bugzilla-daemon at netfilter.org
2020-Jul-24 10:49 UTC
[Bug 1445] New: conntrackd: segfaults when not disabling internal cache
https://bugzilla.netfilter.org/show_bug.cgi?id=1445
Bug ID: 1445
Summary: conntrackd: segfaults when not disabling internal
cache
Product: conntrack-tools
Version: unspecified
Hardware: x86_64
OS: Debian GNU/Linux
Status: NEW
Severity: critical
Priority: P5
Component: conntrack-daemon
Assignee: netfilter-buglog at lists.netfilter.org
Reporter: arturo at netfilter.org
Original bug report: https://bugs.debian.org/965021
Using a config file like this makes conntrackd segfault at startup:
=== 8< ==Sync {
Mode NOTRACK {
# DisableInternalCache on
DisableExternalCache on
}
Multicast {
IPv4_address 225.0.0.50
Group 3780
IPv4_interface 10.10.73.3
Interface vl-asta
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Options {
# TCPWindowTracking On
# ExpectationSync On
}
}
General {
Systemd on
# HashLimit 524288
LogFile on
Syslog on
LockFile /var/lock/conntrackd.lock
UNIX {
Path /var/run/conntrackd.sock
}
NetlinkBufferSize 2097152
NetlinkBufferSizeMaxGrowth 8388608
Filter From Userspace {
Address Ignore {
IPv4_address 127.0.0.0/8
}
}
}
=== 8< ===
sudo valgrind /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf
==11028== Memcheck, a memory error detector
==11028== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==11028== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==11028== Command: /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf
==11028==
[Fri Jul 24 12:46:15 2020] (pid=11028) [notice] disabling external cache
==11028== Invalid read of size 8
==11028== at 0x1135B8: hashtable_find (hash.c:72)
==11028== by 0x1184E8: cache_update_force (cache.c:279)
==11028== by 0x11A547: dump_handler (ctnl.c:266)
==11028== by 0x11A547: dump_handler (ctnl.c:257)
==11028== by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028== by 0x1134A4: init (run.c:301)
==11028== by 0x111FBD: main (main.c:366)
==11028== Address 0x50e17c0 is 0 bytes after a block of size 32 alloc'd
==11028== at 0x483AB65: calloc (vg_replace_malloc.c:760)
==11028== by 0x113517: hashtable_create (hash.c:39)
==11028== by 0x117FD1: cache_create (cache.c:102)
==11028== by 0x121A36: internal_cache_init (internal_cache.c:26)
==11028== by 0x11AF4C: init_sync (sync-mode.c:396)
==11028== by 0x11A6BA: ctnl_init (ctnl.c:414)
==11028== by 0x1134A4: init (run.c:301)
==11028== by 0x111FBD: main (main.c:366)
==11028==
==11028== Invalid read of size 8
==11028== at 0x118D2F: cache_ct_cmp (cache-ct.c:104)
==11028== by 0x1135E1: hashtable_find (hash.c:74)
==11028== by 0x1184E8: cache_update_force (cache.c:279)
==11028== by 0x11A547: dump_handler (ctnl.c:266)
==11028== by 0x11A547: dump_handler (ctnl.c:257)
==11028== by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028== by 0x1134A4: init (run.c:301)
==11028== by 0x111FBD: main (main.c:366)
==11028== Address 0x10 is not stack'd, malloc'd or (recently)
free'd
==11028==
==11028==
==11028== Process terminating with default action of signal 11 (SIGSEGV)
==11028== Access not within mapped region at address 0x10
==11028== at 0x118D2F: cache_ct_cmp (cache-ct.c:104)
==11028== by 0x1135E1: hashtable_find (hash.c:74)
==11028== by 0x1184E8: cache_update_force (cache.c:279)
==11028== by 0x11A547: dump_handler (ctnl.c:266)
==11028== by 0x11A547: dump_handler (ctnl.c:257)
==11028== by 0x4870BDB: __callback (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x4AA005B: ??? (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0822: nfnl_process (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4AA0B8D: nfnl_catch (in
/usr/lib/x86_64-linux-gnu/libnfnetlink.so.0.2.0)
==11028== by 0x4871A6E: nfct_query (in
/usr/lib/x86_64-linux-gnu/libnetfilter_conntrack.so.3.7.0)
==11028== by 0x11A7AF: ctnl_init (ctnl.c:456)
==11028== by 0x1134A4: init (run.c:301)
==11028== by 0x111FBD: main (main.c:366)
This happens with conntrackd 1.4.6 and kernel 5.7.
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200724/3b15f48d/attachment-0001.html>
bugzilla-daemon at netfilter.org
2020-Jul-24 10:52 UTC
[Bug 1445] conntrackd: segfaults when not disabling internal cache
https://bugzilla.netfilter.org/show_bug.cgi?id=1445 --- Comment #1 from Arturo Borrero Gonzalez <arturo at netfilter.org> --- This might have been happening since conntrack 1.4.5. Perhaps not a lot of people are using this software these days? Anyways this piece of software should recv proper testing before being released. -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200724/b87e72d2/attachment.html>