[Oisf-users] Crash for illegal instruction
Tom DeCanio
decanio.tom at gmail.com
Fri Apr 21 22:27:12 UTC 2017
I've seen illegal instruction crashes in the pcre library on some VMs.
This sounds similar to your description.
Tom
On Fri, Apr 21, 2017, 6:01 AM Jozef Mlich <jozef.mlich at greycortex.com>
wrote:
> On Fri, 2017-04-21 at 16:54 +0800, tidy at holonetsecurity.com wrote:
>
> Then I can suggest only running it with
> gdb --args suricata -c /etc/suricata.yaml --af-packet ..etc..
> and explore backtrace where it occurs.
>
> > Jozef,
> > The Same coredump happen after changing the default config to
> > the suggested ones.
> >
> >
> >
> > -Tidy
> >
> > > On Apr 21, 2017, at 4:41 PM, Jozef Mlich <jozef.mlich at greycortex.co
> > > m> wrote:
> > >
> > > On Fri, 2017-04-21 at 16:15 +0800, tidy at holonetsecurity.com wrote:
> > >
> > > Hi,
> > >
> > > I have noticed illegal instruction only with some AMD and hyperscan
> > > enabled. You can try it with
> > >
> > > mpm-algo: ac
> > > spm-algo: bm
> > >
> > > in suricata.yaml, or as command line argument --set ...
> > >
> > >
> > > > Hi,
> > > > I built Suricata using option "disable-gccmarch-native” in VM
> > > > host A (cpu instruction should be newer) which supporting AVX2
> > > > and
> > > > then run suricata in host B. The Suricata has crashed for for
> > > > illegal
> > > > instruction (see coredump information).
> > > > Also, tried the same way in Physical host C with the newer
> > > > cpu
> > > > instruction and it can run well on Host B.
> > > >
> > > > So, I think the configure option “disable-gccmarch-native”
> > > > doesn’t work well on VM. Could some one take a look at this.
> > > >
> > > > root:1.212 at work$ /usr/local/bin/suricata --build-info
> > > > This is Suricata version 3.2dev
> > > > Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET
> > > > HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT
> > > > HAVE_NSS HAVE_LUA TLS MAGIC
> > > > SIMD support: none
> > > > Atomic intrisics: 1 2 4 8 byte(s)
> > > > 64-bits, Little-endian architecture
> > > > GCC version 4.8.5 20150623 (Red Hat 4.8.5-11), C version 199901
> > > > compiled with _FORTIFY_SOURCE=0
> > > > L1 cache line size (CLS)=64
> > > > thread local storage method: __thread
> > > > compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23
> > > >
> > > > Suricata Configuration:
> > > > AF_PACKET support: yes
> > > > PF_RING support: no
> > > > NFQueue support: no
> > > > NFLOG support: no
> > > > IPFW support: no
> > > > Netmap support: no
> > > > DAG enabled: no
> > > > Napatech enabled: no
> > > >
> > > > Unix socket enabled: no
> > > > Detection enabled: yes
> > > >
> > > > Libmagic support: yes
> > > > libnss support: yes
> > > > libnspr support: yes
> > > > libjansson support: no
> > > > hiredis support: yes
> > > > Prelude support: no
> > > > PCRE jit: yes
> > > > LUA support: yes
> > > > libluajit: no
> > > > libgeoip: no
> > > > Non-bundled htp: yes
> > > > Old barnyard2 support: no
> > > > CUDA enabled: no
> > > > Hyperscan support: yes
> > > > Libnet support: no
> > > >
> > > > Suricatasc install: yes
> > > >
> > > > Profiling enabled: no
> > > > Profiling locks enabled: no
> > > >
> > > > Development settings:
> > > > Coccinelle / spatch: no
> > > > Unit tests enabled: no
> > > > Debug output enabled: no
> > > > Debug validation enabled: no
> > > >
> > > > Generic build parameters:
> > > > Installation prefix: /usr/local/
> > > > Configuration directory:
> > > > /usr/local/etc/suricata/
> > > > Log directory:
> > > > /usr/local/var/log/suricata/
> > > >
> > > > --prefix /usr/local/
> > > > --sysconfdir /usr/local/etc
> > > > --localstatedir /usr/local/var
> > > >
> > > > Host: x86_64-unknown-linux-
> > > > gnu
> > > > Compiler: gcc (exec name) / gcc
> > > > (real)
> > > > GCC Protect enabled: no
> > > > GCC march native enabled: no
> > > > GCC Profile enabled: no
> > > > Position Independent Executable enabled: no
> > > > CFLAGS -g -O2
> > > > PCAP_CFLAGS
> > > > -I/usr/local/deps/include
> > > > SECCFLAGS
> > > >
> > > > Here is the coredump information, its cored at strtod
> > > >
> > > >
> > > > _______________________________________________
> > > > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation
> > > > .org
> > > > Site: http://suricata-ids.org | Support: http://suricata-
> > > > ids.org/support/
> > > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oi
> > > > sf-u
> > > > sers
> > > --
> > > Jozef Mlich <jozef.mlich at greycortex.com>
> >
> >
> --
> Jozef Mlich <jozef.mlich at greycortex.com>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170421/34415087/attachment-0002.html>
More information about the Oisf-users
mailing list