Bug#347711: kernel: linux-image-2.6.15-1-amd64-generic panics when pppd is run

[Richard Frith-Macdonald <richard@brainstorm.co.uk>]

Package: kernel
Severity: normal


When I start pppd to tunnel over ssh for a vpn, the kernel panics and
the pppd process is killed.

Partial dmesg output follows ...


CSLIP: code copyright 1989 Regents of the University of California
PPP generic driver version 2.4.2
skb_over_panic: text:ffffffff88205ce1 len:1 put:1 head:ffff810050012800 data:ffff810150012800 tail:ffff810150012801 end:ffff810050012e00 dev:<NULL>
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at net/core/skbuff.c:94
invalid operand: 0000 [1] 
CPU 0 
Modules linked in: ppp_async crc_ccitt ppp_generic slhc videodev ipv6 parport_pc parport floppy pcspkr tg3 i2c_i801 i2c_core piix generic hw_random ehci_hcd uhci_hcd snd_hda_intel snd_hda_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc shpchp pci_hotplug tsdev psmouse ide_generic ide_disk ide_cd cdrom ide_core jfs raid1 md_mod sd_mod ahci libata scsi_mod evdev
Pid: 5269, comm: ssh Not tainted 2.6.15-1-amd64-generic #1
RIP: 0010:[<ffffffff8024f333>] <ffffffff8024f333>{skb_over_panic+75}
RSP: 0018:ffff8100568fdd98  EFLAGS: 00010096
RAX: 000000000000009a RBX: ffff810150012800 RCX: ffffffff80314f90
RDX: ffffffff80314f90 RSI: 0000000000000001 RDI: ffff81005d974750
RBP: ffff81005828e800 R08: 0000000000000000 R09: ffff81005dbe1cc0
R10: 0000000000000010 R11: 0000000000000010 R12: 0000000000000000
R13: ffff810046132c01 R14: 0000000000000001 R15: 000000000000002c
FS:  00002aaaabf13d10(0000) GS:ffffffff803c8800(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fffffc2aa28 CR3: 000000004e87b000 CR4: 00000000000006e0
Process ssh (pid: 5269, threadinfo ffff8100568fc000, task ffff810052f20990)
Stack: ffff810150012801 ffff810050012e00 ffffffff802d5e94 ffff810150012801 
       ffff810150012801 ffffffff88205ce9 0000000000000040 ffff810045d71000 
       0000000000000202 000000000000002d 
Call Trace:<ffffffff88205ce9>{:ppp_async:ppp_asynctty_receive+496}
       <ffffffff8021983b>{pty_write+68} <ffffffff802176bc>{write_chan+698}
       <ffffffff80129f0d>{default_wake_function+0} <ffffffff801751a1>{__pollwait+0}
       <ffffffff802143c3>{tty_write+399} <ffffffff80217402>{write_chan+0}
       <ffffffff80165189>{vfs_write+203} <ffffffff80165a67>{sys_write+69}
       <ffffffff8010e4ba>{system_call+126} 

Code: 0f 0b 68 14 2f 2e 80 c2 5e 00 48 83 c4 28 c3 51 49 89 d2 48 
RIP <ffffffff8024f333>{skb_over_panic+75} RSP <ffff8100568fdd98>
 <1>Unable to handle kernel paging request at ffff81005dac2100 RIP: 
[<ffff81005dac2100>]
PGD 8063 PUD a063 PMD 800000005da001e3 PTE 10247c894804c783
Oops: 0011 [2] 
CPU 0 
Modules linked in: ppp_async crc_ccitt ppp_generic slhc videodev ipv6 parport_pc parport floppy pcspkr tg3 i2c_i801 i2c_core piix generic hw_random ehci_hcd uhci_hcd snd_hda_intel snd_hda_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc shpchp pci_hotplug tsdev psmouse ide_generic ide_disk ide_cd cdrom ide_core jfs raid1 md_mod sd_mod ahci libata scsi_mod evdev
Pid: 5268, comm: su Not tainted 2.6.15-1-amd64-generic #1
RIP: 0010:[<ffff81005dac2100>] [<ffff81005dac2100>]
RSP: 0018:ffff81004dbb1d50  EFLAGS: 00010006
RAX: ffff8100568fde70 RBX: 00000000568fde78 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8100568fde58
RBP: ffff81004dbb1d88 R08: 0000000000000000 R09: 0000000000000010
R10: ffff81005f78b8e8 R11: ffff81005f78b8e8 R12: ffff810052f20990
R13: 0000000000000001 R14: ffff8100536ee9e0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffffffff803c8800(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff81005dac2100 CR3: 000000004dba3000 CR4: 00000000000006e0
Process su (pid: 5268, threadinfo ffff81004dbb0000, task ffff81005d8258f0)
Stack: ffffffff80129544 0000000100000000 0000000000000246 ffff81005db5dbe0 
       0000000000000005 ffff810052f4e3c0 0000000000000001 ffff81004dbb1da8 
       ffffffff80129580 ffff81005f78b8e8 
Call Trace:<ffffffff80129544>{__wake_up_common+57} <ffffffff80129580>{__wake_up+20}
       <ffffffff80219984>{pty_close+111} <ffffffff8021609e>{release_dev+538}
       <ffffffff8015691a>{free_pgd_range+824} <ffffffff802168cd>{tty_release+9}
       <ffffffff80165e71>{__fput+155} <ffffffff80163913>{filp_close+89}
       <ffffffff8012db08>{put_files_struct+106} <ffffffff8012e8da>{do_exit+583}
       <ffffffff8012f239>{sys_exit_group+0} <ffffffff8010e4ba>{system_call+126}
       

Code: 00 00 00 00 00 00 00 00 00 00 76 5d 00 81 ff ff 07 00 00 00 
RIP [<ffff81005dac2100>] RSP <ffff81004dbb1d50>
CR2: ffff81005dac2100
 <1>Fixing recursive fault but reboot is needed!

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.15-1-amd64-generic
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)