mirror of https://github.com/OISF/suricata
cybersecurityidsintrusion-detection-systemintrusion-prevention-systemipsnetwork-monitornetwork-monitoringnsmsecuritysuricatathreat-hunting
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4a1a008009
A crash can occurs in the following conditions: * Suricata running in other mode than "workers" * Kernel fill in the ring buffer Under this conditions, it is possible that the capture thread reads a packet that has not yet released by one of the treatment threads because there is no modification done on the ring buffer entry when a packet is read. Doing, this it access to memory which can be released to the kernel and modified. This results in a kind of memory corruption. This bug has only been seen recently and this has to be linked with the read speed improvement recently made in AF_PACKET support. The patch fixes the issue by modifying the tp_status bitmask in the ring buffer. It sets the TP_STATUS_USER_BUSY flag when it is confirmed that the packet will be treated. And at the start of the read, it exits from the reading loop (returning to poll) when it reaches a packet with the flag set. As tp_status is set to 0 during packet release the flag is destroyed when releasing the packet. Regarding concurrency, we've got a sequence of modification. The capture thread read the packet and set the flag, then it passes the queue and the packet get processed by other threads. The change on tp_status are thus made at different time. Regarding the value of the flag, the patch uses the last bit of tp_status to avoid be impacting by a change in kernel. I will propose a patch to have TP_STATUS_USER_BUSY included in kernel as this is a generic issue for multithreading application using AF_PACKET mechanism. |
13 years ago | |
|---|---|---|
| benches | ||
| contrib/file_processor | 14 years ago | |
| doc | 14 years ago | |
| libhtp | 13 years ago | |
| m4 | ||
| qa | 14 years ago | |
| rules | 13 years ago | |
| src | 13 years ago | |
| .gitignore | ||
| COPYING | ||
| ChangeLog | 13 years ago | |
| LICENSE | ||
| Makefile.am | 13 years ago | |
| Makefile.cvs | ||
| acsite.m4 | ||
| autogen.sh | 13 years ago | |
| classification.config | ||
| configure.ac | 13 years ago | |
| doxygen.cfg | 13 years ago | |
| mkinstalldirs | ||
| reference.config | 14 years ago | |
| suricata.yaml.in | 13 years ago | |
| threshold.config | 13 years ago | |