[systemd-devel] Wierd Segfault in sd_rtnl_message_unref (libnss_myhostname.so.2 by sshd )

[Svenne Krap]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi.

On Arch X64 using 218-1 (first packaging of 218) I have run into the
following wierd problem.

When trying to connect to a ssh server running dualstack (both ipv4 and
ipv6) by ipv6, ssh segfaults when I have loaded the full ipv4 bgp
routing table (~500k+ routes). IPv4 connections works for some reason,
and Ipv6 recovers if I kill the routing daemon (bird).

The stack trace of the core-file starts with

Stack trace of thread 515:
#0  0x00007f48334a3dd5 _int_free (libc.so.6)
#1  0x00007f4834a1e62a sd_rtnl_message_unref (libnss_myhostname.so.2)
#2  0x00007f4834a1e657 sd_rtnl_message_unref (libnss_myhostname.so.2)

And continues with that line (#1 and #2) until frame 63.

I have looked in src/libsystemd/sd-rtnl/rtnl-message.c and have two
observations (my C is very rusty so feel free to correct me).

Line 589, shouldn't the line
    if (m && REFCNT_DEC(m->n_ref) <= 0) {

be

    if (m && REFCNT_DEC(m->n_ref) >= 0) {

(I.e. greater-than-equal instead of less-than-equal)

Also, perhaps a test of whether m->next is equal to m on line 597....

Thank you in advance

Svenne
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQI5BAEBCAAjBQJUtDfOHBpodHRwOi8vc3Zlbm5lLmRrL3BncC9wb2xpY3kACgkQ
/zLSj+olL/JeJBAAgobn/GihBKF1T9toBqF1lnHg5W61wErmjyXcNxFSYljcdbVD
wdKcTax/RPf5Bqh8BzBn68Qw2VEuQ45UqVTudTx+aP8L173ga67eIOVwrN4e/eJ9
tPK+zSXr5ioCEnDjU3MLfzhjY2yOTdplW6X3yeHiuTRoNKInvhURHtIJOAs4c3Ka
NKpZX9ZgZSi46gGVAu+k9J8L+o7hqx2KbGzKODY7+R5iisg1ZAIqvys9cdWEbp3v
F+ugRWS0zkS28A8PK5feH7cPeuSxcFkXPIzikZiGxCtETdrcdKjKwlyEpN2XZECO
DCNj5YZxvjMnGVss4QIz8JGyi6LUXcEEd2HeeQGCzQEpEVM1KE9Bmeq9TLdq1eZq
/nldkQyAzE2qDmEE/ToC5yANtC/0VnjCoha/x5HM90DLwVjlcfRjYMbV9yCQyBiK
LR1o213/6bFXsch+z93Cb4JmtfBviY2zNwMNw9jsV5mR+7QYK6kZbevnjuRXoti7
zyoOYymyqzNRIqIhEnTkxV0+dLGB1slGA8EbntKliPNDlu8vyMDHZkW+A091DfGz
ioMuWIiCD1qQdLtbT1mRXwcPND/4qUHytZomrnn7JR1lyK2bfwoDCcLQQtOkIF2q
XSE7+vUx/ycX6AHn2jcI01nWhZWmnUOvCKsQWDurGacbQ+s/U51uIIBqXC0=
=3n/+
-----END PGP SIGNATURE-----