Bug #3049
closedthread hangs in pfring mode
Description
It doesn't consume CPU after that
- ps -T -p 18131
PID SPID TTY TIME CMD
18131 18131 ? 00:18:18 Suricata-Main
18131 18132 ? 3-15:32:14 RX#01-ens1
18131 18133 ? 3-11:31:03 RX#02-ens1
18131 18134 ? 2-17:07:14 RX#03-ens1
18131 18135 ? 3-16:46:10 RX#04-ens1
and at pfring stats all packets are dropped - cat /proc/net/pf_ring/18134-ens1.8
Tot Packets : 122565158041
Tot Pkt Lost : 22083715992
other threads fine: - cat /proc/net/pf_ring/18133-ens1.7
Tot Packets : 130281268130
Tot Pkt Lost : 213073812
Configuration:
- interface: default
threads: 4
- interface: ens1
cluster-id: 10
cluster-type: cluster_flow
After connecting gdb to suricata, bt from hanged thread:
(gdb) thr 55
[Switching to thread 55 (Thread 0x7f49154dc700 (LWP 18134))]
#0 0x00007f491d54f965 in pthread_cond_wait@GLIBC_2.3.2 () from /lib64/libpthread.so.0
@GLIBC_2.3.2 () from /lib64/libpthread.so.0
(gdb) bt
#0 0x00007f491d54f965 in pthread_cond_wait
#1 0x00005652590f965a in PacketPoolWait () at tmqh-packetpool.c:155
#2 0x00005652590e3c1f in ReceivePfringLoop (tv=0x56525d739f70, data=0x7f48f09bc8c0, slot=<optimized out>) at source-pfring.c:347
#3 0x00005652590fe0c7 in TmThreadsSlotPktAcqLoop (td=0x56525d739f70) at tm-threads.c:334
#4 0x00007f491d54bdd5 in start_thread () from /lib64/libpthread.so.0
#5 0x00007f491ce5aead in clone () from /lib64/libc.so.6
Probably issue here:
void PacketPoolWait(void)
{
PktPool *my_pool = GetThreadPacketPool();
if (PacketPoolIsEmpty(my_pool)) {
SCMutexLock(&my_pool->return_stack.mutex);
// <== you have to check again PacketPoolIsEmpty here, otherwise nobody to send Signal here
SC_ATOMIC_ADD(my_pool->return_stack.sync_now, 1);
SCCondWait(&my_pool->return_stack.cond, &my_pool->return_stack.mutex);
SCMutexUnlock(&my_pool->return_stack.mutex);
}
while(PacketPoolIsEmpty(my_pool))
cc_barrier();
}
Updated by Andreas Herz over 5 years ago
- Assignee set to Community Ticket
- Priority changed from High to Normal
- Target version set to TBD
- Effort deleted (
high)
Can you try to reproduce it with a current 4.1.x version?
Updated by Peter Manev over 5 years ago
Also - i could not see the pfring version you are using.
Updated by Arthur Kokhanenko over 5 years ago
we will check with suricata 4.1.4
pfring-7.5.0-2417.x86_64
Updated by Andreas Herz over 5 years ago
Could you reproduce it at the test with the new versions?
Updated by Arthur Kokhanenko over 5 years ago
Looks like unable to reproduce with 4.1.4