[Snort-devel] [ snort-Bugs-551080 ] Bus Error with OpenBSD 2.8 & SPARC

noreply at ...12... noreply at ...12...
Mon Aug 26 08:33:10 EDT 2002


Bugs item #551080, was opened at 2002-05-01 13:09
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=551080&group_id=3357

Category: None
Group: None
Status: Closed
Resolution: Fixed
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Bus Error with OpenBSD 2.8 & SPARC

Initial Comment:
I was running snort 1.8.1 and decided to upgrade to
1.8.6. Compiled perfectly, didn't use any compile options.
Got 'bus error' when I ran snort by itself, no arguments.
Tried the same thing with 1.8.5 - same results. Tried
compiling with --debug option.. didn't get any extra
info. Here is the gdb output:

root at ...1350...:snort-1.8.5 {253} gdb snort snort.core 
GNU gdb 4.16.1
Copyright 1996 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public
License, and you are
welcome to change it and/or distribute copies of it
under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show
warranty" for details.
This GDB was configured as "sparc-unknown-openbsd2.8"...
Core was generated by `snort'.
Program terminated with signal 10, Bus error.
Reading symbols from /usr/libexec/ld.so...done.
Reading symbols from /usr/lib/libpcap.so.1.1...done.
Reading symbols from /usr/lib/libm.so.0.1...done.
Reading symbols from /usr/lib/libc.so.25.2...done.
#0  0x46d28 in InitStream4Pkt () at spp_stream4.c:2938
2938        stream_pkt->iph->ip_ver   = 0x4;
(gdb) bt
#0  0x46d28 in InitStream4Pkt () at spp_stream4.c:2938
#1  0x41e20 in Stream4Init (args=0xf7ffcc88
"/var/log/snort/session.log") at spp_stream4.c:597
#2  0x12b34 in ParsePreprocessor (rule=0x802c0 "") at
rules.c:1336
#3  0x1207c in ParseRule (rule_file=0x8183160,
prule=0xf7fff278 "preprocessor stream4: detect_scans", 
    inclevel=0) at rules.c:538
#4  0x1192c in ParseRulesFile (file=0x5b000 "",
inclevel=0) at rules.c:198
#5  0x93a4 in ReadConfFile () at snort.c:3310
#6  0x2e5c in main (argc=1, argv=0xf7fff824) at snort.c:192

Thanks,

John

----------------------------------------------------------------------

Comment By: Brian S. Julin (skids)
Date: 2002-08-21 16:49

Message:
Logged In: YES 
user_id=198509

It's not dead yet.  Stream4 problems still on SPARC.
See http://bugs.debian.org #102772 for backtrace.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-07-19 17:35

Message:
Logged In: NO 

I guess my comments really belong here in the thread. Not 
on a new thread. Sorry everyone!

I had success with snort-1.8.7 by replacing spp_stream4.c 
and spp_stream4.h and spp_frag2.c and spp_frag2.h with the 
files of the same name from the snort-1.9.0beta tarball.

I will diff the files later on and try to figure out what did the 
trick.

I am not sure if this is "orthodox" practice or not, but in my 
case if it works ...

Dan

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-07-10 10:05

Message:
Logged In: NO 

Try running 1.9 CVS 

I removed all bitwise accesses and replaced them with macros
that should hopefully work.



----------------------------------------------------------------------

Comment By: Andrew R. Baker (andrewbaker)
Date: 2002-07-10 09:40

Message:
Logged In: YES 
user_id=308707

fixed in 1.8.7

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-07-10 08:05

Message:
Logged In: NO 

The stream4 bug seems related to an alignment problem and 
to the SPARC_TWIDDLE definition. In I've replaced 

#if defined(SOLARIS) || defined(SUNOS)

by

#if defined(WORDS_MUSTALIGN) || defined(SOLARIS) || 
defined(SUNOS)

in spp_frag2.c and spp_stream4.c and stream4 init works OK 
now. But I can't explain the parameter corruption at entry of 
DecodeNullPkt, which leads to a sigbus in DecodeIP.

Fanch.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-07-09 16:13

Message:
Logged In: NO 

And an update to this.

Removing the stream4 section did keept snort alive for me.

Which at least seems to localize the issue and will keep me
at least informed a bit.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-07-09 16:04

Message:
Logged In: NO 

Hi,

I have the same issue on a Sparc machine with Linux.

uname -a:
Linux hvdkooij.xs4all.nl 2.2.19-6.2.1 #1 Mon Apr 9 22:28:20
EDT 2001 sparc unknown

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-05-27 05:30

Message:
Logged In: NO 

Exactly the same thing happens to me with snort releases
from 1.8.4 up to 1.8.6, on a very recent debian/SPARC woody
installation... the program receives a SIGBUS while
manipulating iph->ip-ver.
Disabling the stream4 preprocessor just moves the bug inside
DecodeIP()...

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-05-18 10:25

Message:
Logged In: NO 

Same thing under RH 6.2 on Sparc:
GNU gdb 4.17.0.11 with Linux support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public 
License, and you are
welcome to change it and/or distribute copies of it under 
certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show 
warranty" for details.
This GDB was configured as "sparc-redhat-linux"...
Core was generated by `./snort -c snort.conf'.
Program terminated with signal 10, Bus error.
Reading symbols from /lib/libm.so.6...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libnss_nisplus.so.2...done.
Reading symbols from /lib/libnss_files.so.2...done.
#0  InitStream4Pkt () at spp_stream4.c:2938
2938        stream_pkt->iph->ip_ver   = 0x4;
(gdb) bt
#0  InitStream4Pkt () at spp_stream4.c:2938
#1  0x4333c in Stream4Init 
(args=0xefffc1d8 "/var/log/snort/session.log")
    at spp_stream4.c:597
#2  0x1d35c in ParsePreprocessor (rule=0xb0c38 "") at 
rules.c:1336
#3  0x1c948 in ParseRule (rule_file=0xb1ac0,
    prule=0xefffe7c0 "preprocessor stream4: detect_scans", 
inclevel=0)
    at rules.c:538
#4  0x1c40c in ParseRulesFile (file=0x83c00 "", inclevel=0) 
at rules.c:198
#5  0x12178 in main (argc=3, argv=0xefffed74) at snort.c:335
#6  0x500b28d0 in __libc_start_main () 
at ../sysdeps/generic/libc-start.c:78


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=551080&group_id=3357




More information about the Snort-devel mailing list