Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FS#1875 - netifd: segmentation fault when using _network rules_ #6789

openwrt-bot opened this issue Oct 1, 2018 · 0 comments

FS#1875 - netifd: segmentation fault when using _network rules_ #6789

openwrt-bot opened this issue Oct 1, 2018 · 0 comments


Copy link

openwrt-bot commented Oct 1, 2018


Using openwrt-18.06 in a Linksys WRT1200-AC

I have a rule in my config_network with an out option inside

config rule option out 'wan' option lookup '102' option priority '21000'

and an usb interface like this one

config interface 'usb' option auto '0' option proto 'qmi' option device '/dev/cdc-wdm0' option pincode '' option apn '' option username 'MOVISTAR' option password 'MOVISTAR'

When the wan interface is not yet up (dhcp failed/cable not connected/etc) and I try to bring up usb interface, netifd crashes with a segmentation fault.

After a lot of tries, I've removed the config rule and it started working.

I've followed the execution to locate where the segmentation fault happens and I've found the following path:

179 vlist_for_each_element(&iprules, rule, node) { 180 if (rule_ready(rule)) 181 continue; 182 183 if (!strcmp(rule->out_iface, iface->name)) { 184 memcpy(rule->out_dev, iface->>ifname, sizeof(rule->out_dev)); 185 interface_add_user(&rule->out_iface_user, iface); 186 } 187 188 if (!strcmp(rule->in_iface, iface->name)) { 189 memcpy(rule->in_dev, iface->>ifname, sizeof(rule->in_dev)); 190 interface_add_user(&rule->in_iface_user, iface); 191 } 192 }

At line 180, rule_ready(rule) returns false if at lease one of in_iface or out_iface are set (with appropriate flag).
When comparing at line 183 and 188, out_iface could be NULL if the rule had only in_iface and vice-versa at line 188, so strcmp will throw a segmentation fault

I see two approaches to fix that:

  • Check rule flags for IPRULE_IN/OUT before strcmp
  • Check if rule->in/out_iface are not NULL before strcmp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

1 participant