From a7950c9a1e2ebac69aa13c07eac0e2d0ff632fa2 Mon Sep 17 00:00:00 2001 From: Jaco Kroon Date: Mon, 22 Jun 2026 16:33:49 +0200 Subject: [PATCH] net-dialup/xl2tpd: 1.3.20-r2 - fix a few use-after-free issues Firstly, upstream bug PR at https://github.com/xelerance/xl2tpd/pull/288 (link also in patch). This is very unlikely to cause crashes or anything, so not critical stable. Then an update on the large patch for using poll instead of select: Effective diff at: https://github.com/xelerance/xl2tpd/compare/bfc2730bc17d9a03033b085d38dd2fae691888ce..0bca596a73220c798c43c9b49fa34244a53f9f8e This one does cause crashes, however, even I only use this patch in one single location - so hopefully this won't affect too many people. If you are using xl2tpd with USE=poll and seeing random segfaults - try updating. Signed-off-by: Jaco Kroon --- net-dialup/xl2tpd/Manifest | 1 + ...-Fix-use-after-free-in-child_handler.patch | 64 ++++++++++++++++ net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild | 74 +++++++++++++++++++ 3 files changed, 139 insertions(+) create mode 100644 net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch create mode 100644 net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild diff --git a/net-dialup/xl2tpd/Manifest b/net-dialup/xl2tpd/Manifest index b109b79e685d3..b30dd6056150b 100644 --- a/net-dialup/xl2tpd/Manifest +++ b/net-dialup/xl2tpd/Manifest @@ -1,3 +1,4 @@ DIST xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch 4074 BLAKE2B d1566a22c51dfc448df41424722571206dbedb36b48bafe19a629b5c0c3eadce17a899d387c5aa241f4367cbfef86f09322f4a7dd429eeb1fd82539a81f7aa76 SHA512 8a10ddfbb6998a4caeaf8a55334d5e4a3fdbe10e0b71652699fda5bb27cd8f1e0b88c7dd50fb95cea3385353b91a4d9208003e436cc3d4e8023828a80cbbeb19 +DIST xl2tpd-1.3.20-ditch-select-use-poll-v2.patch 24434 BLAKE2B fdcea3f34c0d7fd9a1ce9934eda825a89d20a9c7254247fd9e55e68f26a3ea3870919b292966a10967e2ebcaed253ade01d90e88d567d8b6a432b2a99ae1d5dc SHA512 86c3151adab74ffc89ac55b15d728632ac41fe2db7e2767ed6f80dd5627fef55c1d3c44aac844e5403d8f5f5afd8069e3d2b648494b52264c4f4cf5163396533 DIST xl2tpd-1.3.20-ditch-select-use-poll.patch 24347 BLAKE2B 8a13a52fb64a8135ccb4ccb618039c9345cccc28f31c08c58349e98b739994c7eddbfa629d1d4c79646e2060aef4cf1331ee57864413f16e105edd275768ce8b SHA512 bcfe9d0f90b8332078221e921307ca111eb3b0ed5c6b11716fc13f5bf9223ea58a667d46f38f8fdc3d062f596533da8550e5fb9312f0b6fefd9f799bf2a21407 DIST xl2tpd-1.3.20.tar.gz 537558 BLAKE2B 98a5c0c6884aa77fe277ffc8a2310a472d5a5db86d39a4ae7da9f97eed53e033b6680a683b1bb52433320711f966ec1f3f02174ce15fbe52fb88d8287a1f8231 SHA512 d227e1dafbb1d7ca64d42084397eaf013f89958bc705d602ca9717e355b2a420756ccbf71663f920b44a6624411a59bf52fd039ba50a7d45a976e9af03ed4dc5 diff --git a/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch b/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch new file mode 100644 index 0000000000000..8add2c8a0f58f --- /dev/null +++ b/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch @@ -0,0 +1,64 @@ +https://github.com/xelerance/xl2tpd/pull/288 +From 0bfd157fe69996a64b7a48dff4b92d6604cbb560 Mon Sep 17 00:00:00 2001 +From: Jaco Kroon +Date: Mon, 22 Jun 2026 12:35:49 +0200 +Subject: [PATCH] xl2tpd: Fix use-after-free in child_handler. + +==12749== Invalid write of size 4 +==12749== at 0x4004D42: child_handler (xl2tpd.c:293) +==12749== by 0x4004D42: process_signal (xl2tpd.c:386) +==12749== by 0x400C843: network_thread (network.c:697) +==12749== by 0x4002A66: main (xl2tpd.c:1946) +==12749== Address 0x56bb9a0 is 480 bytes inside a block of size 4,944 free'd +==12749== at 0x486496F: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) +==12749== by 0x4004D41: child_handler (xl2tpd.c:290) +==12749== by 0x4004D41: process_signal (xl2tpd.c:386) +==12749== by 0x400C843: network_thread (network.c:697) +==12749== by 0x4002A66: main (xl2tpd.c:1946) +==12749== Block was alloc'd at +==12749== at 0x48692B3: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) +==12749== by 0x400B825: new_call (call.c:495) +==12749== by 0x4009020: message_type_avp (avp.c:323) +==12749== by 0x400AF76: handle_avps (avp.c:1771) +==12749== by 0x40085E3: handle_control (control.c:1822) +==12749== by 0x40085E3: handle_packet (control.c:1841) +==12749== by 0x400BEB1: network_thread_process_socket (network.c:617) +==12749== by 0x400C9F2: network_thread (network.c:761) +==12749== by 0x4002A66: main (xl2tpd.c:1946) +==12749== + +When using kernel mode this call call_close, which will already +close(c->fd) if >0 and destroy_call is actually called, including +setting c->fd = -1. + +Further to be noted is that call_close could thus free() the relevant +memory, resulting in this error. + +Bottom line: We only need to set c->fd = -1 if we're the function closing the fd(). + +Signed-off-by: Jaco Kroon +--- + xl2tpd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/xl2tpd.c b/xl2tpd.c +index cbf2e22..c1544f8 100644 +--- a/xl2tpd.c ++++ b/xl2tpd.c +@@ -285,12 +285,12 @@ static void child_handler (int sig) + + #endif + close (c->fd); ++ c->fd = -1; + #ifdef USE_KERNEL + } else { + call_close (c); + } + #endif +- c->fd = -1; + /* + * terminate tunnel and call loops, returning to the + * for(;;) loop (and possibly get the next pid) +-- +2.53.0 + diff --git a/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild b/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild new file mode 100644 index 0000000000000..f54de52f3f230 --- /dev/null +++ b/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild @@ -0,0 +1,74 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit systemd toolchain-funcs tmpfiles + +DESCRIPTION="A modern version of the Layer 2 Tunneling Protocol (L2TP) daemon" +HOMEPAGE="https://github.com/xelerance/xl2tpd" +SRC_URI=" + https://github.com/xelerance/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz + https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.18-r2-Pass-remotenumber-to-pppd.patch + poll? ( https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.20-ditch-select-use-poll-v2.patch ) +" + +LICENSE="GPL-2+" +SLOT="0" +KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86" +IUSE="+kernel poll" + +DEPEND=" + net-libs/libpcap + >=sys-kernel/linux-headers-2.6" + +RDEPEND=" + ${DEPEND} + net-dialup/ppp" + +DOCS=( CREDITS README.md BUGS CHANGES TODO doc/README.patents ) + +PATCHES=( + "${DISTDIR}/xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch" + "${FILESDIR}/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch" +) + +src_prepare() { + default + use poll && eapply "${DISTDIR}/xl2tpd-1.3.20-ditch-select-use-poll-v2.patch" + sed -e 's:/var/run/:/run/:' -i \ + file.h \ + l2tp.h \ + xl2tpd-control.c \ + doc/l2tp-secrets.5 \ + doc/xl2tpd.8 \ + doc/xl2tpd.conf.5 \ + || die "Error updating /var/run to /run" +} + +src_compile() { + tc-export CC + local OSFLAGS="-DLINUX" + use kernel && OSFLAGS+=" -DUSE_KERNEL" + emake OSFLAGS="${OSFLAGS}" +} + +src_install() { + emake PREFIX=/usr DESTDIR="${D}" install + + newinitd "${FILESDIR}"/xl2tpd-init-r1 xl2tpd + + systemd_dounit "${FILESDIR}"/xl2tpd.service + dotmpfiles "${FILESDIR}"/xl2tpd.conf + + einstalldocs + + insinto /etc/xl2tpd + newins doc/l2tpd.conf.sample xl2tpd.conf + insopts -m 0600 + newins doc/l2tp-secrets.sample l2tp-secrets +} + +pkg_postinst() { + tmpfiles_process xl2tpd.conf +}