[Oisf-users] Crash for illegal instruction

[tidy at holonetsecurity.com]

Jozef,
	The Same coredump happen after changing the default config to the suggested ones.



-Tidy

> On Apr 21, 2017, at 4:41 PM, Jozef Mlich <jozef.mlich at greycortex.com> wrote:
> 
> On Fri, 2017-04-21 at 16:15 +0800, tidy at holonetsecurity.com wrote:
> 
> Hi,
> 
> I have noticed illegal instruction only with some AMD and hyperscan
> enabled. You can try it with 
> 
> mpm-algo: ac
> spm-algo: bm 
> 
> in suricata.yaml, or as command line argument --set ...
> 
> 
>> Hi,
>> 	I built Suricata using option "disable-gccmarch-native” in VM
>> host A (cpu instruction should be newer) which supporting AVX2 and
>> then run suricata in host B. The Suricata has crashed for for illegal
>> instruction (see coredump information). 
>>       Also, tried the same way in Physical host C with the newer cpu
>> instruction and it can run well on Host B.
>>    
>>      So, I think the configure option “disable-gccmarch-native”
>> doesn’t work well on VM. Could some one take a look at this.
>> 
>> root:1.212 at work$ /usr/local/bin/suricata --build-info
>> This is Suricata version 3.2dev
>> Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET
>> HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT
>> HAVE_NSS HAVE_LUA TLS MAGIC 
>> SIMD support: none
>> Atomic intrisics: 1 2 4 8 byte(s)
>> 64-bits, Little-endian architecture
>> GCC version 4.8.5 20150623 (Red Hat 4.8.5-11), C version 199901
>> compiled with _FORTIFY_SOURCE=0
>> L1 cache line size (CLS)=64
>> thread local storage method: __thread
>> compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23
>> 
>> Suricata Configuration:
>>   AF_PACKET support:                       yes
>>   PF_RING support:                         no
>>   NFQueue support:                         no
>>   NFLOG support:                           no
>>   IPFW support:                            no
>>   Netmap support:                          no
>>   DAG enabled:                             no
>>   Napatech enabled:                        no
>> 
>>   Unix socket enabled:                     no
>>   Detection enabled:                       yes
>> 
>>   Libmagic support:                        yes
>>   libnss support:                          yes
>>   libnspr support:                         yes
>>   libjansson support:                      no
>>   hiredis support:                         yes
>>   Prelude support:                         no
>>   PCRE jit:                                yes
>>   LUA support:                             yes
>>   libluajit:                               no
>>   libgeoip:                                no
>>   Non-bundled htp:                         yes
>>   Old barnyard2 support:                   no
>>   CUDA enabled:                            no
>>   Hyperscan support:                       yes
>>   Libnet support:                          no
>> 
>>   Suricatasc install:                      yes
>> 
>>   Profiling enabled:                       no
>>   Profiling locks enabled:                 no
>> 
>> Development settings:
>>   Coccinelle / spatch:                     no
>>   Unit tests enabled:                      no
>>   Debug output enabled:                    no
>>   Debug validation enabled:                no
>> 
>> Generic build parameters:
>>   Installation prefix:                     /usr/local/
>>   Configuration directory:                 /usr/local/etc/suricata/
>>   Log directory:                          
>> /usr/local/var/log/suricata/
>> 
>>   --prefix                                 /usr/local/
>>   --sysconfdir                             /usr/local/etc
>>   --localstatedir                          /usr/local/var
>> 
>>   Host:                                    x86_64-unknown-linux-gnu
>>   Compiler:                                gcc (exec name) / gcc
>> (real)
>>   GCC Protect enabled:                     no
>>   GCC march native enabled:                no
>>   GCC Profile enabled:                     no
>>   Position Independent Executable enabled: no
>>   CFLAGS                                   -g -O2
>>   PCAP_CFLAGS                               -I/usr/local/deps/include
>>   SECCFLAGS                                
>> 
>> Here is the coredump information, its cored at strtod
>> 
>> 
>> _______________________________________________
>> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> Site: http://suricata-ids.org | Support: http://suricata-
>> ids.org/support/
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u
>> sers
> -- 
> Jozef Mlich <jozef.mlich at greycortex.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170421/90df7693/attachment-0002.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PastedGraphic-2.png
Type: image/png
Size: 35752 bytes
Desc: not available
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170421/90df7693/attachment-0002.png>