[
https://issues.apache.org/jira/browse/DISPATCH-2056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17341282#comment-17341282
]
Jiri Daněk edited comment on DISPATCH-2056 at 5/8/21, 11:35 AM:
----------------------------------------------------------------
This is from the free_list max = 0 PR build,
https://github.com/apache/qpid-dispatch/runs/2534088828?check_suite_focus=true#step:9:6120
It happened on mainline, I am not 100 % certain 1.16.x has this problem too.
{noformat}
70: E
=================================================================
70: E ==4302==ERROR: AddressSanitizer: heap-use-after-free on address
0x618000030b18 at pc 0x7f8823205231 bp 0x7f88189e8fd0 sp 0x7f88189e8fc0
70: E WRITE of size 8 at 0x618000030b18 thread T4
70: E #0 0x7f8823205230 in qdr_connection_set_context
../src/router_core/connections.c:162
70: E #1 0x7f88230eb7a3 in on_activate
../src/adaptors/tcp_adaptor.c:158
70: E #2 0x7f8823323017 in qd_timer_visit ../src/timer.c:317
70: E #3 0x7f8823310726 in handle ../src/server.c:1006
70: E #4 0x7f882331e805 in thread_run ../src/server.c:1121
70: E #5 0x7f8822b95608 in start_thread
(/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
70: E #6 0x7f882214f292 in __clone
(/lib/x86_64-linux-gnu/libc.so.6+0x122292)
70: E
70: E 0x618000030b18 is located 664 bytes inside of 832-byte region
[0x618000030880,0x618000030bc0)
70: E freed by thread T1 here:
70: E #0 0x7f8823a007cf in __interceptor_free
(/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
70: E #1 0x7f88230f8889 in qd_dealloc ../src/alloc_pool.c:506
70: E #2 0x7f8823297c78 in router_core_thread
../src/router_core/router_core_thread.c:239
70: E #3 0x7f8822b95608 in start_thread
(/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
70: E
70: E previously allocated by thread T4 here:
70: E #0 0x7f8823a01aa5 in posix_memalign
(/lib/x86_64-linux-gnu/libasan.so.5+0x10eaa5)
70: E #1 0x7f88230f16a0 in qd_alloc ../src/alloc_pool.c:398
70: E #2 0x7f8823203b7c in qdr_connection_opened
../src/router_core/connections.c:89
70: E #3 0x7f88230d6ca6 in qdr_tcp_open_server_side_connection
../src/adaptors/tcp_adaptor.c:945
70: E #4 0x7f88230e91bf in qdr_tcp_connection_egress
../src/adaptors/tcp_adaptor.c:1024
70: E #5 0x7f88230ee748 in qd_dispatch_configure_tcp_connector
../src/adaptors/tcp_adaptor.c:1216
70: E #6 0x7f881d17aff4
(/lib/x86_64-linux-gnu/libffi.so.7+0x6ff4)
70: E #7 0x7f88189e800f (<unknown module>)
70: E
70: E Thread T4 created by T0 here:
70: E #0 0x7f882392d805 in pthread_create
(/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
70: E #1 0x7f88231d1e0f in sys_thread ../src/posix/threading.c:181
70: E #2 0x7f882331ee26 in qd_server_run ../src/server.c:1499
70: E #3 0x562adfc911bc in main_process ../router/src/main.c:115
70: E #4 0x562adfc90ce0 in main ../router/src/main.c:369
70: E #5 0x7f88220540b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
70: E
70: E Thread T1 created by T0 here:
70: E #0 0x7f882392d805 in pthread_create
(/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
70: E #1 0x7f88231d1e0f in sys_thread ../src/posix/threading.c:181
70: E #2 0x7f882327db6c in qdr_core
../src/router_core/router_core.c:124
70: E #3 0x7f8823301cc6 in qd_router_setup_late
../src/router_node.c:2123
70: E #4 0x7f881d17aff4
(/lib/x86_64-linux-gnu/libffi.so.7+0x6ff4)
70: E #5 0x7ffdadd005ef ([stack]+0x1e5ef)
70: E
70: E SUMMARY: AddressSanitizer: heap-use-after-free
../src/router_core/connections.c:162 in qdr_connection_set_context
70: E Shadow bytes around the buggy address:
70: E 0x0c307fffe110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E =>0x0c307fffe160: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe170: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
fa
70: E 0x0c307fffe180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
fa
70: E 0x0c307fffe190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe1a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe1b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E Shadow byte legend (one shadow byte represents 8 application
bytes):
70: E Addressable: 00
70: E Partially addressable: 01 02 03 04 05 06 07
70: E Heap left redzone: fa
70: E Freed heap region: fd
70: E Stack left redzone: f1
70: E Stack mid redzone: f2
70: E Stack right redzone: f3
70: E Stack after return: f5
70: E Stack use after scope: f8
70: E Global redzone: f9
70: E Global init order: f6
70: E Poisoned by user: f7
70: E Container overflow: fc
70: E Array cookie: ac
70: E Intra object redzone: bb
70: E ASan internal: fe
70: E Left alloca redzone: ca
70: E Right alloca redzone: cb
70: E Shadow gap: cc
70: E ==4302==ABORTING
70: E <<<<
70:
70:
/home/runner/work/qpid-dispatch/qpid-dispatch/qpid-dispatch/tests/system_test.py:808:
RuntimeError
{noformat}
was (Author: jdanek):
This is from the free_list max = 0 PR build,
https://github.com/apache/qpid-dispatch/runs/2534088828?check_suite_focus=true#step:9:6120
{noformat}
70: E
=================================================================
70: E ==4302==ERROR: AddressSanitizer: heap-use-after-free on address
0x618000030b18 at pc 0x7f8823205231 bp 0x7f88189e8fd0 sp 0x7f88189e8fc0
70: E WRITE of size 8 at 0x618000030b18 thread T4
70: E #0 0x7f8823205230 in qdr_connection_set_context
../src/router_core/connections.c:162
70: E #1 0x7f88230eb7a3 in on_activate
../src/adaptors/tcp_adaptor.c:158
70: E #2 0x7f8823323017 in qd_timer_visit ../src/timer.c:317
70: E #3 0x7f8823310726 in handle ../src/server.c:1006
70: E #4 0x7f882331e805 in thread_run ../src/server.c:1121
70: E #5 0x7f8822b95608 in start_thread
(/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
70: E #6 0x7f882214f292 in __clone
(/lib/x86_64-linux-gnu/libc.so.6+0x122292)
70: E
70: E 0x618000030b18 is located 664 bytes inside of 832-byte region
[0x618000030880,0x618000030bc0)
70: E freed by thread T1 here:
70: E #0 0x7f8823a007cf in __interceptor_free
(/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
70: E #1 0x7f88230f8889 in qd_dealloc ../src/alloc_pool.c:506
70: E #2 0x7f8823297c78 in router_core_thread
../src/router_core/router_core_thread.c:239
70: E #3 0x7f8822b95608 in start_thread
(/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
70: E
70: E previously allocated by thread T4 here:
70: E #0 0x7f8823a01aa5 in posix_memalign
(/lib/x86_64-linux-gnu/libasan.so.5+0x10eaa5)
70: E #1 0x7f88230f16a0 in qd_alloc ../src/alloc_pool.c:398
70: E #2 0x7f8823203b7c in qdr_connection_opened
../src/router_core/connections.c:89
70: E #3 0x7f88230d6ca6 in qdr_tcp_open_server_side_connection
../src/adaptors/tcp_adaptor.c:945
70: E #4 0x7f88230e91bf in qdr_tcp_connection_egress
../src/adaptors/tcp_adaptor.c:1024
70: E #5 0x7f88230ee748 in qd_dispatch_configure_tcp_connector
../src/adaptors/tcp_adaptor.c:1216
70: E #6 0x7f881d17aff4
(/lib/x86_64-linux-gnu/libffi.so.7+0x6ff4)
70: E #7 0x7f88189e800f (<unknown module>)
70: E
70: E Thread T4 created by T0 here:
70: E #0 0x7f882392d805 in pthread_create
(/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
70: E #1 0x7f88231d1e0f in sys_thread ../src/posix/threading.c:181
70: E #2 0x7f882331ee26 in qd_server_run ../src/server.c:1499
70: E #3 0x562adfc911bc in main_process ../router/src/main.c:115
70: E #4 0x562adfc90ce0 in main ../router/src/main.c:369
70: E #5 0x7f88220540b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
70: E
70: E Thread T1 created by T0 here:
70: E #0 0x7f882392d805 in pthread_create
(/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
70: E #1 0x7f88231d1e0f in sys_thread ../src/posix/threading.c:181
70: E #2 0x7f882327db6c in qdr_core
../src/router_core/router_core.c:124
70: E #3 0x7f8823301cc6 in qd_router_setup_late
../src/router_node.c:2123
70: E #4 0x7f881d17aff4
(/lib/x86_64-linux-gnu/libffi.so.7+0x6ff4)
70: E #5 0x7ffdadd005ef ([stack]+0x1e5ef)
70: E
70: E SUMMARY: AddressSanitizer: heap-use-after-free
../src/router_core/connections.c:162 in qdr_connection_set_context
70: E Shadow bytes around the buggy address:
70: E 0x0c307fffe110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E =>0x0c307fffe160: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe170: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
fa
70: E 0x0c307fffe180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
fa
70: E 0x0c307fffe190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe1a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E 0x0c307fffe1b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
fd
70: E Shadow byte legend (one shadow byte represents 8 application
bytes):
70: E Addressable: 00
70: E Partially addressable: 01 02 03 04 05 06 07
70: E Heap left redzone: fa
70: E Freed heap region: fd
70: E Stack left redzone: f1
70: E Stack mid redzone: f2
70: E Stack right redzone: f3
70: E Stack after return: f5
70: E Stack use after scope: f8
70: E Global redzone: f9
70: E Global init order: f6
70: E Poisoned by user: f7
70: E Container overflow: fc
70: E Array cookie: ac
70: E Intra object redzone: bb
70: E ASan internal: fe
70: E Left alloca redzone: ca
70: E Right alloca redzone: cb
70: E Shadow gap: cc
70: E ==4302==ABORTING
70: E <<<<
70:
70:
/home/runner/work/qpid-dispatch/qpid-dispatch/qpid-dispatch/tests/system_test.py:808:
RuntimeError
{noformat}
> AddressSanitizer: use-after-poison in qdr_connection_set_context during
> system_tests_tcp_adaptor, system_tests_http2
> --------------------------------------------------------------------------------------------------------------------
>
> Key: DISPATCH-2056
> URL: https://issues.apache.org/jira/browse/DISPATCH-2056
> Project: Qpid Dispatch
> Issue Type: Bug
> Components: Protocol Adaptors
> Affects Versions: 1.16.0
> Reporter: Jiri Daněk
> Priority: Major
> Fix For: 1.16.0
>
>
> The pool poison PR is new and untried, so this report needs to be taken with
> a portion of healthy scepticism.
> https://travis-ci.com/github/apache/qpid-dispatch/jobs/498888397#L30319
> {noformat}
> 72: =================================================================
> 3216172: ==18570==ERROR: AddressSanitizer: use-after-poison on address
> 0x61800006fb18 at pc 0x7ffa2c7dab05 bp 0x7ffa226d1190 sp 0x7ffa226d1188
> 3216272: WRITE of size 8 at 0x61800006fb18 thread T4
> 3216372: #0 0x7ffa2c7dab04 in qdr_connection_set_context
> /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:162:28
> 3216472: #1 0x7ffa2c6de93c in handle_disconnected
> /home/travis/build/apache/qpid-dispatch/src/adaptors/tcp_adaptor.c:364:9
> 3216572: #2 0x7ffa2c6de93c in handle_connection_event
> /home/travis/build/apache/qpid-dispatch/src/adaptors/tcp_adaptor.c:655:9
> 3216672: #3 0x7ffa2c908291 in handle
> /home/travis/build/apache/qpid-dispatch/src/server.c
> 3216772: #4 0x7ffa2c901c6f in thread_run
> /home/travis/build/apache/qpid-dispatch/src/server.c:1122:23
> 3216872: #5 0x7ffa2c363608 in start_thread
> (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
> 3216972: #6 0x7ffa2bb8e292 in clone
> (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
> 3217072:
> 3217172: 0x61800006fb18 is located 664 bytes inside of 832-byte region
> [0x61800006f880,0x61800006fbc0)
> 3217272: allocated by thread T4 here:
> 3217372: #0 0x496f97 in posix_memalign
> (/home/travis/build/apache/qpid-dispatch/build/router/qdrouterd+0x496f97)
> 3217472: #1 0x7ffa2c6eff9e in qd_alloc
> /home/travis/build/apache/qpid-dispatch/src/alloc_pool.c:398:13
> 3217572: #2 0x7ffa2c7d4c8e in new_qdr_connection_t
> /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:44:1
> 3217672: #3 0x7ffa2c7d4c8e in qdr_connection_opened
> /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:89:32
> 3217772: #4 0x7ffa2c6e16f7 in qdr_tcp_open_server_side_connection
> /home/travis/build/apache/qpid-dispatch/src/adaptors/tcp_adaptor.c:761:30
> 3217872: #5 0x7ffa2c6df1c0 in handle_connection_event
> /home/travis/build/apache/qpid-dispatch/src/adaptors/tcp_adaptor.c:625:17
> 3217972: #6 0x7ffa2c908291 in handle
> /home/travis/build/apache/qpid-dispatch/src/server.c
> 3218072: #7 0x7ffa2c901c6f in thread_run
> /home/travis/build/apache/qpid-dispatch/src/server.c:1122:23
> 3218172: #8 0x7ffa2c363608 in start_thread
> (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
> 3218272:
> 3218372: Thread T4 created by T0 here:
> 3218472: #0 0x480f0a in pthread_create
> (/home/travis/build/apache/qpid-dispatch/build/router/qdrouterd+0x480f0a)
> 3218572: #1 0x7ffa2c7a7b9d in sys_thread
> /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:183:5
> 3218672: #2 0x7ffa2c90152e in qd_server_run
> /home/travis/build/apache/qpid-dispatch/src/server.c:1485:22
> 3218772: #3 0x4c7bbb in main_process
> /home/travis/build/apache/qpid-dispatch/router/src/main.c:115:5
> 3218872: #4 0x4c6876 in main
> /home/travis/build/apache/qpid-dispatch/router/src/main.c:369:9
> 3218972: #5 0x7ffa2ba930b2 in __libc_start_main
> (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
> 3219072:
> 3219172: SUMMARY: AddressSanitizer: use-after-poison
> /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:162:28
> in qdr_connection_set_context
> 3219272: Shadow bytes around the buggy address:
> 3219372: 0x0c3080005f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 3219472: 0x0c3080005f20: 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3219572: 0x0c3080005f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3219672: 0x0c3080005f40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3219772: 0x0c3080005f50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3219872: =>0x0c3080005f60: f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3219972: 0x0c3080005f70: f7 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
> 3220072: 0x0c3080005f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> 3220172: 0x0c3080005f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 3220272: 0x0c3080005fa0: 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3220372: 0x0c3080005fb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
> 3220472: Shadow byte legend (one shadow byte represents 8 application bytes):
> 3220572: Addressable: 00
> 3220672: Partially addressable: 01 02 03 04 05 06 07
> 3220772: Heap left redzone: fa
> 3220872: Freed heap region: fd
> 3220972: Stack left redzone: f1
> 3221072: Stack mid redzone: f2
> 3221172: Stack right redzone: f3
> 3221272: Stack after return: f5
> 3221372: Stack use after scope: f8
> 3221472: Global redzone: f9
> 3221572: Global init order: f6
> 3221672: Poisoned by user: f7
> 3221772: Container overflow: fc
> 3221872: Array cookie: ac
> 3221972: Intra object redzone: bb
> 3222072: ASan internal: fe
> 3222172: Left alloca redzone: ca
> 3222272: Right alloca redzone: cb
> 3222372: Shadow gap: cc
> 3222472: ==18570==ABORTING
> {noformat}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
