Bug #1128: Segmentation fault - live rule reload - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #1128

closed

Segmentation fault - live rule reload

Added by Victor Serbu about 10 years ago. Updated about 10 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

2.0rc3

Affected Versions:

Effort:

Difficulty:

Label:

Description

Segmentation fault after sending SIGUSR2 signal.

# /usr/sbin/suricata --build-info
This is Suricata version 2.0rc2 RELEASE
Features: NFQ PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS HAVE_LIBJANSSON
SIMD support: none
Atomic intrisics: 1 2 4 8 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-4), C version 199901
compiled with -fstack-protector
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
compiled with LibHTP v0.5.10, linked against LibHTP v0.5.10
Suricata Configuration:
  AF_PACKET support:                       yes
  PF_RING support:                         no
  NFQueue support:                         yes
  IPFW support:                            no
  DAG enabled:                             no
  Napatech enabled:                        no
  Unix socket enabled:                     yes
  Detection enabled:                       yes

  libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  Prelude support:                         no
  PCRE jit:                                no
  libluajit:                               no
  libgeoip:                                yes
  Non-bundled htp:                         no
  Old barnyard2 support:                   no
  CUDA enabled:                            no

  Suricatasc install:                      yes

  Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no
  Profiling enabled:                       no
  Profiling locks enabled:                 no
  Coccinelle / spatch:                     no

Generic build parameters:
  Installation prefix (--prefix):          /usr
  Configuration directory (--sysconfdir):  /etc/suricata/
  Log directory (--localstatedir) :        /var/log/suricata/

  Host:                                    x86_64-redhat-linux-gnu
  GCC binary:                              gcc -std=gnu99
  GCC Protect enabled:                     yes
  GCC march native enabled:                no
  GCC Profile enabled:                     no

./configure --enable-gccprotect --disable-gccmarch-native --enable-nfqueue --enable-af-packet  --enable-jansson --enable-geoip CFLAGS="-ggdb -O0"

Files

gdb-liverulereload.txt (1.95 KB) gdb-liverulereload.txt

Victor Serbu, 03/07/2014 07:58 AM

Actions

Copy link

Updated by Victor Julien about 10 years ago

Description updated (diff)

Actions

Copy link

Updated by Victor Julien about 10 years ago

The backtrace is very strange, it shows something that shouldn't be possible.

Thread 1 shows:

#3  0x00000000004ad503 in DetectEngineLiveRuleSwap (arg=0x0) at detect-engine.c:508

However, in no code path can 'arg' be 0x0. So either this is a really weird corruption, or the bt is generated based on the wrong core-binary combination.

Can you post the full output of gdbs bt? So everything after you started gdb, including all gdb startup output, etc.

Actions

Copy link

Updated by Victor Serbu about 10 years ago

I have a problem with gdb (segfault) and i will try monday with another version of gdb (I have to leave the office right now).

I have run the following command:
usr/sbin/suricata -c /etc/suricata/suricata.yaml.minimal-rules --af-packet=eth1

This is the partial output of gdb:

gdb /usr/sbin/suricata core.2235
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6_4.1)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/suricata...Reading symbols from /usr/lib/debug/usr/sbin/suricata.debug...done.
done.

warning: core file may not match specified executable file.
[New Thread 2242]
[New Thread 2239]
[New Thread 2238]
[New Thread 2237]
[New Thread 2236]
[New Thread 2235]
Missing separate debuginfo for
Try: yum --disablerepo='*' --enablerepo='*-debug*' install /usr/lib/debug/.build-id/03/673c781af50aad25840c1e54eb11a0165f6468
Reading symbols from /usr/lib64/libhtp-0.5.10.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libhtp-0.5.10.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libhtp-0.5.10.so.1.0.0
Reading symbols from /usr/lib64/libGeoIP.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libGeoIP.so.1
Reading symbols from /usr/lib64/libmagic.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libmagic.so.1
Reading symbols from /lib64/libcap-ng.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib64/libcap-ng.so.0
Reading symbols from /usr/lib64/libpcap.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libpcap.so.1
Reading symbols from /lib64/libnet.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib64/libnet.so.1
Reading symbols from /usr/lib64/libnetfilter_queue.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libnetfilter_queue.so.1
Reading symbols from /usr/lib64/libnfnetlink.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libnfnetlink.so.0
Reading symbols from /usr/lib64/libjansson.so.4...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libjansson.so.4
Reading symbols from /usr/lib64/libyaml-0.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libyaml-0.so.2
Reading symbols from /lib64/libpcre.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib64/libpcre.so.0
Reading symbols from /usr/lib64/libssl3.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libssl3.so
Reading symbols from /usr/lib64/libsmime3.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libsmime3.so
Reading symbols from /usr/lib64/libnss3.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libnss3.so
Reading symbols from /usr/lib64/libnssutil3.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libnssutil3.so
Reading symbols from /usr/lib64/libplds4.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libplds4.so
Reading symbols from /usr/lib64/libplc4.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libplc4.so
Reading symbols from /usr/lib64/libnspr4.so...(no debugging symbols found)...done.
Loaded symbols for /usr/lib64/libnspr4.so
Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done.
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: debugger service failed

warning: File "/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "/usr/share/gdb/auto-load:/usr/lib/debug:/usr/bin/mono-gdb.py".
To enable execution of this file add
add-auto-load-safe-path /lib64/libthread_db-1.0.so
line to your configuration file "/root/.gdbinit".
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file "/root/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual. E.g., run from the shell:
info "(gdb)Auto-loading safe path"

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
Loaded symbols for /lib64/libpthread.so.0
Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done.
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: debugger service failed