<html>
<head>
<base href="https://bugzilla.netfilter.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Segfault when resetting rules with meta l4proto { tcp, udp }"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1763#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Segfault when resetting rules with meta l4proto { tcp, udp }"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1763">bug 1763</a>
from <span class="vcard"><a class="email" href="mailto:sly@covertlabs.org" title="sly@covertlabs.org">sly@covertlabs.org</a>
</span></b>
<pre>After looking into this some more, I see `expr_print` is losing reference to
the set when it attempts `ops->print(expr, octx)`.
(gdb) r list ruleset
table ip testsegfault {
chain dns-nat-pre {
type nat hook prerouting priority filter; policy accept;
meta l4proto
Breakpoint 1, expr_print (expr=0x555555560040,
octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
(gdb) bt
#0 expr_print (expr=0x555555560040,
octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1 0x00007ffff7ef5150 in expr_print (
octx=0x55555555c2e8, expr=0x5555555611c0)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2 binop_arg_print (op=<optimized out>,
arg=0x5555555611c0, octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3 0x00007ffff7ee6002 in rule_print (
rule=0x555555560e80, octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491
(gdb) r reset rules
table ip testsegfault {
chain dns-nat-pre {
type nat hook prerouting priority filter; policy accept;
meta l4proto
Breakpoint 1, expr_print (expr=0x0,
octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
(gdb) bt
#0 expr_print (expr=0x0, octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1 0x00007ffff7ef5150 in expr_print (
octx=0x55555555c2e8, expr=0x55555555e020)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2 binop_arg_print (op=<optimized out>,
arg=0x55555555e020, octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3 0x00007ffff7ee6002 in rule_print (
rule=0x55555555dce0, octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491
I also noticed that `nft list ruleset` shows `etype = EXPR_SET` while `nft
reset rules` shows `etype = EXPR_SET_REF` before the reference is lost.
(gdb) r list ruleset
table ip testsegfault {
chain dns-nat-pre {
type nat hook prerouting priority filter; policy accept;
meta l4proto
Breakpoint 1, expr_print (expr=0x555555560040,
octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
(gdb) p expr->etype
$2 = EXPR_SET
(gdb) r reset rules
table ip testsegfault {
chain dns-nat-pre {
type nat hook prerouting priority filter; policy accept;
meta l4proto
Breakpoint 1, expr_print (expr=0x0,
octx=0x55555555c2e8)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
(gdb) f 1
#1 0x00007ffff7ef5150 in expr_print (
octx=0x55555555c2e8, expr=0x55555555e020)
at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
105 in /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c
(gdb) p expr->etype
$3 = EXPR_SET_REF
I have yet to find time to discover why this is only being detected as a set
reference when resetting though. Just started getting familiar with the
codebase.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>