Actions
Bug #3925
closeddcerpc: crash in eve logging
Affected Versions:
Effort:
Difficulty:
Label:
Description
Affected 6.0-rc1
Chasing it to get a usable core but this is what i have so far.
-- 20:56:02 - <Perf> - AF_PACKET V3 RX Ring params: block_size=1048576 block_nr=318 frame_size=1664 frame_nr=200340 (mem: 333447168) -- 20:56:02 - <Perf> - AF_PACKET V3 RX Ring params: block_size=1048576 block_nr=318 frame_size=1664 frame_nr=200340 (mem: 333447168) -- 20:56:02 - <Info> - All AFP capture threads are running. -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... -- 03:13:46 - <Notice> - Flow emergency mode entered... AddressSanitizer:DEADLYSIGNAL ================================================================= ==37045==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x000000e0b343 bp 0x7f1856ff11f8 sp 0x7f1856ff0fe0 T2) ==37045==The signal is caused by a READ memory access. ==37045==Hint: address points to the zero page. #0 0xe0b342 in suricata::dcerpc::log::log_dcerpc_header::h26d5fd104f0ee8ce /opt/suricata/rust/src/dcerpc/log.rs:39:43 #1 0xe0d809 in rs_dcerpc_log_json_record /opt/suricata/rust/src/dcerpc/log.rs:86:5 #2 0xa4e5c2 in JsonDCERPCLogger /opt/suricata/src/output-json-dcerpc.c:55:10 #3 0xa5f283 in OutputTxLog /opt/suricata/src/output-tx.c:298:17 #4 0x9dabcf in OutputLoggerLog /opt/suricata/src/output.c:882:9 #5 0x984b80 in FlowWorker /opt/suricata/src/flow-worker.c:545:5 #6 0xb8e24e in TmThreadsSlotVarRun /opt/suricata/src/tm-threads.c:117:21 #7 0xaaf1b2 in TmThreadsSlotProcessPkt /opt/suricata/src/./tm-threads.h:192:17 #8 0xaa80a0 in AFPParsePacketV3 /opt/suricata/src/source-af-packet.c:1113:9 #9 0xaa6717 in AFPWalkBlock /opt/suricata/src/source-af-packet.c:1128:15 #10 0xa9e040 in AFPReadFromRingV3 /opt/suricata/src/source-af-packet.c:1178:15 #11 0xa9bc17 in ReceiveAFPLoop /opt/suricata/src/source-af-packet.c:1571:17 #12 0xb9baaf in TmThreadsSlotPktAcqLoop /opt/suricata/src/tm-threads.c:312:13 #13 0x7f18679ecfa2 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7fa2) #14 0x7f18669404ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /opt/suricata/rust/src/dcerpc/log.rs:39:43 in suricata::dcerpc::log::log_dcerpc_header::h26d5fd104f0ee8ce Thread T2 (W#02-ens1np0) created by T0 (Suricata-Main) here: #0 0x564dfd in pthread_create (/usr/local/bin/suricata+0x564dfd) #1 0xb95b74 in TmThreadSpawn /opt/suricata/src/tm-threads.c:1721:14 #2 0xcb4079 in RunModeSetLiveCaptureWorkersForDevice /opt/suricata/src/util-runmodes.c:323:13 #3 0xcb383c in RunModeSetLiveCaptureWorkers /opt/suricata/src/util-runmodes.c:353:9 #4 0xa7c2e2 in RunModeIdsAFPWorkers /opt/suricata/src/runmode-af-packet.c:903:11 #5 0xa93369 in RunModeDispatch /opt/suricata/src/runmodes.c:391:5 #6 0xb76d91 in SuricataMain /opt/suricata/src/suricata.c:2800:5 #7 0x5ab6be in main /opt/suricata/src/main.c:22:12 #8 0x7f186686b09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) ==37045==ABORTING
/usr/local/bin/suricata --build-info This is Suricata version 6.0.0-rc1 RELEASE Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST SIMD support: SSE_4_2 SSE_4_1 SSE_3 Atomic intrinsics: 1 2 4 8 16 byte(s) 64-bits, Little-endian architecture GCC version 4.2.1 Compatible Clang 7.0.1 (tags/RELEASE_701/final), C version 201112 compiled with _FORTIFY_SOURCE=0 L1 cache line size (CLS)=64 thread local storage method: _Thread_local compiled with LibHTP v0.5.34, linked against LibHTP v0.5.34 Suricata Configuration: AF_PACKET support: yes eBPF support: yes XDP support: yes PF_RING support: no NFQueue support: no NFLOG support: no IPFW support: no Netmap support: no DAG enabled: no Napatech enabled: no WinDivert enabled: no Unix socket enabled: yes Detection enabled: yes Libmagic support: yes libnss support: yes libnspr support: yes libjansson support: yes hiredis support: no hiredis async with libevent: no Prelude support: no PCRE jit: yes LUA support: yes, through luajit libluajit: yes GeoIP2 support: yes Non-bundled htp: no Old barnyard2 support: Hyperscan support: yes Libnet support: yes liblz4 support: yes Rust support: yes Rust strict mode: yes Rust compiler path: /root/.cargo/bin/rustc Rust compiler version: rustc 1.46.0 (04488afe3 2020-08-24) Cargo path: /root/.cargo/bin/cargo Cargo version: cargo 1.46.0 (149022b1d 2020-07-17) Cargo vendor: yes Python support: yes Python path: /usr/bin/python3 Python distutils yes Python yaml yes Install suricatactl: yes Install suricatasc: yes Install suricata-update: not bundled Profiling enabled: no Profiling locks enabled: no Plugin support (experimental): yes Development settings: Coccinelle / spatch: no Unit tests enabled: no Debug output enabled: no Debug validation enabled: no Generic build parameters: Installation prefix: /usr/local Configuration directory: /usr/local/etc/suricata/ Log directory: /usr/local/var/log/suricata/ --prefix /usr/local --sysconfdir /usr/local/etc --localstatedir /usr/local/var --datarootdir /usr/local/share Host: x86_64-pc-linux-gnu Compiler: clang (exec name) / g++ (real) GCC Protect enabled: no GCC march native enabled: yes GCC Profile enabled: no Position Independent Executable enabled: no CFLAGS -ggdb3 -O0 -Werror -Wchar-subscripts -Wshadow -Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function -fno-strict-aliasing -fstack-protector-all -fsanitize=address -fno-omit-frame-pointer -Wno-unused-parameter -Wno-unused-function -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist PCAP_CFLAGS -I/usr/include SECCFLAGS
Files
Actions