pppd crashes with SIGILL during PPPoE connection

[filippocarletti]

PPPoE connection to some ISPs fails because pppd crashes with Fatal signal 4 (SIGILL) during LCP negotiation.

Compiling pppd with debug symbols shows the crash happens in memcpy() called from lcp_reqci() while processing a long list of LCP options. Disabling FORTIFY_SOURCE allows the connection to succeed.

Steps to reproduce

• Configure a PPPoE interface to connect to the ISP.
• Observe logs

Expected behavior

• pppd completes LCP negotiation and establishes the PPPoE connection successfully.

Actual behavior

• pppd crashes with Fatal signal 4 during LCP negotiation and the interface is torn down.

Relevant logs:

daemon.notice netifd: Interface 'eolo' is setting up now
daemon.info pppd[11758]: Plugin pppoe.so loaded.
daemon.info pppd[11758]: PPPoE plugin from pppd 2.5.2
daemon.notice pppd[11758]: pppd 2.5.2 started by root, uid 0
daemon.info pppd[11758]: PPP session is 56000
daemon.warn pppd[11758]: Connected to 52:54:00:93:DC:01 via interface eth2
daemon.info pppd[11758]: Using interface pppoe-eolo
daemon.notice pppd[11758]: Connect: pppoe-eolo <--> eth2
daemon.err pppd[11758]: Fatal signal 4
daemon.info pppd[11758]: Exit.

GDB backtrace:

Program received signal SIGILL, Illegal instruction.
memcpy (...)
    at .../include/fortify/string.h:50
(gdb) bt
#0  memcpy (...)
    at .../include/fortify/string.h:50
#1  lcp_reqci (...)
    at .../pppd/lcp.c:1804

Disabling FORTIFY_SOURCE and rebuilding pppd avoids the crash. In this case, the first LCP options packet is rejected and the ISP retries with a different set of options; the connection then reaches the connected state and remains stable.

See also

ppp-project/ppp#576