
+ p = *(char **)p;
+ } else {
+ p = "NULL";
+ }
+ }
+ printer(arg, "%q", p);

so I protected the %q against dereference of null:

@@ -309,6 +310,12 @@ vslprintf(buf, buflen, fmt, args)
        case 'q': /* quoted string */
            quoted = c == 'q';
            p = va_arg(args, unsigned char *);
+ if(p==NULL) {
+ OUTCHAR('<');
+ OUTCHAR('0');
+ OUTCHAR('>');
+ continue;
+ }
            if (fillch == '0' && prec >= 0) {
                n = prec;
            } else {

The debug options were actually what made this fail, as it was about to print something about the pppol2tp plugin:

Oct 25 13:48:14 l2tp-udesktop pppd[8515]: Plugin pppol2tp.so loaded.
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: pppd MCR options in effect:
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: debug debug debug debug debug#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: nodetach#011#011# (from command line)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: idle 72000#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: ktune#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: dump#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: plugin pppol2tp.so#011#011# (from command line)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: noauth#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: refuse-chap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: refuse-mschap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: refuse-mschap-v2#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: refuse-eap#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: name XXXX#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: password ??????#011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: remotename #011#011# (from /etc/ppp/Checkpoint.options.xl2tpd)

HERE:
Oct 25 13:48:14 l2tp-udesktop pppd[8515]: pppol2tp <0>#011#011# (from command line)
Oct 25 13:48...

[Michael Richardson (mcr-sandelman)]

As a stupid workaround: the fault is in log messages so running without any ppp debug options on makes the problem go away.

[Simon Déziel (sdeziel)]

This bug is probably fixed but I'll mark it as incomplete hoping that someone would take the time to test it with supported versions.

[Launchpad Janitor (janitor)]

[Expired for ppp (Ubuntu) because there has been no activity for 60 days.]