To reproduce this issue, attach an ingress qdisc to some interface (veth0 in this case):

# tc qd add dev veth0 ingress handle ffff:

Then add two identical filters, each with xt action:

# tc filter add dev veth0 parent ffff: u32 match u32 0 0 action xt -j LOG
# tc filter add dev veth0 parent ffff: u32 match u32 0 0 action xt -j LOG

Finally try to print the filter list:

# tc filter show dev veth0 parent ffff:

tc will segfault at the last step. The issue has been fixed upstream:

commit 6e2e5ec28bad4561c534adf4f22b2706e385c71d
Author: Andreas Greve <andreas.greve>
Date:   Sat May 10 11:19:18 2014 +0200

    fix print_ipt: segfault if more then one filter with action -j MARK.
    
    BUG: tc filter show ... produce a segmentation fault if more than one
    filter rule with action -j MARK exists.
    
    Reason: In print_ipt(...) xtables will be initialzed with a
    pointer to the static struct tcipt_globals at xtables_init_all().
    Later on the fields .opts and .options_offset of tcipt_globals are
    modified. The call of xtables_free_opts(1) at the end of print(...)
    does not restore the original values of tcipt_globals for the
    modified fields. It only frees some allocated memory and sets
    .opts to NULL. This leads to a segmentation fault when print_ipt()
    is called for the next filter rule with action -j MARK.
    
    Fix: Cloneing tcipt_globals on the stack as tmp_tcipt_globals and
    use it instead of tcipt_globals, so tcipt_globals will be not
    modified.
    
    Signed-off-by: Andreas Greve <andreas.greve>