[Bug 1763] Segfault when resetting rules with meta l4proto { tcp, udp }

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

--- Comment #2 from sly at covertlabs.org ---
After looking into this some more, I see `expr_print` is losing reference to
the set when it attempts `ops->print(expr, octx)`.

(gdb) r list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) bt
#0  expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x5555555611c0)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2  binop_arg_print (op=<optimized out>, 
    arg=0x5555555611c0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3  0x00007ffff7ee6002 in rule_print (
    rule=0x555555560e80, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491



(gdb) r reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x0, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) bt
#0  expr_print (expr=0x0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x55555555e020)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2  binop_arg_print (op=<optimized out>, 
    arg=0x55555555e020, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3  0x00007ffff7ee6002 in rule_print (
    rule=0x55555555dce0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491



I also noticed that `nft list ruleset` shows `etype = EXPR_SET` while `nft
reset rules` shows `etype = EXPR_SET_REF` before the reference is lost.

(gdb) r list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) p expr->etype
$2 = EXPR_SET



(gdb) r reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x0, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) f 1
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x55555555e020)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
105     in /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c

(gdb) p expr->etype
$3 = EXPR_SET_REF



I have yet to find time to discover why this is only being detected as a set
reference when resetting though. Just started getting familiar with the
codebase.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240806/e803e42a/attachment.html>