Affects me too. This is a third independent reporter, on a different setup (client/LAC only, xl2tpd in Docker). == Environment == Ubuntu 24.04.4 LTS, x86_64, HP EliteDesk 800 G1 USDT (BIOS L01 v02.57) Kernel-mode L2TP (l2tp_ppp), L2TP over IPsec transport, ESP in UDP 4500, behind NAT. Client only (one [lac], redial=yes). It runs in a privileged Debian bookworm container: xl2tpd 1.3.18-1, ppp 2.4.9-1+1.1+b1, strongswan-charon 5.9.8-5+deb12u5. Last good: 6.8.0-142.142. It ran for 15 days with zero l2tp warnings. == What happened == The host auto-rebooted into 6.8.0-146 at 02:00. The first splat came about 9 minutes later, on the first tunnel bring-up after a container restart. It was followed by a page fault in an unrelated process (ffmpeg, memset_orig), then pppol2tp_xmit warnings, then hard resets. Several boots died within about 6 minutes. refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 10 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150 Workqueue: events xfrm_trans_reinject l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core] l2tp_udp_recv_core+0xb1/0x350 [l2tp_core] l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core] ... xfrm4_rcv_encap_finish2+0x3c/0x60 xfrm_trans_reinject+0xe5/0x170 refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount+0xbb <- l2tp_udp_recv_core+0x103) refcount_t: saturated; leaking memory. BUG: unable to handle page fault ... RIP: memset_orig+0x98/0xb0 (Comm: ffmpeg) WARNING: ... at net/l2tp/l2tp_ppp.c:166 pppol2tp_xmit+0x1e1/0x220 [l2tp_ppp] (Comm: pppd, tailscaled) == Module evidence == The srcversions match the original report: l2tp_ppp 142: 410F7BD8BFBF7AF73E5803E 146: 5FE6350B4BF3E0647293B12 l2tp_core 142 = 146: D5976517E8DDA0096C46F58 Call relocations inside pppol2tp_ioctl (objdump -dr l2tp_ppp.ko): 6.8.0-142: l2tp_session_dec_refcount x2, no sock refcount ops 6.8.0-146: l2tp_session_dec_refcount x3, plus two "lock xadd 0x80(%rbx)" (sk->sk_refcnt) and sk_free Upstream a213a8950414 ("l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()") relies on the newer pppol2tp_sock_to_session(), which takes a SESSION reference that l2tp_session_put() then releases. In 6.8, pppol2tp_sock_to_session() takes a SOCKET reference (sock_hold(sk)) and returns sk_user_data with no session reference. The 146 backport seems to map the final l2tp_session_put() to l2tp_session_dec_refcount(). If so, each L2TP ioctl drops a session reference it never took, and also leaks a socket reference. That matches the underflow and the "addition on 0" in l2tp_tunnel_get_session on the RX path. I have not seen the backport source (git.launchpad.net returned 403 to me), so this is inferred from the binary. == Workaround == I blocked the modules with "install l2tp_core /bin/false" (plus l2tp_ppp and l2tp_netlink) in /etc/modprobe.d. xl2tpd then falls back to userspace pppd. The host has been stable since then (24h+, no warnings). Booting 6.8.0-142 should also work. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169477 Title: [regression] 6.8.0-146: l2tp/pppol2tp use-after-free -> kernel panic / soft lockup (L2TP/IPsec, xl2tpd) Status in linux package in Ubuntu: Confirmed Bug description: Package: linux (Ubuntu Noble) Affected: linux-image-6.8.0-146-generic 6.8.0-146.146 Last good: 6.8.0-142.142 (also 6.8.0-139.139) == Summary == After upgrading from 6.8.0-142 to 6.8.0-146, a host acting as an L2TP/IPsec server (LNS) and client (LAC) at the same time crashes within 1-10 minutes of boot: kernel panic ("Fatal exception in interrupt") or a permanent soft lockup. 11 crashes in ~2 hours, all on 6.8.0-146, all inside l2tp_core/l2tp_ppp. Booting back into 6.8.0-142 fixes it completely (no warnings at all since). Among the l2tp modules, only l2tp_ppp.ko changed between 142 and 146: l2tp_core srcversion: D5976517E8DDA0096C46F58 (139, 142, 146 - identical) l2tp_ppp srcversion: 410F7BD8BFBF7AF73E5803E (139, 142) 5FE6350B4BF3E0647293B12 (146) Suspected commit (146 changelog, LP: #2164796, CVE-2026-53262): "l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()" All failures are refcount errors on the L2TP session object and the faults that follow from them, which suggests an unbalanced session reference in the backport. == Environment == Ubuntu 24.04.5 LTS, x86_64 Hardware: YF ADLNN01 (Intel N150), BIOS 5.27 12/17/2025, 4x Intel I226-V (igc) xl2tpd 1.3.18-1build2, ppp 2.4.9-1+1.1ubuntu4, strongswan 5.9.13-2ubuntu4.24.04.5 Kernel-mode L2TP (l2tp_ppp), L2TP over IPsec transport (ESP in UDP 4500), xl2tpd configured with one [lns default] (several clients) plus one [lac] with redial=yes, redial timeout=30. == Reproduction == 1. Boot 6.8.0-146 with xl2tpd (LNS + LAC) over strongswan IPsec. 2. Let 2-3 L2TP tunnels come up; reconnects / session teardown happen. 3. Within 1-10 minutes: refcount warnings, then panic or soft lockup. Not reproducible on 6.8.0-142 (4 boots, hours of uptime, zero warnings). == Crash signatures (6.8.0-146) == 1) refcount UAF on RX path (first symptom on every bad boot) refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 42 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150 Workqueue: events xfrm_trans_reinject l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core] l2tp_udp_recv_core+0xb1/0x350 [l2tp_core] l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core] udp_queue_rcv_one_skb / __udp4_lib_rcv / udp_rcv followed by: refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount+0xbb <- l2tp_udp_recv_core+0x103) refcount_t: saturated; leaking memory. 2) NULL pointer dereference on TX path -> panic BUG: kernel NULL pointer dereference, address: 000000000000002d CPU: 2 PID: 2608 Comm: pppd Tainted: G W 6.8.0-146-generic #146-Ubuntu xfrm_dst_check+0x24/0x40 __sk_dst_check+0x8f/0xa0 __ip_queue_xmit+0x2a0/0x510 l2tp_xmit_core.constprop.0+0x225/0x460 [l2tp_core] l2tp_xmit_skb+0x30/0xa0 [l2tp_core] pppol2tp_xmit+0x114/0x220 [l2tp_ppp] Kernel panic - not syncing: Fatal exception in interrupt (other instances: RIP _raw_spin_lock+0x13 / pppol2tp_xmit+0x1e1) 3) Soft lockup in tunnel deletion (host hangs, no auto-reboot) watchdog: BUG: soft lockup - CPU#1 stuck for 26s..130s! [kworker/u8:3:176] Workqueue: l2tp l2tp_tunnel_del_work [l2tp_core] RIP: _raw_spin_lock_bh+0x1b / l2tp_tunnel_del_work+0x98 l2tp_tunnel_del_work+0x8d/0x1b0 [l2tp_core] process_one_work / worker_thread / kthread preceded by a warning in pppol2tp_release+0x153 [l2tp_ppp] (sock close path). Some dumps also show faults in __mptcp_close_ssk / tcp_release_cb_override / xfrm_bundle_ok after the l2tp refcount warnings. These are most likely secondary memory corruption. == Boot statistics == 6.8.0-139: 16 days uptime, no issues 6.8.0-146: 13 boots in 2h, 11 pstore crash dumps (all l2tp), boots in between ended in hard hangs 6.8.0-142: 4 boots, 0 refcount warnings, 0 soft lockups, 0 l2tp traces == Attachments == pstore/*.txt - EFI pstore dumps (systemd-pstore). Inside each file the parts are in reverse order (PartN first). IPv4/MAC addresses redacted. == Workaround == Pin 6.8.0-142 in GRUB and hold linux-image-generic. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169477/+subscriptions
Комментариев нет:
Отправить комментарий