search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.38k stars 902 forks source link

Segfault in falco #223

Closed jacques- closed 7 years ago

jacques- commented 7 years ago

Falco binary seems to segfault every 10 - 30 minutes. No idea what is triggering this.

gdb /usr/bin/falco core.15764

GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/... Reading symbols from /usr/bin/falco...(no debugging symbols found)...done. [New LWP 15764] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `falco -v'. Program terminated with signal 11, Segmentation fault.

0 0x00000000004b1b14 in sinsp_evt::get_param(unsigned int) ()

Missing separate debuginfos, use: debuginfo-install falco-0.5.0-1.x86_64 (gdb) bt

0 0x00000000004b1b14 in sinsp_evt::get_param(unsigned int) ()

1 0x0000000000570f6a in sinsp_parser::reset(sinsp_evt*) ()

2 0x0000000000572e6b in sinsp_parser::process_event(sinsp_evt*) ()

3 0x0000000000584870 in sinsp::next(sinsp_evt**) ()

4 0x00000000004a87d5 in do_inspect(falco_engine, falco_outputs, sinsp*, std::string&) ()

5 0x00000000004aa747 in falco_init(int, char**) ()

6 0x00007f16426d8b35 in __libc_start_main () from /lib64/libc.so.6

7 0x000000000049a521 in _start ()

mstemm commented 7 years ago

It's likely the same problem as https://github.com/draios/falco/issues/215. Could you try downgrading the sysdig version by hand and see if that fixes the problem?

I'm working on a fix for this (having falco use it's own standalone driver) right now.

jacques- commented 7 years ago

Yup, downgrade worked, thanks!