Nginx 1.5.10 + ModSecurity 2.7.7: Process killed by segmentation fault at 10

[ThraaxSession]

The process is killed by Signal 11. The software tries to allocate unassigned memory area.
kernel: [6062665.616763] nginx[8497]: segfault at 10 ip 00007fab654c2581 sp 00007fff401c4db0 error 4 in libapr-1.so.0.4.6[7fab654aa000+30000]

[ThraaxSession]

Hey guys! :)
I'd like to know if something new about the issue. Any feedback please.

Regards
Gino

[zimmerle]

Hi @GinoHereIam we are working on a refactoring of our nginx versions. Beta code is available at:

https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring

Do you mind to test it?

[ThraaxSession]

I'll give feedback in the near future.
Hopefully it works.

[DOSarrest]

We are also seeing this problem. We have tested the nginx_refactoring branch and still observe the same problem...
kernel: nginx[7045]: segfault at 10 ip 00007f6aebb9f1c1 sp 00007fffe1b0f130 error 4 in libapr-1.so.0.4.8[7f6aebb86000+2f000]
This also causes problems with nginx...
[alert] 21527#0: worker process 5999 exited on signal 11
Making modsecurity for nginx VERY unstable. Our current testing is with nginx/1.4.7

[zimmerle]

Hi @DOSarrest, it would be great if you can share more details about this segfault.

Can you send me GDB output? while running the nginx_refactoring branch?

There are instructions on how to do it here:
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual

This GDB output will be very valuable to fix the problem.

Br.,
F.

[DOSarrest]

Hello @zimmerle, Yes, we are willing to do what ever we can to help resolve this.

We located the information on how to do it here...

https://github.com/SpiderLabs/ModSecurity/wiki/Debugging-ModSecurity

and we are going to go try and get you the information right now and will reply shortly.

[zimmerle]

Ops, Sorry I have placed the wrong link.

Thanks this GDB information will be very helpful.

[DOSarrest]

Np problem, Glad to help. If you don't mind, could you also check into #713 we have not had a response on that yet. It's related to nginx refactorying.

[DOSarrest]

Here is what I am getting currently...

# gdb nginx
GNU gdb (Gentoo 7.6.2 p1) 7.6.2
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /usr/sbin/nginx...(no debugging symbols found)...done.
(gdb) run
Starting program: /usr/sbin/nginx 
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
nginx: [warn] duplicate MIME type "text/html" in /etc/nginx/nginx.conf:56

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff703b1c1 in apr_global_mutex_lock () from /usr/lib64/libapr-1.so.0
(gdb) bt full
#0  0x00007ffff703b1c1 in apr_global_mutex_lock () from /usr/lib64/libapr-1.so.0
No symbol table info available.
#1  0x000000000056403e in ?? ()
No symbol table info available.
#2  0x0000000000562a0d in ?? ()
No symbol table info available.
#3  0x00000000005607a2 in ?? ()
No symbol table info available.
#4  0x000000000055b17a in modsecFinishRequest ()
No symbol table info available.
#5  0x0000000000532839 in ?? ()
No symbol table info available.
#6  0x0000000000423d09 in ngx_destroy_pool ()
No symbol table info available.
#7  0x0000000000476b31 in ngx_http_free_request ()
No symbol table info available.
#8  0x00000000004756a3 in ?? ()
No symbol table info available.
#9  0x0000000000474bc7 in ?? ()
No symbol table info available.
#10 0x000000000047482f in ngx_http_finalize_request ()
No symbol table info available.
#11 0x00000000004922e8 in ?? ()
No symbol table info available.
#12 0x000000000049153a in ?? ()
No symbol table info available.
#13 0x00000000004912a4 in ?? ()
No symbol table info available.
#14 0x000000000048fc63 in ?? ()
No symbol table info available.
#15 0x000000000048e133 in ?? ()
No symbol table info available.
#16 0x000000000048c9fb in ?? ()
No symbol table info available.
#17 0x0000000000455e9e in ?? ()
No symbol table info available.
#18 0x000000000044653c in ngx_process_events_and_timers ()
No symbol table info available.
#19 0x00000000004529c1 in ngx_single_process_cycle ()
No symbol table info available.
#20 0x0000000000420b20 in main ()
No symbol table info available.

[DOSarrest]

I'm trying to figure out how to get debugging symbols working

[zimmerle]

Did you had a change to re-compile, both, ModSec and nginx with its respective "debug" enablers?

If so, can you try a "make clean" (or start from a fresh directory) before: "./configure" ... "make install"