[Oisf-users] Crash for illegal instruction

[Jozef Mlich]

On Fri, 2017-04-21 at 16:54 +0800, tidy at holonetsecurity.com wrote:

Then I can suggest only running it with
gdb --args suricata -c /etc/suricata.yaml --af-packet ..etc..
and explore backtrace where it occurs.

> Jozef,
> 	The Same coredump happen after changing the default config to
> the suggested ones.
> 
> 
> 
> -Tidy
> 
> > On Apr 21, 2017, at 4:41 PM, Jozef Mlich <jozef.mlich at greycortex.co
> > m> wrote:
> > 
> > On Fri, 2017-04-21 at 16:15 +0800, tidy at holonetsecurity.com wrote:
> > 
> > Hi,
> > 
> > I have noticed illegal instruction only with some AMD and hyperscan
> > enabled. You can try it with 
> > 
> > mpm-algo: ac
> > spm-algo: bm 
> > 
> > in suricata.yaml, or as command line argument --set ...
> > 
> > 
> > > Hi,
> > > 	I built Suricata using option "disable-gccmarch-native” in VM
> > > host A (cpu instruction should be newer) which supporting AVX2
> > > and
> > > then run suricata in host B. The Suricata has crashed for for
> > > illegal
> > > instruction (see coredump information). 
> > >       Also, tried the same way in Physical host C with the newer
> > > cpu
> > > instruction and it can run well on Host B.
> > >    
> > >      So, I think the configure option “disable-gccmarch-native”
> > > doesn’t work well on VM. Could some one take a look at this.
> > > 
> > > root:1.212 at work$ /usr/local/bin/suricata --build-info
> > > This is Suricata version 3.2dev
> > > Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET
> > > HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT
> > > HAVE_NSS HAVE_LUA TLS MAGIC 
> > > SIMD support: none
> > > Atomic intrisics: 1 2 4 8 byte(s)
> > > 64-bits, Little-endian architecture
> > > GCC version 4.8.5 20150623 (Red Hat 4.8.5-11), C version 199901
> > > compiled with _FORTIFY_SOURCE=0
> > > L1 cache line size (CLS)=64
> > > thread local storage method: __thread
> > > compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23
> > > 
> > > Suricata Configuration:
> > >   AF_PACKET support:                       yes
> > >   PF_RING support:                         no
> > >   NFQueue support:                         no
> > >   NFLOG support:                           no
> > >   IPFW support:                            no
> > >   Netmap support:                          no
> > >   DAG enabled:                             no
> > >   Napatech enabled:                        no
> > > 
> > >   Unix socket enabled:                     no
> > >   Detection enabled:                       yes
> > > 
> > >   Libmagic support:                        yes
> > >   libnss support:                          yes
> > >   libnspr support:                         yes
> > >   libjansson support:                      no
> > >   hiredis support:                         yes
> > >   Prelude support:                         no
> > >   PCRE jit:                                yes
> > >   LUA support:                             yes
> > >   libluajit:                               no
> > >   libgeoip:                                no
> > >   Non-bundled htp:                         yes
> > >   Old barnyard2 support:                   no
> > >   CUDA enabled:                            no
> > >   Hyperscan support:                       yes
> > >   Libnet support:                          no
> > > 
> > >   Suricatasc install:                      yes
> > > 
> > >   Profiling enabled:                       no
> > >   Profiling locks enabled:                 no
> > > 
> > > Development settings:
> > >   Coccinelle / spatch:                     no
> > >   Unit tests enabled:                      no
> > >   Debug output enabled:                    no
> > >   Debug validation enabled:                no
> > > 
> > > Generic build parameters:
> > >   Installation prefix:                     /usr/local/
> > >   Configuration directory:                
> > > /usr/local/etc/suricata/
> > >   Log directory:                          
> > > /usr/local/var/log/suricata/
> > > 
> > >   --prefix                                 /usr/local/
> > >   --sysconfdir                             /usr/local/etc
> > >   --localstatedir                          /usr/local/var
> > > 
> > >   Host:                                    x86_64-unknown-linux-
> > > gnu
> > >   Compiler:                                gcc (exec name) / gcc
> > > (real)
> > >   GCC Protect enabled:                     no
> > >   GCC march native enabled:                no
> > >   GCC Profile enabled:                     no
> > >   Position Independent Executable enabled: no
> > >   CFLAGS                                   -g -O2
> > >   PCAP_CFLAGS                              
> > > -I/usr/local/deps/include
> > >   SECCFLAGS                                
> > > 
> > > Here is the coredump information, its cored at strtod
> > > 
> > > 
> > > _______________________________________________
> > > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation
> > > .org
> > > Site: http://suricata-ids.org | Support: http://suricata-
> > > ids.org/support/
> > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oi
> > > sf-u
> > > sers
> > -- 
> > Jozef Mlich <jozef.mlich at greycortex.com>
> 
> 
-- 
Jozef Mlich <jozef.mlich at greycortex.com>