[go: up one dir, main page]

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Coredump 6.2.0: obj.h:166 zeek::Ref (o=0x0) #3802

Open
initconf opened this issue Jun 28, 2024 · 1 comment
Open

Coredump 6.2.0: obj.h:166 zeek::Ref (o=0x0) #3802

initconf opened this issue Jun 28, 2024 · 1 comment

Comments

@initconf
Copy link
initconf commented Jun 28, 2024

It looks like input-framework does not like when a value in a table is deleted twice, albeit accidentally.

Core was generated by `/usr/local/zeek-6.2.0/bin/zeek -i myri0 -U .status -p zeekctl -p zeekctl-live -p'.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  zeek::Ref (o=0x0) at /usr/local/src/zeek-6.2.0/src/include/zeek/Obj.h:166
166         if ( ++(o->ref_cnt) <= 1 )
[Current thread is 1 (LWP 103142)]
(gdb) bt
#0  zeek::Ref (o=0x0) at /usr/local/src/zeek-6.2.0/src/include/zeek/Obj.h:166
#1  zeek::Val::Ref (this=0x0) at /usr/local/src/zeek-6.2.0/src/include/zeek/Val.h:113
#2  zeek::input::Manager::EndCurrentSend (this=0x8056b8240, reader=<optimized out>) at /usr/local/src/zeek-6.2.0/src/input/Manager.cc:1269
#3  0x0000000000cf4467 in zeek::input::EndCurrentSendMessage::Process (this=<optimized out>) at /usr/local/src/zeek-6.2.0/src/input/ReaderBackend.cc:90
#4  0x0000000001049c49 in zeek::threading::MsgThread::Process (this=0x807017a00) at /usr/local/src/zeek-6.2.0/src/threading/MsgThread.cc:427
#5  0x0000000000fbffb6 in zeek::run_state::detail::run_loop () at /usr/local/src/zeek-6.2.0/src/RunState.cc:289
#6  0x000000000087b5a8 in main (argc=<optimized out>, argv=<optimized out>) at /usr/local/src/zeek-6.2.0/src/main.cc:93
(gdb)

for reference the coredump is : @adhoc ~/spool/tmp/post-terminate-worker-2024-06-28-12-04-19-5665-crash

Here is code which can reproduce the crash - Make sure you run in cluster format. ( I have tried to oversimplify the code so as to distill down as much as while keeping the crash in there. So please don't mind the deviation from good coding conventions)

module ASH;
#redef exit_only_after_terminate = T ;
export {

        redef enum Notice::Type += {
                WhitelistRemoved,
        };

        global whitelist_ip_file: string = "/tmp/ip-whitelist.scan.2" &redef;

        type wl_ip_Idx: record {
                ip: addr;
        };
        type wl_ip_Val: record {
                ip: addr;
                comment: string &optional;
        };
        global whitelist_ip_table: table[addr] of wl_ip_Val = table() &redef;
       global ASH::m_w_remove_ip: event(ip: addr, comment: string);

}

event read_whitelist_ip(description: Input::TableDescription, tpe: Input::Event,
    left: wl_ip_Idx, right: wl_ip_Val)
{
        local _msg = "";
        local ip = right$ip;
        local comment = right?$comment ? right$comment : "";

        if ( tpe == Input::EVENT_REMOVED ) {

                _msg = fmt("%s: %s", ip, comment);
                NOTICE([$note=WhitelistRemoved, $src=right$ip, $msg=_msg]);

@if ( Cluster::is_enabled() )
                Broker::publish(Cluster::worker_topic, ASH::m_w_remove_ip, ip, comment);
@endif
        }

}
event ASH::m_w_remove_ip(ip: addr, comment: string)
{
                delete whitelist_ip_table[ip];  # <---------- crash cause 
}
event zeek_init()
{
                Input::add_table([
                    $source=whitelist_ip_file,
                    $name="whitelist_ip",
                    $idx=wl_ip_Idx,
                    $val=wl_ip_Val,
                    $destination=whitelist_ip_table,
                    $mode=Input::REREAD,
                    $ev=read_whitelist_ip]);
}

here is sample /tmp/ip-whitelist.scan.2

[bro@adhoc /usr/local/zeek-cpp/host/policies]$ cat /YURT/feeds/BRO-feeds/ip-whitelist.scan.2 | head
#fields ip      comment
172.70.162.135  ## 2023-02-07-06:56:19: bro: AUTOMATED ZEEK 
172.70.162.163  ## 2023-02-07-08:25:34: bro: AUTOMATED ZEEK
172.70.162.242  ## 2023-02-08-01:58:49: bro: AUTOMATED ZEEK
172.70.162.26   ## 2023-01-29-07:06:34: bro: AUTOMATED ZEEK 

Side note:

So one would expect this kind of code construct to work even with clusterization and with input-framework ( below works but one above sample crashes if IP is deleted )

module Test;
global t: table[addr] of count ;
event zeek_init()
{
     t[1.1.1.1] = 1 ;
    delete t[2.2.2.2];
    delete t[1.1.1.1];
    delete t[1.1.1.1];
    print fmt ("%s", t);
}

Let me know if any questions or need access to coredump or any further info from backtraces or have issue replicating this!

@awelzel
Copy link
Contributor
awelzel commented Jul 2, 2024

Duplicate of #2984

@awelzel awelzel marked this as a duplicate of #2984 Jul 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants