[nft] segfault in expr_clone()

[nft] segfault in expr_clone()

[Arturo Borrero Gonzalez]

Hi,

debian users are reporting [0] a segfault related to expr_clone().

Is this the issue fixed by Florian's patch [1] ?

In concrete, this is the backtrace:

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000040a9ad in expr_clone (expr=expr@entry=0x6549b0) at
expression.c:51
#2  0x000000000040ab08 in compound_expr_clone (new=0x65e500,
expr=0x654a40) at expression.c:656
#3  0x000000000040a9ad in expr_clone (expr=0x654a40) at expression.c:51
#4  0x000000000040c7ff in expr_evaluate_symbol (expr=<optimized out>,
ctx=<optimized out>) at evaluate.c:183
#5  expr_evaluate (ctx=0x7fffffffe9e8, expr=0x6569d8) at evaluate.c:1074
#6  0x000000000040c20f in expr_evaluate_relational (expr=<optimized
out>, ctx=<optimized out>) at evaluate.c:891
#7  expr_evaluate (ctx=0x7fffffffe9e8, expr=0x656a48) at evaluate.c:1108
#8  0x000000000040dd6c in stmt_evaluate_expr (stmt=0x656a00,
ctx=0x7fffffffe9e8) at evaluate.c:1117
#9  stmt_evaluate (ctx=ctx@entry=0x7fffffffe9e8,
stmt=stmt@entry=0x656a00) at evaluate.c:1688
#10 0x000000000040e43f in rule_evaluate (ctx=0x7fffffffe9e8,
rule=0x656b70) at evaluate.c:1816
#11 0x000000000040e5f7 in chain_evaluate
(ctx=ctx@entry=0x7fffffffe9e8, chain=chain@entry=0x655c90) at
evaluate.c:1901
#12 0x000000000040ec2f in table_evaluate (table=0x655690,
ctx=0x7fffffffe9e8) at evaluate.c:1933
#13 cmd_evaluate_add (cmd=<optimized out>, ctx=0x7fffffffe9e8) at
evaluate.c:1954
#14 cmd_evaluate (ctx=0x7fffffffe9e8, cmd=<optimized out>) at evaluate.c:2112
#15 0x0000000000425b05 in nft_parse (scanner=scanner@entry=0x6504b0,
state=state@entry=0x7fffffffe400) at parser_bison.y:566
#16 0x00000000004062ed in nft_run (scanner=scanner@entry=0x6504b0,
state=state@entry=0x7fffffffe400, msgs=msgs@entry=0x7fffffffe3f0) at
main.c:231
#17 0x0000000000405f50 in main (argc=<optimized out>, argv=<optimized
out>) at main.c:357

thanks, best regards.

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801087
[1] http://patchwork.ozlabs.org/patch/524679/
-- 
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [nft] segfault in expr_clone()

[Arturo Borrero Gonzalez]

On 6 October 2015 at 10:48, Arturo Borrero Gonzalez
<arturo.borrero.glez@gmail.com> wrote:
> Hi,
>
> debian users are reporting [0] a segfault related to expr_clone().
>
> Is this the issue fixed by Florian's patch [1] ?

Ok, I've checked myself. Florian's patch address the issue.

regards.
-- 
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [nft] segfault in expr_clone()

[Pablo Neira Ayuso]

On Tue, Oct 06, 2015 at 10:58:08AM +0200, Arturo Borrero Gonzalez wrote:
> On 6 October 2015 at 10:48, Arturo Borrero Gonzalez
> <arturo.borrero.glez@gmail.com> wrote:
> > Hi,
> >
> > debian users are reporting [0] a segfault related to expr_clone().
> >
> > Is this the issue fixed by Florian's patch [1] ?
> 
> Ok, I've checked myself. Florian's patch address the issue.

Florian, please push out this fix.

I would like to have a closer look to the inet/ether conflicts.

Thanks!

Re: [nft] segfault in expr_clone()

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Tue, Oct 06, 2015 at 10:58:08AM +0200, Arturo Borrero Gonzalez wrote:
> > On 6 October 2015 at 10:48, Arturo Borrero Gonzalez
> > <arturo.borrero.glez@gmail.com> wrote:
> > > Hi,
> > >
> > > debian users are reporting [0] a segfault related to expr_clone().
> > >
> > > Is this the issue fixed by Florian's patch [1] ?
> > 
> > Ok, I've checked myself. Florian's patch address the issue.
> 
> Florian, please push out this fix.

pushed and marked accepted in patchwork.