Coredump at /usr/local/src/zeek-4.1.0/src/Val.cc:809

[initconf]

Manager crashed with /usr/local/zeek-4.1.0/share/zeekctl/scripts/run-zeek: line 110: 22186 Segmentation fault (core dumped) nohup "$myzeek" "$@"

Let me know if you need more information

#3  0x0000000000893353 in zeek::AddrVal::AddrVal (this=0x161bd530, addr=...) at /usr/local/src/zeek-4.1.0/src/Val.cc:809
809             addr_val = new IPAddr(addr);
(gdb) p *this
$1 = {<zeek::Val> = {<zeek::Obj> = {_vptr$Obj = 0x4940d8 <vtable for zeek::AddrVal+16>, location = 0x0, ref_cnt = 1, notify_plugins = false, static suppress_errors = 0}, static nil = {ptr_ = 0x0}, type = {ptr_ = 0x2440240}}, addr_val = 0x14eae10}

Full coredump : /home/bro/spool/tmp/post-terminate-manager-2021-10-20-09-10-00-60870-crash

Core was generated by `/usr/local/zeek-4.1.0/bin/zeek -U .status -p zeekctl -p zeekctl-live -p local -p'.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  0x00000008014c46b3 in tcmalloc::CentralFreeList::FetchFromOneSpansSafe(int, void**, void**) () from /usr/local/lib/libtcmalloc.so.4
[Current thread is 1 (LWP 100850)]
(gdb) bt
#0  0x00000008014c46b3 in tcmalloc::CentralFreeList::FetchFromOneSpansSafe(int, void**, void**) () from /usr/local/lib/libtcmalloc.so.4
#1  0x00000008014c4561 in tcmalloc::CentralFreeList::RemoveRange(void**, void**, int) () from /usr/local/lib/libtcmalloc.so.4
#2  0x00000008014c956b in tcmalloc::ThreadCache::FetchFromCentralCache(unsigned int, int, void* (*)(unsigned long)) ()
   from /usr/local/lib/libtcmalloc.so.4
#3  0x0000000000893353 in zeek::AddrVal::AddrVal (this=0x161bd530, addr=...) at /usr/local/src/zeek-4.1.0/src/Val.cc:809
#4  0x0000000000a16345 in zeek::make_intrusive<zeek::AddrVal, zeek::IPAddr> (args=...)
    at /usr/local/src/zeek-4.1.0/src/zeek/IntrusivePtr.h:204
#5  zeek::Broker::detail::val_converter::operator() (this=<optimized out>, a=...) at /usr/local/src/zeek-4.1.0/src/broker/Data.cc:155
#6  caf::visit_impl<zeek::IntrusivePtr<zeek::Val>, 0ul>::apply<zeek::Broker::detail::val_converter&, broker::address&> (f=..., xs=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:128
#7  caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>::operator()<broker::address&>
    (this=<optimized out>, xs=...) at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:138
#8  caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >::apply_impl<zeek::IntrusivePtr<zeek::Val>, caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (x=..., f=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/variant.hpp:256
#9  0x0000000000a1054b in caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >::apply<zeek::IntrusivePtr<zeek::Val>, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (this=0x20, visitor=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/variant.hpp:242
#10 caf::default_sum_type_access<broker::data>::apply<zeek::IntrusivePtr<zeek::Val>, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (x=..., visitor=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/default_sum_type_access.hpp:53
#11 caf::visit_impl<zeek::IntrusivePtr<zeek::Val>, 1ul>::apply<zeek::Broker::detail::val_converter, broker::data> (f=..., x=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:119
#12 caf::visit<zeek::Broker::detail::val_converter, broker::data, , zeek::IntrusivePtr<zeek::Val> >(zeek::Broker::detail::val_converter&&, broker::data&&) (f=..., x=...) at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:147
#13 zeek::Broker::detail::data_to_val (d=<error reading variable: Cannot access memory at address 0x20>, type=<optimized out>)
    at /usr/local/src/zeek-4.1.0/src/broker/Data.cc:838
#14 0x0000000000a17c6d in zeek::Broker::detail::val_converter::operator() (this=<optimized out>, a=std::vector of length 4 = {...})
    at /usr/local/src/zeek-4.1.0/src/broker/Data.cc:459
#15 0x0000000000a1640e in caf::visit_impl<zeek::IntrusivePtr<zeek::Val>, 0ul>::apply<zeek::Broker::detail::val_converter&, std::__1::vector<broker::data, std::__1::allocator<broker::data> >&> (f=..., xs=std::vector of length -18753806 = {...})
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:128
#16 caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>::operator()<std::__1::vector<broker::data, std::__1::allocator<broker::data> >&> (this=<optimized out>, xs=std::vector of length -18753806 = {...})
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:138
#17 caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >::apply_impl<zeek::IntrusivePtr<zeek::Val>, caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (x=..., f=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/variant.hpp:264
#18 0x0000000000a1054b in caf::variant<broker::none, bool, unsigned long, long, double, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, broker::address, broker::subnet, broker::port, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> > >, std::__1::chrono::duration<long, std::__1::ratio<1l, 1000000000l> >, broker::enum_value, std::__1::set<broker::data, std::__1::less<broker::data>, std::__1::allocator<broker::data> >, std::__1::map<broker::data, broker::data, std::__1::less<broker::data>, std::__1::allocator<std::__1::pair<broker::data const, broker::data> > >, std::__1::vector<broker::data, std::__1::allocator<broker::data> > >::apply<zeek::IntrusivePtr<zeek::Val>, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (this=0x20, visitor=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/variant.hpp:242
#19 caf::default_sum_type_access<broker::data>::apply<zeek::IntrusivePtr<zeek::Val>, caf::visit_impl_continuation<zeek::IntrusivePtr<zeek::Val>, 0ul, zeek::Broker::detail::val_converter>&> (x=..., visitor=...)
    at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/default_sum_type_access.hpp:53
    #20 caf::visit_impl<zeek::IntrusivePtr<zeek::Val>, 1ul>::apply<zeek::Broker::detail::val_converter, broker::data> (f=..., x=...) at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:119
#21 caf::visit<zeek::Broker::detail::val_converter, broker::data, , zeek::IntrusivePtr<zeek::Val> >(zeek::Broker::detail::val_converter&&, broker::data&&) (f=..., x=...) at /usr/local/src/zeek-4.1.0/auxil/broker/caf/libcaf_core/caf/sum_type.hpp:147
#22 zeek::Broker::detail::data_to_val (d=<error reading variable: Cannot access memory at address 0x20>, type=<optimized out>) at /usr/local/src/zeek-4.1.0/src/broker/Data.cc:838
#23 0x0000000000a21959 in zeek::Broker::Manager::ProcessEvent (this=<optimized out>, topic=..., ev=...) at /usr/local/src/zeek-4.1.0/src/broker/Manager.cc:1365
#24 0x0000000000a20ff1 in zeek::Broker::Manager::DispatchMessage (this=0x1560180, topic=..., msg=...) at /usr/local/src/zeek-4.1.0/src/broker/Manager.cc:1041
#25 0x0000000000a232e5 in zeek::Broker::Manager::Process (this=0x1560180) at /usr/local/src/zeek-4.1.0/src/broker/Manager.cc:1141
#26 0x0000000000864f70 in zeek::run_state::detail::run_loop () at /usr/local/src/zeek-4.1.0/src/RunState.cc:315
#27 0x000000000064834e in main (argc=<optimized out>, argv=<optimized out>) at /usr/local/src/zeek-4.1.0/src/main.cc:59

[0xxon]

Just guessing around - seems like it dies processing an incoming our outgoing broker message. @Neverlord - do you have any clue from this?

[Neverlord]

@0xxon sorry, just from looking the trace I don't see where it could go wrong.

[0xxon]

@initconf - do you have any more information that might help us reproduce this?

[JustinAzoff]

Was this maybe out of memory? the crash is inside tcmalloc.

[0xxon]

That's a good. Point. @initconf - if there is no more input from you I am going to close this.

[0xxon]

Closing this - if you encounter this again, let us know.