criblio / appscope

Gain observability into any Linux command or application with no code modification
https://appscope.dev
Apache License 2.0
268 stars 33 forks source link

[Bug]: SCOPE_CONF_RELOAD=true results with SIGSEGV #1251

Closed michalbiesek closed 1 year ago

michalbiesek commented 1 year ago

Steps To Reproduce

On arm64 env, during scoping the Cribl using dynamic configuration file results with segfault Dynamic configuration file:

echo "SCOPE_CONF_RELOAD=true" > /tmp/scope.${STREAM_PID} 

The SIGSEGV occurred somewhere in SetConfigFromDoc during the processing of the configuration file scope.yml

Edit: The issue is with content of scope.yml what we are want to reload:

cribl:
    enable: true
    transport:
        path: /opt/edge/state/appscope.sock
        type: unix
event:
    watch:
    -   field: .*
        name: .*
        type: http
        value: .*
libscope:
    log:
        transport:
            path: /var/log/scope/cribl.log
            type: file
    summaryperiod: 60
protocol:
-   detect: false
    name: HTTP
    payload: false
    regex: " HTTP\\/1\\.[0-2]|PRI \\* HTTP\\/2\\.0\r\n\r\nSM\r\n\r\n"
-   binary: true
    detect: false
    len: 6
    name: TLS
    payload: false
    regex: ^16030[0-3].{4}0[12]

Environment

- AppScope: 1.2.1
- OS: Amazon Linux
- Architecture: arm64/x86_64

Requested priority

None

Relevant log output

No response

jrcheli commented 1 year ago

@abetones This is a good candidate for both the known issues list and change log. This issue exists in all versions of AppScope before 1.2.2. The issue is resolved in 1.2.2.

When might a user see this issue? It's only possible if the user has configured protocol definitions, and is reconfiguring a running process.

The crash occurs when the new configuration defines a protocol that the old configuration also defines. It crashes as long as the two protocols have the same name, even if the two definitions are identical.