Reproductible PPP bug in 1.2.11

Cristian Gafton (gafton@cccis.sfos.ro)
Wed, 19 Jul 1995 20:59:44 +0300 (EET DST)

Scenario:
Two linux boxes are connecting here two eth-networks. On heavy
transfers one of them (the initiator of the ppp conection) is crashing,
after a short period. I've tryied using 1.2.6-1.2.11 and ppp-2.1.2[b-d].
Still the same errors. FTP transfers between the Linux boxes on the ppp
link work fine, but from any other two computers (also Linux), routed
through ppp link will fail in short time. I think there is a problem with
the buffering code, but I may be wrong. Following I've included the dump
messages from three such situations.

Any clues ?

Cristian Gafton

============================================================================
Unable to handle kernel NULL pointer dereference at virtual address c0000000
current->tss.cr3 = 0084c000, `r3 = 0084c000
*pde = 00102067
*pte = 00000027
Oops: 0002
EIP: 0010:0018e897
EFLAGS: 00010246
eax: 00000000 ebx: 001cabd0 ecx: 000000ff edx: 00000007
esi: 0000000f edi: 00010b41 ebp: 00000010 esp: 00bdef44
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process pppd (pid: 2759, process nr: 35, stackpage=00bde000)
Stack: 00836000 000770e0 00436cf0 00010b40 001337ff 00174f34 00836000 00436cf0
00010b40 00000010 00436cf0 000770e0 00000010 00126118 000770e0 00436cf0
00010b40 00000010 00207000 00010b40 00010910 bffffc14 0011ddb2 00000000
Call Trace: 001337ff 00174f34 00126118 0011ddb2 001106a5 00110721
Code: 88 08 ff 43 68 66 8b 53 38 66 c1 ea 08 8a 44 24 10 32 43 38

call info:
0018e300 t _ppp_read
0018e6a0 t _ppp_write
0018ebd0 t _ppp_ioctl
==========================================================================

general protection: 0000
EIP: 0010:0018d6aa
EFLAGS: 00010206
eax: f000e3d4 ebx: 00000014 ecx: 00661930 edx: 00000000
esi: 001cabd0 edi: 00010b50 ebp: 00000010 esp: 00cfef24
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process pppd (pid: 2956, process nr: 36, stackpage=00cfe000)
Stack: 00000000 00000000 00000000 00000014 001cabd0 ffffffff 0018e939 001cabd0
0040b000 00a4ca80 00436b10 00010b40 0013379a 00174f34 0040b000 00436b10
00010b40 00000010 00436b10 00a4ca80 00000010 00126118 00a4ca80 00436b10
Call Trace: 0018e939 0013379a 00174f34 00126118 0011d562 00110721
Code: ff d0 01 86 b8 00 00 00 83 c4 10 39 d8 75 37 56 e8 51 29 00

call info
0018d610 t _ppp_dev_ioctl
0018d690 t _ppp_kick_tty
0018d740 t _ppp_write_wakeup
==========================================================================

general protection: 0000
EIP: 0010:0018d6aa
EFLAGS: 00010206
eax: f000e3d4 ebx: 00000014 ecx: 006a1467 edx: 00000000
esi: 001caaf0 edi: 00010b60 ebp: 00000010 esp: 0070df24
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process pppd (pid: 3254, process nr: 34, stackpage=0070d000)
Stack: 00000000 00000000 00000000 00000014 001caaf0 ffffffff 0018e939 001caaf0
00b77000 00afe8c0 00436b10 00010b50 00133716 00174f34 00b77000 00436b10
00010b50 00000010 00436b10 00afe8c0 00000010 00126118 00afe8c0 00436b10
Call Trace: 0018e939 00133716 00174f34 00126118 0011ddb2 001106a5 00110721
Code: ff d0 01 86 b8 00 00 00 83 c4 10 39 d8 75 37 56 e8 51 29 00

call info:
0018d610 t _ppp_dev_ioctl
0018d690 t _ppp_kick_tty
0018d740 t _ppp_write_wakeup
=============================================================================