Re: PaX killing conntrackd (strange "execution attempt")

[Wolfram Schlich <lists@wolfram.schlich.org>]

* Pablo Neira Ayuso <pablo@netfilter.org> [2008-11-17 13:29]:
> pageexec@freemail.hu wrote:
>> [...]
>> so that's a null function pointer in whatever structure __build_protoinfo 
>> dereferences
>> there. is it of any help to you or do you need me to dig out more?
>
> Hm, that code belongs to libnetfilter_conntrack (src/conntrack/build.c). 
> The annoying thing is that I see no structure with function pointers in 
> that piece of bits. There are only calls to libnfnetlink functions to build 
> the netlink message that is sent to kernel-space.
>
> @Wolfram: that code is only reachable during a fail-over - ie. when the 
> external cache commits the entries or if you have CacheWriteThrough enabled 
> (you shouldn't unless you know what you're doing). I'm telling this because 
> otherwise I don't see a way to reach that code - considering the posibility 
> of having a memory corruption so that this backtrace becomes useless.

Hmm. There was definitely no fail-over at that time and I didn't
enable CacheWriteThrough either.
But I got a second coredump from the second firewall machine which
I already sent to the PaX team -- maybe the analysis of that one
shows different results. I guess we should wait for this one before
thinking about possible causes.

@PaX team: did you already have time to look at the second coredump?
-- 
Regards,
Wolfram Schlich <wschlich@gentoo.org>
Gentoo Linux * http://dev.gentoo.org/~wschlich/