Http1 removetx 5921 v12 #423
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closed
So, will you merge this ? |
|
Testing the auto-libhtp-PR pickup with this. Run should be done this afternoon ~4hr |
|
Information: QA ran without warnings. Pipeline 20399 |
Merged
victorjulien
approved these changes
Jun 4, 2024
victorjulien
requested changes
Jun 4, 2024
There was a problem hiding this comment.
Still leads to a double free in Suricata
=================================================================
==24790==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000599c60 at pc 0x7f7550b76117 bp 0x7f751e932ca0 sp 0x7f751e932c90
READ of size 8 at 0x614000599c60 thread T98854 (W#44)
#0 0x7f7550b76116 in htp_tx_get_user_data /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_transaction.c:228
#1 0x55d5d5e9f861 in HTPStateFree (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2d1861)
#2 0x55d5d5ec1083 in AppLayerParserStateProtoCleanup (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2f3083)
#3 0x55d5d5ec114e in AppLayerParserStateCleanup (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2f314e)
#4 0x55d5d60764a3 in FlowCleanupAppLayer (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4a84a3)
#5 0x55d5d607d6f2 in FlowClearMemory (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4af6f2)
#6 0x55d5d60a0d19 in CheckWorkQueue (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d2d19)
#7 0x55d5d60a317b in FlowWorkerProcessLocalFlows (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d517b)
#8 0x55d5d60a4bfc in FlowWorker (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d6bfc)
#9 0x55d5d5e2eaf3 in TmThreadsSlotVarRun (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x260af3)
#10 0x55d5d5e30d2f in TmThreadsSlotVar (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x262d2f)
#11 0x7f7550724ac2 (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2)
#12 0x7f75507b5a03 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x125a03)
0x614000599c60 is located 32 bytes inside of 400-byte region [0x614000599c40,0x614000599dd0)
freed by thread T98854 (W#44) here:
#0 0x7f7550c58537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7f7550b7ad17 in htp_tx_destroy /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_transaction.c:122
#2 0x7f7550b7ad17 in htp_tx_destroy /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_transaction.c:117
#3 0x55d5d5e9fa8f in HTPStateTransactionFree (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2d1a8f)
#4 0x55d5d5ebd9a8 in AppLayerParserTransactionsCleanup (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2ef9a8)
#5 0x55d5d60a2a7d in FlowWorkerFlowTimeout (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d4a7d)
#6 0x55d5d60a0599 in FlowFinish (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d2599)
#7 0x55d5d60a09f8 in CheckWorkQueue (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d29f8)
#8 0x55d5d60a317b in FlowWorkerProcessLocalFlows (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d517b)
#9 0x55d5d60a4bfc in FlowWorker (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x4d6bfc)
#10 0x55d5d5e2eaf3 in TmThreadsSlotVarRun (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x260af3)
#11 0x55d5d5e30d2f in TmThreadsSlotVar (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x262d2f)
#12 0x7f7550724ac2 (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2)
previously allocated by thread T98854 (W#44) here:
#0 0x7f7550c58a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7f7550b75b8f in htp_tx_create /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_transaction.c:59
#2 0x7f7550b59d9c in htp_connp_tx_create /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_connection_parser.c:210
#3 0x7f7550b66479 in htp_connp_REQ_IDLE /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_request.c:966
#4 0x7f7550b66479 in htp_connp_REQ_IDLE /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_request.c:958
#5 0x7f7550b69be4 in htp_connp_req_data /builds/inliniac/suricata-ci/suricata/libhtp/htp/htp_request.c:1091
#6 0x55d5d5ea11eb in HTPHandleRequestData (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2d31eb)
#7 0x55d5d5ebfc8b in AppLayerParserParse (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2f1c8b)
#8 0x55d5d5e81998 in TCPProtoDetect (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2b3998)
#9 0x55d5d5e82b2d in AppLayerHandleTCPData (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x2b4b2d)
#10 0x55d5d619d7dc in ReassembleUpdateAppLayer (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x5cf7dc)
#11 0x55d5d619ddb4 in StreamTcpReassembleAppLayer (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x5cfdb4)
#12 0x55d5d61a13c3 in StreamTcpReassembleHandleSegmentUpdateACK (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x5d33c3)
#13 0x55d5d61a177e in StreamTcpReassembleHandleSegment (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x5d377e)
#14 0x55d5d616994b in HandleEstablishedPacketToClient (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x59b94b)
#15 0x55d5d616c789 in StreamTcpPacketStateEstablished (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x59e789)
#16 0x55d5d617e8a1 in StreamTcpStateDispatch (/builds/inliniac/suricata-ci/suricata/src/.libs/suricata+0x5b08a1)
|
Thinking giving up on this optimization, and working on libhtp-rs 🤔 |
|
Giving up on this optimization, so summing up :
Because of the list structure, which can be realloced, and its elements moved, we cannot keep the index where we put it somewhere to reuse it when replacing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#418 with SV passing for
http-sticky-server:do not pop out of the list when removing a tx, as the list size is used for tx count