wireshark-1.10.0 segfaults on Slackware64
 

I just built and installed wireshark-1.10.0 (as root)
It compiled normally with a few typical warnings.

When I run it (as root) I get a
Segmentation fault

When I debug with gdb I get the following backtrace

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff14839fe in genl_register () from /usr/lib64/libnl-genl-3.so.200
(gdb) bt 10
#0 0x00007ffff14839fe in genl_register () from /usr/lib64/libnl-genl-3.so.200
#1 0x00007fffefdda716 in ?? () from /usr/lib64/libnl.so.1
#2 0x0000000000000000 in ?? ()
(gdb)

an "ldd /usr/local/bin/wireshark" gives me the following

linux-vdso.so.1 (0x00007fffacdc7000)
libwiretap.so.3 => /usr/local/lib/libwiretap.so.3 (0x00007f41c9543000)
libwireshark.so.3 => /usr/local/lib/libwireshark.so.3 (0x00007f41c55a0000)
libwsutil.so.3 => /usr/local/lib/libwsutil.so.3 (0x00007f41c539a000)
libpcap.so.1 => /usr/lib64/libpcap.so.1 (0x00007f41c515b000)
libgtk-x11-2.0.so.0 => /usr/lib64/libgtk-x11-2.0.so.0 (0x00007f41c4b2a000)
libgdk-x11-2.0.so.0 => /usr/lib64/libgdk-x11-2.0.so.0 (0x00007f41c4877000)
libpangocairo-1.0.so.0 => /usr/lib64/libpangocairo-1.0.so.0 (0x00007f41c466b000)
libgdk_pixbuf-2.0.so.0 => /usr/lib64/libgdk_pixbuf-2.0.so.0 (0x00007f41c444c000)
libcairo.so.2 => /usr/lib64/libcairo.so.2 (0x00007f41c419d000)
libpango-1.0.so.0 => /usr/lib64/libpango-1.0.so.0 (0x00007f41c3f52000)
libgobject-2.0.so.0 => /usr/lib64/libgobject-2.0.so.0 (0x00007f41c3d05000)
libgmodule-2.0.so.0 => /usr/lib64/libgmodule-2.0.so.0 (0x00007f41c3b01000)
libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f41c37e3000)
libm.so.6 => /lib64/libm.so.6 (0x00007f41c34e8000)
libz.so.1 => /usr/lib64/libz.so.1 (0x00007f41c32d2000)
libnl-route-3.so.200 => /usr/lib64/libnl-route-3.so.200 (0x00007f41c308b000)
libnl-genl-3.so.200 => /usr/lib64/libnl-genl-3.so.200 (0x00007f41c2e86000)
libnl-3.so.200 => /usr/lib64/libnl-3.so.200 (0x00007f41c2c6d000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f41c2a51000)
libc.so.6 => /lib64/libc.so.6 (0x00007f41c2691000)
libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f41c248f000)
librt.so.1 => /lib64/librt.so.1 (0x00007f41c2287000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f41c2083000)
libgcrypt.so.11 => /usr/lib64/libgcrypt.so.11 (0x00007f41c1e05000)
libgpg-error.so.0 => /usr/lib64/libgpg-error.so.0 (0x00007f41c1c02000)
libusb-1.0.so.0 => /usr/lib64/libusb-1.0.so.0 (0x00007f41c19f2000)
libnl.so.1 => /usr/lib64/libnl.so.1 (0x00007f41c17a3000)
libXinerama.so.1 => /usr/lib64/libXinerama.so.1 (0x00007f41c15a1000)
libXi.so.6 => /usr/lib64/libXi.so.6 (0x00007f41c1392000)
libXrandr.so.2 => /usr/lib64/libXrandr.so.2 (0x00007f41c118a000)
libXext.so.6 => /usr/lib64/libXext.so.6 (0x00007f41c0f79000)
libXcursor.so.1 => /usr/lib64/libXcursor.so.1 (0x00007f41c0d6e000)
libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007f41c0a6d000)
libXcomposite.so.1 => /usr/lib64/libXcomposite.so.1 (0x00007f41c086b000)
libXdamage.so.1 => /usr/lib64/libXdamage.so.1 (0x00007f41c0668000)
libXfixes.so.3 => /usr/lib64/libXfixes.so.3 (0x00007f41c0462000)
libatk-1.0.so.0 => /usr/lib64/libatk-1.0.so.0 (0x00007f41c0240000)


I'm used to being stumped forcing my intentions on sourcecode not intended for Slackware.
I usually figure it out with a few(hundred) web searches.
I tried the latest libnl (3.2.22) didn't help.

I'm no guru but I have been operating a compiler since Slackware 4 back in the mid '90s.
I configure and compile kernels at the bleeding edge for fun.
I did boot the stock Slack14-64 kernel and rebuilt wireshark, no change.

I have been googling for days and have not been able to solve it on my own.

I did try a couple of prebuilt 64bit wireshark's
They all complain about missing libs only available with wireshark source.
Beware of vicious circle.


Thx for reading this far
Please help! (if possible)


Luckily I have a managed switch with port mirroring and used a DOZE box to get my sniffin done.
I must solve it for Slackware though.

Another wierdness,
wireshark is installed in
/usr/local/bin
and it _IS_ on the PATH before /usr/bin
If I just type
"wireshark"
I get
-bash: /usr/bin/wireshark: No such file or directory

Where does this come from?
I checked there is indeed no wireshark in /usr/bin so what!
I'm loosing my mind...

Glad that you aren't losing your mind ;-)

Anyway, if there was previously a sym link from /usr/bin/wireshark to some existing program, bash remembers this and gives such a message. For example
cp /bin/cat /tmp
ln -s /tmp/cat ~/bin/qqq
qqq /etc/passwd # that works, assuming ~/bin is in your path
rm -f /tmp/cat
qqq /etc/passwd # that produces bash: /home/zsd/bin/qqq: No such file or directory

I saw you said "there is indeed no wireshark in /usr/bin" but I'm not sure how you tested that.
Care to look again?

In terms of the seg fault, sorry I can't help. I am running wireshark 1.8.6 on Slackware64 14.0 and it works fine. Have you considered modifying (if necessary) the slackbuild script and compiling 1.10 with that, and seeing if that helps? (Since you have installed into /usr/local/bin, I am assuming you didn't use the slackbuild script, but perhaps you did anyway.)

Try to compile with option configure --whithout-nl


I've had to build with the option to avoid the segfault, but I do not know if it puts restrictions on the use.
http://www.slackers.it/repository/wireshark/

Otherwise, try switching the specific version of nl to configure

The problem is that the wireshark-1.10 is linked with a libnl-3 library, while libpcap points to libnl1 (old version of libnl) library. Those two conflict with each other causing a segmentation fault. To fix your problem just upgrade the tcpdump / libpcap suite to the latest stable version tcpdump 4.4.0 / libpcap 1.4.0, as from that version the libpcap links to libnl-3.

Regrads,
Adam

Thank you for the solution!!!

I was and still am having this same issue. I updated tcpdump and libcap to no avail, also tried building with --without-nl which returns "unrecognized option."

This does seem to be related to libnl for me, but I don't know how to get around it.

Can you run the wireshark from within the GDB, then print the back-trace and paste it here? Exactly the same as it is described in the first post of this thread.

Also output from the
would help.

-Adam

I have absolutely no idea how to use gdb.


As for ldd

And

Edit:

I think this is what you want from gdb:

You must update the tcpdump / libpcap suite to the latest stable version (tcpdump 4.4.0 / libpcap 1.4.0)

Yours libpcap.so:
it is linked against libnl.so.1 (version 1), thus it's most probably the libpcap version 1.3.0 or pre (as the libpcap version 1.4.0 links with libnl-3.so).

While the wireshark:
is using libnl-3 (version 3).

So you have a conflict that causes your segmentation fault.

In order to resolve this error please download the latest sources of the stable release for tcpdump/libpcap (mentioned above) and create the slackware packages for those (I've used the official slackbuild scripts without any changes), than upgrade the libpcap and tcpdump and viola!

-Adam

I just built the latest of both of those (for the second time) from:

http://www.tcpdump.org/#latest-release

I got no errors, and I removed/re installed wireshark. Still, segfault.

What could I possibly be doing wrong?

We need to investigate the building of the libpcap library then.

Can you paste the output of following commands
And from your build directory of the libpcap package (it's probably the /tmp/libpcap-1.4.0 after running the SlackBuild script)
-Adam

Okay, I'm building from source, not using a slackbuild. I suppose I will give the slackbuild a shot just for fun though.

And...

Strange...

Ok, let's go though step by step and verify. For now let's focus on the libpcap lib.

If any of that steps fails than just tell me which one ;)


1. Download latest libpcap release from here (link)
2. Download slackbuild script for libpcap from here (link) to the same directory as libpcap sources
3. run libpcap.SlackBuild
Verification step: the /tmp/package-libpcap/usr/lib64/libpcap.so.1.4.0 is created
4. run command
Verification step: one of lines should be similar (linking with libnl-3)
If you see a linking with libnl-1 that there's no sense in continuing.
5. run 6. run command
Verification step: one of lines should be similar (linking with libnl-3)
-Adam

I installed the slackpackage and wireshark works just fine now. Thanks for your help, but can you offer any sort of explanation as to why using the slackpackage made a difference? It was the same version of the package. I didn't even download the one you linked me to, just the slackbuild to see if it would work and magically it did. But what went wrong before?

Glad to hear that.

My first bet is that you were installing the updated libpcap to the /usr/lib instead of /usr/lib64, but there could be many explanations for this.

Regards,
Adam