[Oisf-devel] 4.0.3 Segfault

[Nick Price]

It doesn’t seem to want to segfault with -O0 but I’m gonna keep an eye on it.  Might be a compiler bug.  With -O2 (or whatever the default is) I got some more data from the core dump but the stuff I think we want got optimized out.  Might try a different GCC as well and see if it makes a difference.

Thanks
Nick


> On Dec 16, 2017, at 3:31 AM, Peter Manev <petermanev at gmail.com> wrote:
> 
> 
> 
> On 15 Dec 2017, at 21:49, Nick Price <nick at spun.io <mailto:nick at spun.io>> wrote:
> 
>> Gotten a couple of segfaults today that seem to point to the
>> parse_rpc_packet_header nom macro in the Rust extensions. Haven't been
>> able to get a core dump yet or packet capture, but I'm working on it.
>> 
>> Anyone else seen anything like this? For now I've just disabled nfs in
>> my config and everything has been stable.
> 
> It would be very helpful if you could recompile with debugging enabled ( https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Reporting_Bugs <https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Reporting_Bugs> ) and post a report (once you have a core) after it segfaults again on our redmine tracker.
> 
> 
>> 
>> [ 3190.831668] W#19[51202]: segfault at 0 ip 000000000061ec49 sp
>> 00007f4814ff7f10 error 4 in suricata[400000+345000] 
>> [ 6252.420770] W#58[53247]: segfault at 0 ip 000000000061ec49 sp
>> 00007f05e3ffde00 error 4 in suricata[400000+345000]
>> 
>> root at lpa880:~# addr2line -e /usr/bin/suricata
>> 000000000061ec49                                                       
>> 
>> /root/suricata-4.0.3/rust/src/nfs/rpc_records.rs:67 <http://rpc_records.rs:67/>
>> 
>> Nick
>> _______________________________________________
>> Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org <mailto:oisf-devel at openinfosecfoundation.org>
>> Site: http://suricata-ids.org <http://suricata-ids.org/> | Participate: http://suricata-ids.org/participate/ <http://suricata-ids.org/participate/>
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel <https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel>
>> Redmine: https://redmine.openinfosecfoundation.org/ <https://redmine.openinfosecfoundation.org/>
>> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20171218/d67f3c0b/attachment-0002.html>