Affects me too. This is a third independent reporter, on a different
setup (client/LAC only, xl2tpd in Docker).
== Environment ==
Ubuntu 24.04.4 LTS, x86_64, HP EliteDesk 800 G1 USDT (BIOS L01 v02.57)
Kernel-mode L2TP (l2tp_ppp), L2TP over IPsec transport, ESP in UDP 4500, behind
NAT.
Client only (one [lac], redial=yes). It runs in a privileged Debian bookworm
container:
xl2tpd 1.3.18-1, ppp 2.4.9-1+1.1+b1, strongswan-charon 5.9.8-5+deb12u5.
Last good: 6.8.0-142.142. It ran for 15 days with zero l2tp warnings.
== What happened ==
The host auto-rebooted into 6.8.0-146 at 02:00. The first splat came about 9
minutes later, on the
first tunnel bring-up after a container restart. It was followed by a page
fault in an unrelated
process (ffmpeg, memset_orig), then pppol2tp_xmit warnings, then hard resets.
Several boots
died within about 6 minutes.
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 10 at lib/refcount.c:25
refcount_warn_saturate+0x12e/0x150
Workqueue: events xfrm_trans_reinject
l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core]
l2tp_udp_recv_core+0xb1/0x350 [l2tp_core]
l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core]
...
xfrm4_rcv_encap_finish2+0x3c/0x60
xfrm_trans_reinject+0xe5/0x170
refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount+0xbb <-
l2tp_udp_recv_core+0x103)
refcount_t: saturated; leaking memory.
BUG: unable to handle page fault ... RIP: memset_orig+0x98/0xb0 (Comm:
ffmpeg)
WARNING: ... at net/l2tp/l2tp_ppp.c:166 pppol2tp_xmit+0x1e1/0x220 [l2tp_ppp]
(Comm: pppd, tailscaled)
== Module evidence ==
The srcversions match the original report:
l2tp_ppp 142: 410F7BD8BFBF7AF73E5803E 146: 5FE6350B4BF3E0647293B12
l2tp_core 142 = 146: D5976517E8DDA0096C46F58
Call relocations inside pppol2tp_ioctl (objdump -dr l2tp_ppp.ko):
6.8.0-142: l2tp_session_dec_refcount x2, no sock refcount ops
6.8.0-146: l2tp_session_dec_refcount x3, plus two "lock xadd 0x80(%rbx)"
(sk->sk_refcnt) and sk_free
Upstream a213a8950414 ("l2tp: pppol2tp: hold reference to session in
pppol2tp_ioctl()")
relies on the newer pppol2tp_sock_to_session(), which takes a SESSION reference
that
l2tp_session_put() then releases. In 6.8, pppol2tp_sock_to_session() takes a
SOCKET reference
(sock_hold(sk)) and returns sk_user_data with no session reference. The 146
backport seems to map the
final l2tp_session_put() to l2tp_session_dec_refcount(). If so, each L2TP ioctl
drops a session
reference it never took, and also leaks a socket reference. That matches the
underflow and the
"addition on 0" in l2tp_tunnel_get_session on the RX path.
I have not seen the backport source (git.launchpad.net returned 403 to me), so
this is inferred from the binary.
== Workaround ==
I blocked the modules with "install l2tp_core /bin/false" (plus l2tp_ppp and
l2tp_netlink) in /etc/modprobe.d.
xl2tpd then falls back to userspace pppd. The host has been stable since then
(24h+, no warnings).
Booting 6.8.0-142 should also work.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169477
Title:
[regression] 6.8.0-146: l2tp/pppol2tp use-after-free -> kernel panic /
soft lockup (L2TP/IPsec, xl2tpd)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169477/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
