Skip to content

test/erasure-code: fix stack-use-after-scope by replacing initializer_list with array#64238

Merged
tchaikov merged 1 commit intoceph:mainfrom
tchaikov:wip-test-ec-fix-stack-use-after-scope
Jul 3, 2025
Merged

test/erasure-code: fix stack-use-after-scope by replacing initializer_list with array#64238
tchaikov merged 1 commit intoceph:mainfrom
tchaikov:wip-test-ec-fix-stack-use-after-scope

Conversation

@tchaikov
Copy link
Contributor

@tchaikov tchaikov commented Jun 29, 2025

Previously, we used std::array<std::initializer_list, 27> to store a multi-dimensional array. However, initializer_list objects only hold pointers to their underlying data, not the data itself. When initialized with brace-enclosed lists like {0,1,2,3}, the temporary arrays created by these literals are destroyed after the initialization expression completes, leaving the initializer_list objects pointing to deallocated memory.

This caused AddressSanitizer to detect stack-use-after-scope errors when getint() attempted to iterate over the initializer_list contents:

==2085499==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f5fe9803580 at pc 0x55d851bea586 bp 0x7ffc9816a5b0 sp 0x7ffc9816a5a8
READ of size 4 at 0x7f5fe9803580 thread T0
    #0 0x55d851bea585 in getint(std::initializer_list<int>) /home/jenkins-build/build/workspace/ceph-pull-requests/src/test/erasure-code/TestErasureCodeShec_arguments.cc:46:21
    #1 0x55d851bf0258 in int std::__invoke_impl<int, int (*&)(std::initializer_list<int>), std::initializer_list<int>&>(std::__invoke_other, int (*&)(std::initializer_list<int>), std::initializer_list<int>&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
...
Address 0x7f5fe9803580 is located in stack of thread T0 at offset 1408 in frame
    #0 0x55d851bdd07f in create_table_shec432() /home/jenkins-build/build/workspace/ceph-pull-requests/src/test/erasure-code/TestErasureCodeShec_arguments.cc:52

Fix this by using std::array<std::array<int, 4>, 27> instead, which actually owns and stores the data rather than just pointing to it.

Contribution Guidelines

  • To sign and title your commits, please refer to Submitting Patches to Ceph.

  • If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.

  • When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

  • Tracker (select at least one)
    • References tracker ticket
    • Very recent bug; references commit where it was introduced
    • New feature (ticket optional)
    • Doc update (no ticket needed)
    • Code cleanup (no ticket needed)
  • Component impact
    • Affects Dashboard, opened tracker ticket
    • Affects Orchestrator, opened tracker ticket
    • No impact that needs to be tracked
  • Documentation (select at least one)
    • Updates relevant documentation
    • No doc update is appropriate
  • Tests (select at least one)
Show available Jenkins commands

…_list with array

Previously, we used std::array<std::initializer_list<int>, 27> to store
a multi-dimensional array. However, initializer_list objects only hold
pointers to their underlying data, not the data itself. When initialized
with brace-enclosed lists like {0,1,2,3}, the temporary arrays created
by these literals are destroyed after the initialization expression
completes, leaving the initializer_list objects pointing to deallocated
memory.

This caused AddressSanitizer to detect stack-use-after-scope errors when
getint() attempted to iterate over the initializer_list contents:

```
==2085499==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f5fe9803580 at pc 0x55d851bea586 bp 0x7ffc9816a5b0 sp 0x7ffc9816a5a8
READ of size 4 at 0x7f5fe9803580 thread T0
    #0 0x55d851bea585 in getint(std::initializer_list<int>) /home/jenkins-build/build/workspace/ceph-pull-requests/src/test/erasure-code/TestErasureCodeShec_arguments.cc:46:21
    #1 0x55d851bf0258 in int std::__invoke_impl<int, int (*&)(std::initializer_list<int>), std::initializer_list<int>&>(std::__invoke_other, int (*&)(std::initializer_list<int>), std::initializer_list<int>&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
...
Address 0x7f5fe9803580 is located in stack of thread T0 at offset 1408 in frame
    #0 0x55d851bdd07f in create_table_shec432() /home/jenkins-build/build/workspace/ceph-pull-requests/src/test/erasure-code/TestErasureCodeShec_arguments.cc:52
```

Fix this by using std::array<std::array<int, 4>, 27> instead, which
actually owns and stores the data rather than just pointing to it.

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
@tchaikov tchaikov requested a review from adamemerson June 29, 2025 02:27
@tchaikov tchaikov added the tests label Jun 29, 2025
@tchaikov
Copy link
Contributor Author

@adamemerson hi Adam, could you please help review this change?

@tchaikov
Copy link
Contributor Author

jenkins test api

1 similar comment
@tchaikov
Copy link
Contributor Author

tchaikov commented Jul 1, 2025

jenkins test api

Copy link
Contributor

@adamemerson adamemerson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@tchaikov tchaikov merged commit e6178a8 into ceph:main Jul 3, 2025
26 checks passed
@tchaikov tchaikov deleted the wip-test-ec-fix-stack-use-after-scope branch July 3, 2025 04:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants