Actions
Bug #2089
closedengine file logging race condition (3.2.x)
Affected Versions:
Effort:
Difficulty:
Label:
Description
Start command -
# Thursday's run # af+ac+custom+spm-bm+full # verified /usr/local/bin/suricata -c /etc/suricata/test-yaml/suricata.yaml \ --pidfile /var/run/suricata.pid \ --af-packet=eth2 --af-packet=eth3 --af-packet=eth0 \ --set "af-packet.0.tpacket-v3=no" \ --set "mpm-algo=ac" --set "spm-algo=bm" --set "detect.profile=custom" \ --set "detect.custom-values.toclient-groups=700" \ --set "detect.custom-values.toserver-groups=1000" \ --set "detect.sgh-mpm-context=full" -vvv -D
root@suricata:~# suricata -V This is Suricata version 4.0dev (rev bcfbb88)
[New LWP 23738] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/local/bin/suricata -c /etc/suricata/yaml/suricata.yaml --pidfile /va'. Program terminated with signal SIGABRT, Aborted. #0 0x00007fac2d50f428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. [Current thread is 1 (Thread 0x7fa6637fe700 (LWP 23806))] (gdb) (gdb) (gdb) thread apply all bt Thread 25 (Thread 0x7fa7a55e8700 (LWP 23738)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a55e6bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7faaee0374f0, data=0x7fa737fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaee0374f0) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a55e8700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 24 (Thread 0x7fac30255940 (LWP 23652)): #0 0x00007fac2d5a575d in nanosleep () at ../sysdeps/unix/syscall-template.S:84 #1 0x00007fac2d5d71a4 in usleep (useconds=useconds@entry=10000) at ../sysdeps/posix/usleep.c:32 #2 0x0000000000411303 in SuricataMainLoop (suri=<optimized out>) at suricata.c:2757 #3 main (argc=<optimized out>, argv=<optimized out>) at suricata.c:2869 Thread 23 (Thread 0x7fa7a45e6700 (LWP 23740)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a45e4bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7faafed3a560, data=0x7fa717fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faafed3a560) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a45e6700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 22 (Thread 0x7fa7af029700 (LWP 23736)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7af027bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7faaa4f39920, data=0x7fa757fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaa4f39920) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa7af029700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 21 (Thread 0x7fa627fff700 (LWP 23812)): #0 0x00007fac2d5d69e3 in select () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000589913 in UnixMain (this=this@entry=0x897d40 <command>) at unix-manager.c:565 #2 0x0000000000589b82 in UnixManager (th_v=0x7faa1d8393b0, thread_data=<optimized out>) at unix-manager.c:966 #3 0x00000000005840b3 in TmThreadsManagement (td=0x7faa1d8393b0) at tm-threads.c:709 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa627fff700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 20 (Thread 0x7fa660ff9700 (LWP 23811)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225 #1 0x000000000046b8c2 in StatsMgmtThread (arg=0x7faa11a3bc20) at counters.c:378 #2 0x00007fac2ea0e6ba in start_thread (arg=0x7fa660ff9700) at pthread_create.c:333 #3 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 19 (Thread 0x7fa661ffb700 (LWP 23809)): #0 0x00007fac2d558450 in malloc_consolidate (av=av@entry=0x7fa740000020) at malloc.c:4167 #1 0x00007fac2d55a0a8 in _int_free (av=0x7fa740000020, p=<optimized out>, have_lock=0) at malloc.c:4073 #2 0x00007fac2d55d98c in __GI___libc_free (mem=<optimized out>) at malloc.c:2966 #3 0x0000000000453309 in HTPFree (ptr=<optimized out>, size=67488) at app-layer-htp-mem.c:159 ---Type <return> to continue, or q <return> to quit--- #4 0x00000000005e7d26 in StreamingBufferClear (sb=sb@entry=0x7fa461e29f70) at util-streaming-buffer.c:78 #5 0x00000000005e7d4e in StreamingBufferFree (sb=0x7fa461e29f70) at util-streaming-buffer.c:87 #6 0x000000000044cebc in HtpBodyFree (body=<optimized out>) at app-layer-htp-body.c:170 #7 0x000000000044d1a7 in HtpTxUserDataFree (state=state@entry=0x7fa461e29c10, htud=0x7fa461e29c70) at app-layer-htp.c:309 #8 0x000000000044d2d8 in HTPStateFree (state=0x7fa461e29c10) at app-layer-htp.c:357 #9 0x0000000000457b10 in AppLayerParserStateCleanup (ipproto=<optimized out>, alproto=<optimized out>, alstate=0x7fa461e29c10, pstate=0x7fa461e2a700) at app-layer-parser.c:1190 #10 0x00000000004fdda1 in FlowCleanupAppLayer (f=f@entry=0x7fa16fd44700) at flow.c:97 #11 0x00000000004ff66e in FlowClearMemory (f=f@entry=0x7fa16fd44700, proto_map=<optimized out>) at flow.c:853 #12 0x000000000050151e in FlowRecycler (th_v=0x7fa9fef365f0, thread_data=0x7fa6280008c0) at flow-manager.c:935 #13 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9fef365f0) at tm-threads.c:709 #14 0x00007fac2ea0e6ba in start_thread (arg=0x7fa661ffb700) at pthread_create.c:333 #15 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 18 (Thread 0x7fa7a5de9700 (LWP 23737)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a5de7bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7faaec13cc30, data=0x7fa747fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaec13cc30) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a5de9700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 17 (Thread 0x7fa6627fc700 (LWP 23808)): #0 0x00007fac2d55991e in _int_free (av=0x7fa634000020, p=0x7fa634011140, have_lock=0) at malloc.c:3945 #1 0x00007fac2d55d98c in __GI___libc_free (mem=<optimized out>) at malloc.c:2966 #2 0x00007fac2ec2710d in ?? () from /usr/lib/x86_64-linux-gnu/libjansson.so.4 #3 0x00007fac2ec27629 in ?? () from /usr/lib/x86_64-linux-gnu/libjansson.so.4 #4 0x00007fac2ec2b8cd in json_object_clear () from /usr/lib/x86_64-linux-gnu/libjansson.so.4 #5 0x0000000000533776 in JsonFlowLogger (tv=<optimized out>, thread_data=0x7fa634000900, f=0x7fa16ea80090) at output-json-flow.c:359 #6 0x0000000000521cb6 in OutputFlowLog (tv=tv@entry=0x7fa9f6f3cbf0, thread_data=<optimized out>, f=f@entry=0x7fa16ea80090) at output-flow.c:112 #7 0x000000000050150f in FlowRecycler (th_v=0x7fa9f6f3cbf0, thread_data=0x7fa6340008c0) at flow-manager.c:933 #8 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9f6f3cbf0) at tm-threads.c:709 #9 0x00007fac2ea0e6ba in start_thread (arg=0x7fa6627fc700) at pthread_create.c:333 #10 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 16 (Thread 0x7fa662ffd700 (LWP 23807)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225 #1 0x0000000000501a4f in FlowManager (th_v=0x7fa9d9241c80, thread_data=<optimized out>) at flow-manager.c:790 #2 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9d9241c80) at tm-threads.c:709 #3 0x00007fac2ea0e6ba in start_thread (arg=0x7fa662ffd700) at pthread_create.c:333 #4 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 15 (Thread 0x7fa663fff700 (LWP 23805)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa663ffdbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7fa9c8444f00, data=0x7fa653fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9c8444f00) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa663fff700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 14 (Thread 0x7fa760a4b700 (LWP 23804)): ---Type <return> to continue, or q <return> to quit--- #0 DetectPortLookupGroup (dp=<optimized out>, port=25) at detect-engine-port.c:810 #1 0x0000000000483613 in SigMatchSignaturesGetSgh (de_ctx=de_ctx@entry=0x7fab09e37120, det_ctx=det_ctx@entry=0x7fa65f50d980, p=p@entry=0x7fa669eff1b0) at detect.c:625 #2 0x0000000000484055 in SigMatchSignatures (th_v=th_v@entry=0x7fa9c3843ca0, de_ctx=0x7fab09e37120, det_ctx=0x7fa65f50d980, p=p@entry=0x7fa669eff1b0) at detect.c:1131 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7fa9c3843ca0, p=p@entry=0x7fa669eff1b0, data=data@entry=0x7fa65f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7fa9c3843ca0, p=0x7fa669eff1b0, data=0x7fa669f24c60, preq=0x7fab723456c0, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9c3843ca0, p=p@entry=0x7fa669eff1b0, slot=slot@entry=0x7fab70145aa0) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa669eff1b0, s=0x7fab70145aa0, tv=0x7fa9c3843ca0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa4e2458000, ppd=0x7fa4e245ed20, ptv=0x7fa667fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa4e2458000, ptv=0x7fa667fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa667fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9c3843ca0, data=0x7fa667fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9c3843ca0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa760a4b700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 13 (Thread 0x7fa77fd2f700 (LWP 23767)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa77fd2dbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7fa9de537af0, data=0x7fa6e7fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9de537af0) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77fd2f700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 12 (Thread 0x7fa6617fa700 (LWP 23810)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225 #1 0x000000000046aabf in StatsWakeupThread (arg=0x7faa0063d800) at counters.c:456 #2 0x00007fac2ea0e6ba in start_thread (arg=0x7fa6617fa700) at pthread_create.c:333 #3 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 11 (Thread 0x7fa76224e700 (LWP 23801)): #0 SigMatchSignaturesGetSmsg (flags=<optimized out>, p=0x7fa699eff1b0, f=0x7fa1883f4f30) at detect.c:674 #1 SigMatchSignatures (th_v=th_v@entry=0x7faac5745770, de_ctx=0x7fab09e37120, det_ctx=0x7fa68f50d980, p=p@entry=0x7fa699eff1b0) at detect.c:1068 #2 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #3 Detect (tv=tv@entry=0x7faac5745770, p=p@entry=0x7fa699eff1b0, data=data@entry=0x7fa68f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #4 0x0000000000505005 in FlowWorker (tv=0x7faac5745770, p=0x7fa699eff1b0, data=0x7fa699f24c60, preq=0x7fab70d45d90, unused=<optimized out>) at flow-worker.c:252 #5 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faac5745770, p=p@entry=0x7fa699eff1b0, slot=slot@entry=0x7fab71145d50) at tm-threads.c:130 #6 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa699eff1b0, s=0x7fab71145d50, tv=0x7faac5745770) at tm-threads.h:148 #7 AFPParsePacketV3 (pbd=0x7fa525480000, ppd=0x7fa525483c80, ptv=0x7fa697fffd80) at source-af-packet.c:1036 #8 AFPWalkBlock (pbd=0x7fa525480000, ptv=0x7fa697fffd80) at source-af-packet.c:1051 #9 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa697fffd80) at source-af-packet.c:1090 #10 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faac5745770, data=0x7fa697fffd80, slot=<optimized out>) at source-af-packet.c:1479 #11 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faac5745770) at tm-threads.c:334 #12 0x00007fac2ea0e6ba in start_thread (arg=0x7fa76224e700) at pthread_create.c:333 #13 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 10 (Thread 0x7fa76124c700 (LWP 23803)): #0 SCACTileSearchSmall256 (ctx=0x7faa3243fbd0, mpm_thread_ctx=<optimized out>, pmq=0x7fa66f50daa8, buf=0x7fa4ef0dc644 <error: Cannot access memory at address 0x7fa4ef0dc644>, buflen=476) at util-mpm-ac-tile-small.c:72 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa66f50d980, sgh=0x7faaab544f50, p=p@entry=0x7fa679eff1b0, flags=flags@entry=36 '$', has_state=has_state@entry=0) ---Type <return> to continue, or q <return> to quit--- at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fa9ac6429f0, de_ctx=0x7fab09e37120, det_ctx=0x7fa66f50d980, p=p@entry=0x7fa679eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7fa9ac6429f0, p=p@entry=0x7fa679eff1b0, data=data@entry=0x7fa66f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7fa9ac6429f0, p=0x7fa679eff1b0, data=0x7fa679f24c60, preq=0x7fab707456c0, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9ac6429f0, p=p@entry=0x7fa679eff1b0, slot=slot@entry=0x7fab70945a00) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa679eff1b0, s=0x7fab70945a00, tv=0x7fa9ac6429f0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa4ef0d8000, ppd=0x7fa4ef0dc5b0, ptv=0x7fa677fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa4ef0d8000, ptv=0x7fa677fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa677fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9ac6429f0, data=0x7fa677fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9ac6429f0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa76124c700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 9 (Thread 0x7fa761a4d700 (LWP 23802)): #0 SCACTileSearchSmall256 (ctx=0x7fa9b0736340, mpm_thread_ctx=<optimized out>, pmq=0x7fa67f50daa8, buf=0x7fa50039f96c <error: Cannot access memory at address 0x7fa50039f96c>, buflen=1448) at util-mpm-ac-tile-small.c:64 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa67f50d980, sgh=0x7faaabc42a70, p=p@entry=0x7fa689eff1b0, flags=flags@entry=8 '\b', has_state=has_state@entry=0) at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faac9544940, de_ctx=0x7fab09e37120, det_ctx=0x7fa67f50d980, p=p@entry=0x7fa689eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7faac9544940, p=p@entry=0x7fa689eff1b0, data=data@entry=0x7fa67f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7faac9544940, p=0x7fa689eff1b0, data=0x7fa689f24c60, preq=0x7fab70545d90, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faac9544940, p=p@entry=0x7fa689eff1b0, slot=slot@entry=0x7fab71345a00) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa689eff1b0, s=0x7fab71345a00, tv=0x7faac9544940) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa500398000, ppd=0x7fa50039f8d8, ptv=0x7fa687fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa500398000, ptv=0x7fa687fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa687fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faac9544940, data=0x7fa687fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faac9544940) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa761a4d700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 8 (Thread 0x7fa77e52c700 (LWP 23790)): #0 QuickSortSigIntId (n=<optimized out>, sids=<optimized out>) at detect-engine-prefilter.c:77 #1 Prefilter (det_ctx=det_ctx@entry=0x7fa6af50d980, sgh=<optimized out>, p=p@entry=0x7fa6b9eff1b0, flags=flags@entry=4 '\004', has_state=has_state@entry=0) at detect-engine-prefilter.c:199 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa41737ec0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6af50d980, p=p@entry=0x7fa6b9eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7faa41737ec0, p=p@entry=0x7fa6b9eff1b0, data=data@entry=0x7fa6af50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7faa41737ec0, p=0x7fa6b9eff1b0, data=0x7fa6b9f24c60, preq=0x7fab77745c80, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa41737ec0, p=p@entry=0x7fa6b9eff1b0, slot=slot@entry=0x7fab740457c0) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6b9eff1b0, s=0x7fab740457c0, tv=0x7faa41737ec0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa54d0d8000, ppd=0x7fa54d0dd700, ptv=0x7fa6b7fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa54d0d8000, ptv=0x7fa6b7fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6b7fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa41737ec0, data=0x7fa6b7fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa41737ec0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77e52c700) at pthread_create.c:333 ---Type <return> to continue, or q <return> to quit--- #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 7 (Thread 0x7fa77dd2b700 (LWP 23793)): #0 SCACTileSearchSmall256 (ctx=0x7faa0cd40d30, mpm_thread_ctx=<optimized out>, pmq=0x7fa69f50daa8, buf=0x7fa52c329bbc <error: Cannot access memory at address 0x7fa52c329bbc>, buflen=1398) at util-mpm-ac-tile-small.c:79 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa69f50d980, sgh=0x7faaa973f8d0, p=p@entry=0x7fa6a9eff1b0, flags=flags@entry=52 '4', has_state=has_state@entry=0) at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fab97345b20, de_ctx=0x7fab09e37120, det_ctx=0x7fa69f50d980, p=p@entry=0x7fa6a9eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7fab97345b20, p=p@entry=0x7fa6a9eff1b0, data=data@entry=0x7fa69f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7fab97345b20, p=0x7fa6a9eff1b0, data=0x7fa6a9f24c60, preq=0x7fab72e45d90, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fab97345b20, p=p@entry=0x7fa6a9eff1b0, slot=slot@entry=0x7fab73e45400) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6a9eff1b0, s=0x7fab73e45400, tv=0x7fab97345b20) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa52c328000, ppd=0x7fa52c329b28, ptv=0x7fa6a7fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa52c328000, ptv=0x7fa6a7fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6a7fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fab97345b20, data=0x7fa6a7fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fab97345b20) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77dd2b700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 6 (Thread 0x7fa7a4de7700 (LWP 23739)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a4de5bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7faaf5f44880, data=0x7fa727fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaf5f44880) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a4de7700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 5 (Thread 0x7fa77ed2d700 (LWP 23789)): #0 SCACTileSearchSmall256 (ctx=0x7faa3b63c2d0, mpm_thread_ctx=<optimized out>, pmq=0x7fa6bf50daa8, buf=0x7fa553b4c308 <error: Cannot access memory at address 0x7fa553b4c308>, buflen=1380) at util-mpm-ac-tile-small.c:72 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6bf50d980, sgh=0x7faaad93d0b0, p=p@entry=0x7fa6c9eff1b0, flags=flags@entry=4 '\004', has_state=has_state@entry=0) at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa2243c6f0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6bf50d980, p=p@entry=0x7fa6c9eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7faa2243c6f0, p=p@entry=0x7fa6c9eff1b0, data=data@entry=0x7fa6bf50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7faa2243c6f0, p=0x7fa6c9eff1b0, data=0x7fa6c9f24c60, preq=0x7fab74845440, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa2243c6f0, p=p@entry=0x7fa6c9eff1b0, slot=slot@entry=0x7fab74945500) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6c9eff1b0, s=0x7fab74945500, tv=0x7faa2243c6f0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa553b48000, ppd=0x7fa553b4c280, ptv=0x7fa6c7fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa553b48000, ptv=0x7fa6c7fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6c7fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa2243c6f0, data=0x7fa6c7fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa2243c6f0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77ed2d700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 4 (Thread 0x7fa780530700 (LWP 23766)): #0 SCACTileSearchSmall256 (ctx=0x7fa9abb3dc70, mpm_thread_ctx=<optimized out>, pmq=0x7fa6ef50daa8, buf=0x7fa59b4844ac <error: Cannot access memory at address 0x7fa59b4844ac>, ---Type <return> to continue, or q <return> to quit--- buflen=1298) at util-mpm-ac-tile-small.c:63 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6ef50d980, sgh=0x7faaa8843ab0, p=p@entry=0x7fa6f9eff1b0, flags=flags@entry=40 '(', has_state=has_state@entry=0) at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fa9e75411b0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6ef50d980, p=p@entry=0x7fa6f9eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7fa9e75411b0, p=p@entry=0x7fa6f9eff1b0, data=data@entry=0x7fa6ef50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7fa9e75411b0, p=0x7fa6f9eff1b0, data=0x7fa6f9f24c60, preq=0x7fab76145960, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9e75411b0, p=p@entry=0x7fa6f9eff1b0, slot=slot@entry=0x7fab76745680) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6f9eff1b0, s=0x7fab76745680, tv=0x7fa9e75411b0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa59b480000, ppd=0x7fa59b484418, ptv=0x7fa6f7fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa59b480000, ptv=0x7fa6f7fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6f7fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9e75411b0, data=0x7fa6f7fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9e75411b0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa780530700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 3 (Thread 0x7fa780d31700 (LWP 23763)): #0 0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa780d2fbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46 #2 ReceiveAFPLoop (tv=0x7fa9e6f45a70, data=0x7fa707fffd80, slot=<optimized out>) at source-af-packet.c:1452 #3 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9e6f45a70) at tm-threads.c:334 #4 0x00007fac2ea0e6ba in start_thread (arg=0x7fa780d31700) at pthread_create.c:333 #5 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 2 (Thread 0x7fa77f52e700 (LWP 23776)): #0 SCACTileSearchSmall256 (ctx=0x7fa9f0142f50, mpm_thread_ctx=<optimized out>, pmq=0x7fa6cf50daa8, buf=0x7fa567a9e074 <error: Cannot access memory at address 0x7fa567a9e074>, buflen=1448) at util-mpm-ac-tile-small.c:79 #1 0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6cf50d980, sgh=0x7faaac0434a0, p=p@entry=0x7fa6d9eff1b0, flags=flags@entry=36 '$', has_state=has_state@entry=0) at detect-engine-prefilter.c:174 #2 0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa0a5401a0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6cf50d980, p=p@entry=0x7fa6d9eff1b0) at detect.c:1191 #3 0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603 #4 Detect (tv=tv@entry=0x7faa0a5401a0, p=p@entry=0x7fa6d9eff1b0, data=data@entry=0x7fa6cf50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663 #5 0x0000000000505005 in FlowWorker (tv=0x7faa0a5401a0, p=0x7fa6d9eff1b0, data=0x7fa6d9f24c60, preq=0x7fab75645a80, unused=<optimized out>) at flow-worker.c:252 #6 0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa0a5401a0, p=p@entry=0x7fa6d9eff1b0, slot=slot@entry=0x7fab75445d30) at tm-threads.c:130 #7 0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6d9eff1b0, s=0x7fab75445d30, tv=0x7faa0a5401a0) at tm-threads.h:148 #8 AFPParsePacketV3 (pbd=0x7fa567a98000, ppd=0x7fa567a9dfe0, ptv=0x7fa6d7fffd80) at source-af-packet.c:1036 #9 AFPWalkBlock (pbd=0x7fa567a98000, ptv=0x7fa6d7fffd80) at source-af-packet.c:1051 #10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6d7fffd80) at source-af-packet.c:1090 #11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa0a5401a0, data=0x7fa6d7fffd80, slot=<optimized out>) at source-af-packet.c:1479 #12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa0a5401a0) at tm-threads.c:334 #13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77f52e700) at pthread_create.c:333 #14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 1 (Thread 0x7fa6637fe700 (LWP 23806)): #0 0x00007fac2d50f428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 #1 0x00007fac2d51102a in __GI_abort () at abort.c:89 #2 0x00007fac2d5517ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fac2d66a2e0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007fac2d559e0a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7fac2d66a410 "double free or corruption (!prev)", action=3) at malloc.c:5004 #4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3865 ---Type <return> to continue, or q <return> to quit--- #5 0x00007fac2d55d98c in __GI___libc_free (mem=mem@entry=0x1e274f0) at malloc.c:2966 #6 0x00007fac2d547363 in _IO_new_fclose (fp=0x1e274f0) at iofclose.c:84 #7 0x0000000000593825 in SCLogReopen (op_iface_ctx=0x1e27250, op_iface_ctx=0x1e27250) at util-debug.c:514 #8 SCLogMessage (log_level=log_level@entry=SC_LOG_INFO, file=file@entry=0x60db98 "flow-manager.c", line=line@entry=773, function=function@entry=0x60e028 <__FUNCTION__.18428> "FlowManager", error_code=error_code@entry=SC_OK, message=message@entry=0x7fa6637fcc90 "Flow emergency mode over, back to normal... unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1491288829, ts.tv_usec:154623) flow_spare_q status(): 31% flows at the queue") at util-debug.c:577 #9 0x00000000005021fc in FlowManager (th_v=0x7fa9c8a43270, thread_data=<optimized out>) at flow-manager.c:769 #10 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9c8a43270) at tm-threads.c:709 #11 0x00007fac2ea0e6ba in start_thread (arg=0x7fa6637fe700) at pthread_create.c:333 #12 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Updated by Andreas Herz over 7 years ago
- Assignee set to OISF Dev
- Target version set to TBD
Updated by Victor Julien over 7 years ago
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Jason Ish
- Target version changed from TBD to 3.2.3
Updated by Victor Julien over 7 years ago
- Subject changed from abort() - with AFPv2 - 4.0dev (rev bcfbb88) to engine file logging race condition (3.2.x)
- Assignee changed from Jason Ish to Victor Julien
Updated by Victor Julien over 7 years ago
- Status changed from Assigned to Closed
Actions