From owner-freebsd-bugs  Sat Mar 16  0:20:15 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 4029337B404
	for <freebsd-bugs@hub.freebsd.org>; Sat, 16 Mar 2002 00:20:01 -0800 (PST)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g2G8K1538162;
	Sat, 16 Mar 2002 00:20:01 -0800 (PST)
	(envelope-from gnats)
Received: from D00015.dialonly.kemerovo.su (D00015.dialonly.kemerovo.su [213.184.66.105])
	by hub.freebsd.org (Postfix) with ESMTP id 60B9D37B496
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 16 Mar 2002 00:11:52 -0800 (PST)
Received: (from eugen@localhost)
	by D00015.dialonly.kemerovo.su (8.11.6/8.11.6) id g2G880k17109;
	Sat, 16 Mar 2002 15:08:00 +0700 (KRAT)
	(envelope-from eugen)
Message-Id: <200203160808.g2G880k17109@D00015.dialonly.kemerovo.su>
Date: Sat, 16 Mar 2002 15:08:00 +0700 (KRAT)
From: Eugene Grosbein <eugen@grosbein.pp.ru>
Reply-To: Eugene Grosbein <eugen@grosbein.pp.ru>
To: FreeBSD-gnats-submit@FreeBSD.org
X-Send-Pr-Version: 3.113
Subject: kern/35969: kernel option PPP_DEFLATE often procudes kernel panics; PPP_BSDCOMP sometimes procudes stalled connections
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         35969
>Category:       kern
>Synopsis:       kernel option PPP_DEFLATE often procudes kernel panics; PPP_BSDCOMP sometimes procudes stalled connections
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 16 00:20:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Eugene Grosbein
>Release:        FreeBSD 4.5-STABLE i386
>Organization:
Svyaz Service
>Environment:
System: FreeBSD D00015.dialonly.kemerovo.su 4.5-STABLE FreeBSD 4.5-STABLE #4: Sat Mar 9 13:41:04 KRAT 2002 eu@D00015.dialonly.kemerovo.su:/usr/local/obj/usr/local/src/sys/DADV i386
	
	pseudo-device ppp 2
	options	PPP_DEFLATE
	options	PPP_BSDCOMP
	options	PPP_FILTER

>Description:
	
	Using pppd with compression 'deflate' produces kernel panics
	with 4.5-STABLE at least after 1 March 2002.
	Some investigation performed by Kirk McKusick shows
	corription of kernel structures. 
	
	4.5-RELEASE doesn't have this problem. 
	Really the problem appeared much later but I can't say exact date.

>How-To-Repeat:
	
	1. Build kernel with 
	
	pseudo-device ppp 2
	options	PPP_DEFLATE
	options	PPP_BSDCOMP
	options	PPP_FILTER

	For debugging purposes, add 
	
	makeoptions DEBUG=-g
	options		DDB

	and enable creating of crashdumps via /etc/rc.conf (dumpdev parameter)

	2. Create user 'pppuser' with shell '/usr/sbin/pppd', group dialer,
	   create empty ~pppuser/.hushlogin, empty /etc/ppp/options and say:
	
	# cat >~pppuser/.ppprc <<EOF
	local
	-crtscts
	172.20.0.1:172.20.0.2
	EOF

	3. The problem was first discovered with dialin service,
	so you can attach an analog modem with phone line and dial 
	to the system. Use client supporting 'deflate' compression method.
	Make some traffic and you'll get some kind of kernel panic shortly.

	I've found that there is no need to use hardware modem to trigger
	this bug. It's can be shown even with tunnelling 
	PPP over TCP connection via loopback.

	I personally used this small helper to make connection
	pppd <-> pppd over rlogin TCP stream:

#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <limits.h>
#include <stdio.h>
#include <libutil.h>

int main(int argc, char* argv[])
{
    char *me=argv[0];
    char ptyname[PATH_MAX];
    int master;
    
    ++argv; --argc;
    if(argc<1) {
	fprintf(stderr,"usage: %s command [params]\n",me);
	exit(1);
    }
    
    switch(forkpty(&master,ptyname,NULL,NULL)) {
    case -1:	/* failure */
	    fprintf(stderr,"%s: cannot forkpty: %s\n",me,strerror(errno));
	    exit(1);
    case  0:	/* slave, new pty - running process*/
	    execlp("/usr/sbin/pppd","/usr/sbin/pppd",NULL);
	    _exit(1);
	    /* NOT REACHED */
    default:	/* master */
	    dup2(master, 0);
	    dup2(master, 1);
	    dup2(master, 2);
	    if (master > 2) close(master);
	    execvp(*argv,argv);
    }
    return 1;
}

/* END OF FILE */

	Compile this: cc runatpty.c -o runatpty -lutil
	Then enable 'rlogin' in /etc/inetd.conf and say:

	# echo 'localhost +' > ~pppuser/.rhosts
	# chown pppuser ~pppuser/.rhosts
	# chmod 600 ~pppuser/.rhosts

	Test your settings using 'rlogin -8E -l pppuser localhost'.
	You should be able to login without password and see pppd
	trying to talk PPP with you. It will timeout and fail.
	Now say:
	
	# ./runatpty rlogin -8E -l pppuser localhost
	
	It will not go background, leave it run. You should have two
	up and running ppp interfaces - both sides of PPP connection
	over rlogin TCP stream. Try using it, make some traffic
	and you'll get kernel panic.

>Fix:

	Unknown for me.
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message