net-dialup/xl2tpd: 1.3.20-r2 - fix a few use-after-free issues

Firstly, upstream bug PR at https://github.com/xelerance/xl2tpd/pull/288
(link also in patch).  This is very unlikely to cause crashes or
anything, so not critical stable.

Then an update on the large patch for using poll instead of select:

Effective diff at:

bfc2730bc1..0bca596a73

This one does cause crashes, however, even I only use this patch in one
single location - so hopefully this won't affect too many people.  If
you are using xl2tpd with USE=poll and seeing random segfaults - try
updating.

Signed-off-by: Jaco Kroon <jkroon@gentoo.org>

net-dialup/xl2tpd/Manifest

@@ -1,3 +1,4 @@
 DIST xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch 4074 BLAKE2B d1566a22c51dfc448df41424722571206dbedb36b48bafe19a629b5c0c3eadce17a899d387c5aa241f4367cbfef86f09322f4a7dd429eeb1fd82539a81f7aa76 SHA512 8a10ddfbb6998a4caeaf8a55334d5e4a3fdbe10e0b71652699fda5bb27cd8f1e0b88c7dd50fb95cea3385353b91a4d9208003e436cc3d4e8023828a80cbbeb19
+DIST xl2tpd-1.3.20-ditch-select-use-poll-v2.patch 24434 BLAKE2B fdcea3f34c0d7fd9a1ce9934eda825a89d20a9c7254247fd9e55e68f26a3ea3870919b292966a10967e2ebcaed253ade01d90e88d567d8b6a432b2a99ae1d5dc SHA512 86c3151adab74ffc89ac55b15d728632ac41fe2db7e2767ed6f80dd5627fef55c1d3c44aac844e5403d8f5f5afd8069e3d2b648494b52264c4f4cf5163396533
 DIST xl2tpd-1.3.20-ditch-select-use-poll.patch 24347 BLAKE2B 8a13a52fb64a8135ccb4ccb618039c9345cccc28f31c08c58349e98b739994c7eddbfa629d1d4c79646e2060aef4cf1331ee57864413f16e105edd275768ce8b SHA512 bcfe9d0f90b8332078221e921307ca111eb3b0ed5c6b11716fc13f5bf9223ea58a667d46f38f8fdc3d062f596533da8550e5fb9312f0b6fefd9f799bf2a21407
 DIST xl2tpd-1.3.20.tar.gz 537558 BLAKE2B 98a5c0c6884aa77fe277ffc8a2310a472d5a5db86d39a4ae7da9f97eed53e033b6680a683b1bb52433320711f966ec1f3f02174ce15fbe52fb88d8287a1f8231 SHA512 d227e1dafbb1d7ca64d42084397eaf013f89958bc705d602ca9717e355b2a420756ccbf71663f920b44a6624411a59bf52fd039ba50a7d45a976e9af03ed4dc5

net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch

@@ -0,0 +1,64 @@
+https://github.com/xelerance/xl2tpd/pull/288
+From 0bfd157fe69996a64b7a48dff4b92d6604cbb560 Mon Sep 17 00:00:00 2001
+From: Jaco Kroon <jaco@uls.co.za>
+Date: Mon, 22 Jun 2026 12:35:49 +0200
+Subject: [PATCH] xl2tpd: Fix use-after-free in child_handler.
+
+==12749== Invalid write of size 4
+==12749==    at 0x4004D42: child_handler (xl2tpd.c:293)
+==12749==    by 0x4004D42: process_signal (xl2tpd.c:386)
+==12749==    by 0x400C843: network_thread (network.c:697)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==  Address 0x56bb9a0 is 480 bytes inside a block of size 4,944 free'd
+==12749==    at 0x486496F: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+==12749==    by 0x4004D41: child_handler (xl2tpd.c:290)
+==12749==    by 0x4004D41: process_signal (xl2tpd.c:386)
+==12749==    by 0x400C843: network_thread (network.c:697)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==  Block was alloc'd at
+==12749==    at 0x48692B3: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+==12749==    by 0x400B825: new_call (call.c:495)
+==12749==    by 0x4009020: message_type_avp (avp.c:323)
+==12749==    by 0x400AF76: handle_avps (avp.c:1771)
+==12749==    by 0x40085E3: handle_control (control.c:1822)
+==12749==    by 0x40085E3: handle_packet (control.c:1841)
+==12749==    by 0x400BEB1: network_thread_process_socket (network.c:617)
+==12749==    by 0x400C9F2: network_thread (network.c:761)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==
+
+When using kernel mode this call call_close, which will already
+close(c->fd) if >0 and destroy_call is actually called, including
+setting c->fd = -1.
+
+Further to be noted is that call_close could thus free() the relevant
+memory, resulting in this error.
+
+Bottom line:  We only need to set c->fd = -1 if we're the function closing the fd().
+
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+---
+ xl2tpd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xl2tpd.c b/xl2tpd.c
+index cbf2e22..c1544f8 100644
+--- a/xl2tpd.c
++++ b/xl2tpd.c
+@@ -285,12 +285,12 @@ static void child_handler (int sig)
+ 
+ #endif
+                     close (c->fd);
++                    c->fd = -1;
+ #ifdef USE_KERNEL
+                  } else {
+                      call_close (c);
+                  }
+ #endif
+-                    c->fd = -1;
+                     /*
+                      * terminate tunnel and call loops, returning to the
+                      * for(;;) loop (and possibly get the next pid)
+-- 
+2.53.0
+

net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild

@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs tmpfiles
+
+DESCRIPTION="A modern version of the Layer 2 Tunneling Protocol (L2TP) daemon"
+HOMEPAGE="https://github.com/xelerance/xl2tpd"
+SRC_URI="
+	https://github.com/xelerance/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.18-r2-Pass-remotenumber-to-pppd.patch
+	poll? ( https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.20-ditch-select-use-poll-v2.patch )
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+kernel poll"
+
+DEPEND="
+	net-libs/libpcap
+	>=sys-kernel/linux-headers-2.6"
+
+RDEPEND="
+	${DEPEND}
+	net-dialup/ppp"
+
+DOCS=( CREDITS README.md BUGS CHANGES TODO doc/README.patents )
+
+PATCHES=(
+	"${DISTDIR}/xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch"
+	"${FILESDIR}/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch"
+)
+
+src_prepare() {
+	default
+	use poll && eapply "${DISTDIR}/xl2tpd-1.3.20-ditch-select-use-poll-v2.patch"
+	sed -e 's:/var/run/:/run/:' -i \
+		file.h \
+		l2tp.h \
+		xl2tpd-control.c \
+		doc/l2tp-secrets.5 \
+		doc/xl2tpd.8 \
+		doc/xl2tpd.conf.5 \
+		|| die "Error updating /var/run to /run"
+}
+
+src_compile() {
+	tc-export CC
+	local OSFLAGS="-DLINUX"
+	use kernel && OSFLAGS+=" -DUSE_KERNEL"
+	emake OSFLAGS="${OSFLAGS}"
+}
+
+src_install() {
+	emake PREFIX=/usr DESTDIR="${D}" install
+
+	newinitd "${FILESDIR}"/xl2tpd-init-r1 xl2tpd
+
+	systemd_dounit "${FILESDIR}"/xl2tpd.service
+	dotmpfiles "${FILESDIR}"/xl2tpd.conf
+
+	einstalldocs
+
+	insinto /etc/xl2tpd
+	newins doc/l2tpd.conf.sample xl2tpd.conf
+	insopts -m 0600
+	newins doc/l2tp-secrets.sample l2tp-secrets
+}
+
+pkg_postinst() {
+	tmpfiles_process xl2tpd.conf
+}