[Snort-devel] 2.8.2 - bus errors on OpenBSD/sparc64

Steven Sturges steve.sturges at ...402...
Wed Jun 18 09:31:04 EDT 2008


Hi Markus--

There aren't any significant changes with 2.8.1 to 2.8.2 in
Frag3 -- 2.8.2 changes were related to how rules are processed.

Sounds like an alignment issue somewhere with the 64bit sparc
system.  As we've seen, sparc is much more strict when it comes
to that.  ;) Perhaps the new code pushed things around?

Let us know if you find anything more detailed.

Cheers.
-steve

Todd Wease wrote:
> Hi Markus,
> 
> Thanks for the report.
> 
> Can you provide some more information that might be useful in helping us
> debug the problem?
> 
> What configuration options did you use to compile Snort?
> What command line options did you use to run Snort?
> Did you make any changes in compilation or configuration from when you
> were running 2.8.1?
> 
> Thanks,
> Todd
> 
> 
> Markus Lude wrote:
>> Hello,
>> after updating to 2.8.2 snort crashes every now and then with a bus
>> error. With 2.8.1 I didn't have that problem here. Finally I got a core
>> dump today:
>>
>> (gdb) bt
>> #0  0x00000000001de63c in Frag3NewTracker ()
>> #1  0x00000000001ddda0 in Frag3Defrag ()
>> #2  0x0000000000152278 in Preprocess ()
>> #3  0x000000000013ce4c in ProcessPacket ()
>> #4  0x000000000013c5d4 in PcapProcessPacket ()
>> #5  0x00000000460bbb94 in pcap_read (p=0x433b5200, cnt=-203042, 
>>     callback=0x13c42c <PcapProcessPacket>, user=0x0)
>>     at /usr/src/lib/libpcap/pcap-bpf.c:154
>> #6  0x00000000001441ac in InterfaceThread ()
>> #7  0x000000000013b62c in SnortMain ()
>> #8  0x00000000001392fc in main ()
>>
>> Hopefully I have some time during next days to track this down a bit.
>> It's a bit more difficult since last time because snort don't crashes
>> that fast but only after 1-2 days running here.
>>
>> Regards,
>> Markus
>>
>>
>> -------------------------------------------------------------------------
>> Check out the new SourceForge.net Marketplace.
>> It's the best place to buy or sell services for
>> just about anything Open Source.
>> http://sourceforge.net/services/buy/index.php
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 




More information about the Snort-devel mailing list