logging: test for multi-threaded double free in deinit v2 - #3301
Open
lukashino wants to merge 1 commit into
Open
logging: test for multi-threaded double free in deinit v2#3301lukashino wants to merge 1 commit into
lukashino wants to merge 1 commit into
Conversation
This was referenced Aug 22, 2026
There was a problem hiding this comment.
Pull request overview
Adds a new Suricata-verify regression test covering Redmine #8861 (multi-threaded EVE teardown double-free), scoped to Suricata v9+ per the v2 note in the PR description.
Changes:
- Introduce a new test case directory
bug-8861-eve-threaded-flowwith threaded EVE output configuration. - Add shell + filter checks that validate per-thread EVE output, merge records, and assert expected alert/flow content.
- Document the regression scenario and intent in a dedicated README.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| tests/bug-8861-eve-threaded-flow/test.yaml | New test definition validating threaded EVE output via shell and filter checks (with merged JSON preprocessing). |
| tests/bug-8861-eve-threaded-flow/test.rules | Minimal rule to reliably generate EVE alert output for the test. |
| tests/bug-8861-eve-threaded-flow/suricata.yaml | Threaded EVE output configuration (regular filetype, prefix, and alert/flow types). |
| tests/bug-8861-eve-threaded-flow/README.md | Explains the bug mechanism and what the regression test is exercising. |
Suppressed comments (2)
tests/bug-8861-eve-threaded-flow/test.yaml:22
- This shell check uses
cat ... | grep ...(unnecessary) and matches only exactly one space between the prefix and{. Usinggrepdirectly on the files and allowing any whitespace makes the check less fragile without weakening the intent.
args: "cat eve.*.json | grep -v '^@cee: {' | wc -l | xargs"
expect: 0
tests/bug-8861-eve-threaded-flow/test.yaml:25
- The host validation check relies on an exact JSON formatting substring (
"host":"..."). If Suricata ever changes spacing, this becomes a false negative. A whitespace-tolerant regex keeps the semantic check while being more robust.
args: "cat eve.*.json | grep -v '\"host\":\"bug8861sensor\"' | wc -l | xargs"
expect: 0
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # Strip the configured prefix so the remaining payload can be validated as | ||
| # real JSON by the filter checks below. | ||
| pre-check: | | ||
| cat eve.*.json | sed 's/^@cee: //' > merged.json |
Comment on lines
+8
to
+11
| During init phase (LogFileNewThreadedCtx), threads shared prefix/sensor names | ||
| through a shallow copy. | ||
| In the deinit, all threads attempted to free the variables. | ||
| Suricata would then crash as a result of double free. |
victorjulien
approved these changes
Aug 22, 2026
| # own contexts on top of the workers, so at least three files exist even on | ||
| # a single-core host. The exact count tracks the CPU count. | ||
| - shell: | ||
| args: test $(ls eve.*.json | wc -l) -ge 3 |
Member
There was a problem hiding this comment.
this fails on my OpenBSD runner:
===> bug-8861-eve-threaded-flow: Sub test #2: FAIL : Shell command failed: {'args': 'test $(ls eve.*.json | wc -l) -ge 3'} -> b''
victorjulien
requested changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Suricata crashes on double free without the proposed fix as multiple threads free the same shallow-copied variables.
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8861
Describe changes:
v2: