[Bug 1445] New: conntrackd: segfaults when not disabling internal cache

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1445

            Bug ID: 1445
           Summary: conntrackd: segfaults when not disabling internal
                    cache
           Product: conntrack-tools
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: critical
          Priority: P5
         Component: conntrack-daemon
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: arturo at netfilter.org

Original bug report: https://bugs.debian.org/965021

Using a config file like this makes conntrackd segfault at startup:

=== 8< ===
Sync {
    Mode NOTRACK {
        # DisableInternalCache on
        DisableExternalCache on
    }
    Multicast {
        IPv4_address 225.0.0.50
        Group 3780
        IPv4_interface 10.10.73.3
        Interface vl-asta
        SndSocketBuffer 1249280
        RcvSocketBuffer 1249280
        Checksum on
    }
    Options {
        # TCPWindowTracking On
        # ExpectationSync On
    }
}
General {
    Systemd on
    # HashLimit 524288
    LogFile on
    Syslog on
    LockFile /var/lock/conntrackd.lock
    UNIX {
        Path /var/run/conntrackd.sock
    }
    NetlinkBufferSize 2097152
    NetlinkBufferSizeMaxGrowth 8388608
    Filter From Userspace {
        Address Ignore {
            IPv4_address 127.0.0.0/8
        }
    }
}
=== 8< ====

sudo valgrind /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf
==11028== Memcheck, a memory error detector
==11028== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==11028== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==11028== Command: /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf
==11028== 
[Fri Jul 24 12:46:15 2020] (pid=11028) [notice] disabling external cache
==11028== Invalid read of size 8
==11028==    at 0x1135B8: hashtable_find (hash.c:72)
==11028==    by 0x1184E8: cache_update_force (cache.c:279)
==11028==    by 0x11A547: dump_handler (ctnl.c:266)
==11028==    by 0x11A547: dump_handler (ctnl.c:257)
==11028==    by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028==    by 0x1134A4: init (run.c:301)
==11028==    by 0x111FBD: main (main.c:366)
==11028==  Address 0x50e17c0 is 0 bytes after a block of size 32 alloc'd
==11028==    at 0x483AB65: calloc (vg_replace_malloc.c:760)
==11028==    by 0x113517: hashtable_create (hash.c:39)
==11028==    by 0x117FD1: cache_create (cache.c:102)
==11028==    by 0x121A36: internal_cache_init (internal_cache.c:26)
==11028==    by 0x11AF4C: init_sync (sync-mode.c:396)
==11028==    by 0x11A6BA: ctnl_init (ctnl.c:414)
==11028==    by 0x1134A4: init (run.c:301)
==11028==    by 0x111FBD: main (main.c:366)
==11028== 
==11028== Invalid read of size 8
==11028==    at 0x118D2F: cache_ct_cmp (cache-ct.c:104)
==11028==    by 0x1135E1: hashtable_find (hash.c:74)
==11028==    by 0x1184E8: cache_update_force (cache.c:279)
==11028==    by 0x11A547: dump_handler (ctnl.c:266)
==11028==    by 0x11A547: dump_handler (ctnl.c:257)
==11028==    by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028==    by 0x1134A4: init (run.c:301)
==11028==    by 0x111FBD: main (main.c:366)
==11028==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==11028== 
==11028== 
==11028== Process terminating with default action of signal 11 (SIGSEGV)
==11028==  Access not within mapped region at address 0x10
==11028==    at 0x118D2F: cache_ct_cmp (cache-ct.c:104)
==11028==    by 0x1135E1: hashtable_find (hash.c:74)
==11028==    by 0x1184E8: cache_update_force (cache.c:279)
==11028==    by 0x11A547: dump_handler (ctnl.c:266)
==11028==    by 0x11A547: dump_handler (ctnl.c:257)
==11028==    by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028==    by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028==    by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028==    by 0x1134A4: init (run.c:301)
==11028==    by 0x111FBD: main (main.c:366)


This happens with conntrackd 1.4.6 and kernel 5.7.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200724/3b15f48d/attachment-0001.html>