Project

General

Profile

Actions
Copy link

Bug #2462

closed

memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592)

Added by Peter Manev about 6 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Peter Manev
Target version:
TBD
Affected Versions:
4.1beta1, 4.1rc1, 4.1rc2
Effort:
Difficulty:
Label:

Description

I am seeing this bellow on live traffic shutdown.
Attached is the build-info inventory.

It may be two separate leaks as well one related to json dns logger the other to decompression.
The leak about json logger is reproducible it seems - aka it appeared every time at shutdown for the last 2 runs - so will try to chase and get a reproducible pcap case.


[4586] 22/3/2018 -- 01:45:12 - (ippair.c:290) <Perf> (IPPairPrintStats) -- ippair memory usage: 414144 bytes, maximum: 16777216
[4586] 22/3/2018 -- 01:45:15 - (host.c:294) <Perf> (HostPrintStats) -- host memory usage: 1622144 bytes, maximum: 16777216
[4586] 22/3/2018 -- 01:45:16 - (detect-engine-build.c:1704) <Info> (SigAddressCleanupStage1) -- cleaning up signature grouping structure... complete
[4586] 22/3/2018 -- 01:45:16 - (util-device.c:328) <Notice> (LiveDeviceListClean) -- Stats for 'eth2':  pkts: 1088426408, drop: 12601166 (1.16%), invalid chksum: 0
[4586] 22/3/2018 -- 01:45:16 - (util-device.c:328) <Notice> (LiveDeviceListClean) -- Stats for 'eth3':  pkts: 1681884857, drop: 33949331 (2.02%), invalid chksum: 0
[4586] 22/3/2018 -- 01:45:16 - (util-device.c:328) <Notice> (LiveDeviceListClean) -- Stats for 'eth0':  pkts: 59291, drop: 0 (0.00%), invalid chksum: 0
[4586] 22/3/2018 -- 01:45:16 - (util-mpm-hs.c:1068) <Perf> (MpmHSGlobalCleanup) -- Cleaning up Hyperscan global scratch
[4586] 22/3/2018 -- 01:45:16 - (util-mpm-hs.c:1076) <Perf> (MpmHSGlobalCleanup) -- Clearing Hyperscan database cache

=================================================================
==4586==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 144347616 byte(s) in 3007242 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a0a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a0a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #8 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #9 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #10 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #11 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #12 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #13 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Direct leak of 557760 byte(s) in 11620 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a0a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a0a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xcc7722 in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:171:21
    #8 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #9 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #10 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #11 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #12 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #13 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #14 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Direct leak of 288 byte(s) in 6 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a0a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a0a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xbd4758 in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:176:29
    #8 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #9 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #10 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #11 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #12 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #13 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x62204f in AppLayerDecoderEventsSetEventRaw /home/pevman/tests/git/suricata/src/app-layer-events.c:76:46
    #2 0x7cf675 in DetectEngineSetEvent /home/pevman/tests/git/suricata/src/detect-engine.c:3587:5
    #3 0xd75c7e in FileSwfZlibDecompression /home/pevman/tests/git/suricata/src/util-file-swf-decompression.c:102:13
    #4 0xd75138 in FileSwfDecompression /home/pevman/tests/git/suricata/src/util-file-decompression.c:159:13
    #5 0x82ec6b in HttpServerBodyGetDataCallback /home/pevman/tests/git/suricata/src/detect-engine-hsbd.c:163:19
    #6 0x87ca7f in PrefilterMpm /home/pevman/tests/git/suricata/src/detect-engine-prefilter.c:581:32
    #7 0x873254 in DetectRunPrefilterTx /home/pevman/tests/git/suricata/src/detect-engine-prefilter.c:117:9
    #8 0x75efda in DetectRunTx /home/pevman/tests/git/suricata/src/detect.c:1392:13
    #9 0x75b2ae in DetectRun /home/pevman/tests/git/suricata/src/detect.c:141:9
    #10 0x75a9be in DetectFlow /home/pevman/tests/git/suricata/src/detect.c:1655:11
    #11 0x75a4e5 in Detect /home/pevman/tests/git/suricata/src/detect.c:1729:9
    #12 0xa18bcd in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:258:9
    #13 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #14 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #15 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #16 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #17 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #18 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #19 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #20 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Indirect leak of 192463488 byte(s) in 3007242 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a3a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a3a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #8 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #9 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #10 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #11 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #12 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #13 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Indirect leak of 743680 byte(s) in 11620 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a3a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a3a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xcc7722 in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:171:21
    #8 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #9 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #10 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #11 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #12 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #13 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #14 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Indirect leak of 384 byte(s) in 6 object(s) allocated from:
    #0 0x4bfdb8 in __interceptor_malloc (/usr/local/bin/suricata+0x4bfdb8)
    #1 0x7f4078253a3a in json_array (/usr/lib/x86_64-linux-gnu/libjansson.so.4+0x7a3a)
    #2 0xaca427 in JsonDnsLoggerToClient /home/pevman/tests/git/suricata/src/output-json-dns.c:1087:26
    #3 0xb5b2b3 in OutputTxLog /home/pevman/tests/git/suricata/src/output-tx.c:236:17
    #4 0xaa7e1a in OutputLoggerLog /home/pevman/tests/git/suricata/src/output.c:917:13
    #5 0xa18c35 in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:263:5
    #6 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #7 0xbd4758 in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:176:29
    #8 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #9 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #10 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #11 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #12 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #13 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Indirect leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x4c0138 in realloc (/usr/local/bin/suricata+0x4c0138)
    #1 0x622b14 in AppLayerDecoderEventsSetEventRaw /home/pevman/tests/git/suricata/src/app-layer-events.c:93:21
    #2 0x7cf675 in DetectEngineSetEvent /home/pevman/tests/git/suricata/src/detect-engine.c:3587:5
    #3 0xd75c7e in FileSwfZlibDecompression /home/pevman/tests/git/suricata/src/util-file-swf-decompression.c:102:13
    #4 0xd75138 in FileSwfDecompression /home/pevman/tests/git/suricata/src/util-file-decompression.c:159:13
    #5 0x82ec6b in HttpServerBodyGetDataCallback /home/pevman/tests/git/suricata/src/detect-engine-hsbd.c:163:19
    #6 0x87ca7f in PrefilterMpm /home/pevman/tests/git/suricata/src/detect-engine-prefilter.c:581:32
    #7 0x873254 in DetectRunPrefilterTx /home/pevman/tests/git/suricata/src/detect-engine-prefilter.c:117:9
    #8 0x75efda in DetectRunTx /home/pevman/tests/git/suricata/src/detect.c:1392:13
    #9 0x75b2ae in DetectRun /home/pevman/tests/git/suricata/src/detect.c:141:9
    #10 0x75a9be in DetectFlow /home/pevman/tests/git/suricata/src/detect.c:1655:11
    #11 0x75a4e5 in Detect /home/pevman/tests/git/suricata/src/detect.c:1729:9
    #12 0xa18bcd in FlowWorker /home/pevman/tests/git/suricata/src/flow-worker.c:258:9
    #13 0xcc756d in TmThreadsSlotVarRun /home/pevman/tests/git/suricata/src/tm-threads.c:145:17
    #14 0xbd451b in TmThreadsSlotProcessPkt /home/pevman/tests/git/suricata/src/./tm-threads.h:147:9
    #15 0xbd0fcd in AFPParsePacketV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1116:9
    #16 0xbcf700 in AFPWalkBlock /home/pevman/tests/git/suricata/src/source-af-packet.c:1131:13
    #17 0xbbfb97 in AFPReadFromRingV3 /home/pevman/tests/git/suricata/src/source-af-packet.c:1170:13
    #18 0xbbc5fe in ReceiveAFPLoop /home/pevman/tests/git/suricata/src/source-af-packet.c:1559:17
    #19 0xcd9f7e in TmThreadsSlotPktAcqLoop /home/pevman/tests/git/suricata/src/tm-threads.c:348:13
    #20 0x7f40780366b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

SUMMARY: AddressSanitizer: 338113240 byte(s) leaked in 6037738 allocation(s).

Files

build-info (3.64 KB) build-info Peter Manev, 03/23/2018 04:31 AM
Actions
Copy link
 #1

Updated by Victor Julien about 6 years ago

  • Status changed from New to Assigned
  • Assignee set to Giuseppe Longo
  • Priority changed from Normal to High
  • Target version set to 70
Actions
Copy link
 #2

Updated by Victor Julien over 5 years ago

  • Assignee changed from Giuseppe Longo to Jason Ish
  • Affected Versions 4.1beta1, 4.1rc1 added
Actions
Copy link
 #3

Updated by Victor Julien over 5 years ago

  • Target version changed from 70 to 4.1rc2
Actions
Copy link
 #4

Updated by Victor Julien over 5 years ago

  • Target version changed from 4.1rc2 to 4.1
  • Affected Versions 4.1rc2 added
Actions
Copy link
 #5

Updated by Victor Julien over 5 years ago

The detect engine leak was fixed in c620fc3dc4721436c396f41c558a036d1d655c2d

Actions
Copy link
 #6

Updated by Victor Julien over 5 years ago

  • Target version changed from 4.1 to 4.1.1
Actions
Copy link
 #7

Updated by Victor Julien over 5 years ago

  • Target version changed from 4.1.1 to 70
Actions
Copy link
 #8

Updated by Victor Julien about 5 years ago

  • Status changed from Assigned to New
  • Assignee changed from Jason Ish to Peter Manev
  • Priority changed from High to Normal
  • Target version changed from 70 to TBD

Unable to reproduce and code review didn't show it either. Peter, are you able to reproduce this still? If so, can you provide a test case?

Actions
Copy link
 #9

Updated by Peter Manev about 5 years ago

  • Status changed from New to Closed

I do not see that issue any more. I will reopen if i see it again.
Closing.

Actions
Copy link

Also available in: Atom PDF