AddressSanitizer: stack-buffer-underflow in BlobStore::write #4054
Description
Bug Report
Please answer these questions before submitting your issue. Thanks!
1. Minimal reproduce step (Required)
# Only available under Linux
> cat ../tests/sanitize/asan.suppression
leak:fiu_enable
> cmake -DCMAKE_BUILD_TYPE=ASan -DENABLE_TESTS=ON -GNinja ..
> ninja -j16 gtests_dbms && LSAN_OPTIONS=suppressions=../tests/sanitize/asan.suppression ./dbms/gtests_dbms --gtest_filter='*PageDirectoryTest*:*PageDirectoryGCTest*:*VersionedEntriesTest*:*LogFileRWTest*:*WALSeriTest*:*WALStoreTest*:*WALLognameTest*:*WALLognameSetTest*:*PageStorageWith2PagesTest*:*PageStorageTest*:*SpaceMapTest*:*BlobStoreTest*:*BlobStoreStatsTest*'
2. What did you expect to see? (Required)
3. What did you see instead (Required)
[ RUN ] BlobStoreTest.testBlobStoreGcStats
[2022/02/16 17:46:59.778 +08:00] [DEBUG] [BlobStore.cpp:769] ["BlobStore:Created a new BlobStat [blob_id=1]"] [thread_id=1]
=================================================================
==119854==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fff87638880 at pc 0x000005806bb7 bp 0x7fff87638870 sp 0x7fff87638038
READ of size 1024 at 0x7fff87638880 thread T0
#0 0x5806bb6 in __asan_memcpy /root/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
#1 0x5976515 in DB::ReadBuffer::read(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:135:13
#2 0x5976515 in DB::ReadBuffer::readStrict(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:146:18
#3 0xc73d710 in DB::PS::V3::BlobStore::write(DB::WriteBatch&, std::__1::shared_ptr<DB::WriteLimiter> const&) /DATA/disk1/jaysonhuang/tics/dbms/src/Storages/Page/V3/BlobStore.cpp:118:32
#4 0x8f3b78f in DB::PS::V3::tests::BlobStoreTest_testBlobStoreGcStats_Test::TestBody() /DATA/disk1/jaysonhuang/tics/dbms/src/Storages/Page/V3/tests/gtest_blob_store.cpp:707:28
#5 0x191504f0 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2401:10
#6 0x191504f0 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2437:14
#7 0x19100a88 in testing::Test::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2473:5
#8 0x19103b97 in testing::TestInfo::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2655:11
#9 0x191050ff in testing::TestCase::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2773:28
#10 0x191202f8 in testing::internal::UnitTestImpl::RunAllTests() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:4673:43
#11 0x19152520 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2401:10
#12 0x19152520 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2437:14
#13 0x1911ef1a in testing::UnitTest::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:4281:10
#14 0x93efc1a in RUN_ALL_TESTS() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/include/gtest/gtest.h:2237:46
#15 0x93efc1a in main /DATA/disk1/jaysonhuang/tics/dbms/src/TestUtils/gtests_dbms_main.cpp:22:16
#16 0x7f0a8439d554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#17 0x578b268 in _start (/DATA/disk1/jaysonhuang/tics/cmake-build-asan/dbms/gtests_dbms+0x578b268)
Address 0x7fff87638880 is located in stack of thread T0 at offset 0 in frame
#0 0x59762df in DB::ReadBuffer::readStrict(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:145
This frame has 1 object(s):
[32, 56) 'ref.tmp' (line 147) <== Memory access at offset 0 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-underflow /root/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
Shadow bytes around the buggy address:
0x100070ebf0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100070ebf0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100070ebf0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100070ebf0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100070ebf100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100070ebf110:[f1]f1 f1 f1 f8 f8 f8 f3 f3 f3 f3 f3 00 00 00 00
0x100070ebf120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100070ebf130: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8
0x100070ebf140: f8 f8 f2 f2 f2 f2 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8
0x100070ebf150: f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 00 f2 f2 f2 f8 f8
0x100070ebf160: f8 f2 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==119854==ABORTING
[ RUN ] BlobStoreTest.testBlobStoreGcStats2
[2022/02/16 17:50:21.680 +08:00] [DEBUG] [BlobStore.cpp:769] ["BlobStore:Created a new BlobStat [blob_id=1]"] [thread_id=1]
=================================================================
==122799==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffc65888040 at pc 0x000005806bb7 bp 0x7ffc65888030 sp 0x7ffc658877f8
READ of size 1024 at 0x7ffc65888040 thread T0
#0 0x5806bb6 in __asan_memcpy /root/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
#1 0x5976515 in DB::ReadBuffer::read(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:135:13
#2 0x5976515 in DB::ReadBuffer::readStrict(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:146:18
#3 0xc73d710 in DB::PS::V3::BlobStore::write(DB::WriteBatch&, std::__1::shared_ptr<DB::WriteLimiter> const&) /DATA/disk1/jaysonhuang/tics/dbms/src/Storages/Page/V3/BlobStore.cpp:118:32
#4 0x8f42223 in DB::PS::V3::tests::BlobStoreTest_testBlobStoreGcStats2_Test::TestBody() /DATA/disk1/jaysonhuang/tics/dbms/src/Storages/Page/V3/tests/gtest_blob_store.cpp:790:28
#5 0x191504f0 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2401:10
#6 0x191504f0 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2437:14
#7 0x19100a88 in testing::Test::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2473:5
#8 0x19103b97 in testing::TestInfo::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2655:11
#9 0x191050ff in testing::TestCase::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2773:28
#10 0x191202f8 in testing::internal::UnitTestImpl::RunAllTests() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:4673:43
#11 0x19152520 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2401:10
#12 0x19152520 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:2437:14
#13 0x1911ef1a in testing::UnitTest::Run() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/src/gtest.cc:4281:10
#14 0x93efc1a in RUN_ALL_TESTS() /DATA/disk1/jaysonhuang/tics/contrib/googletest/googletest/include/gtest/gtest.h:2237:46
#15 0x93efc1a in main /DATA/disk1/jaysonhuang/tics/dbms/src/TestUtils/gtests_dbms_main.cpp:22:16
#16 0x7f2db8a32554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#17 0x578b268 in _start (/DATA/disk1/jaysonhuang/tics/cmake-build-asan/dbms/gtests_dbms+0x578b268)
Address 0x7ffc65888040 is located in stack of thread T0 at offset 0 in frame
#0 0x59762df in DB::ReadBuffer::readStrict(char*, unsigned long) /DATA/disk1/jaysonhuang/tics/dbms/src/IO/ReadBuffer.h:145
This frame has 1 object(s):
[32, 56) 'ref.tmp' (line 147) <== Memory access at offset 0 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-underflow /root/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
Shadow bytes around the buggy address:
0x10000cb08fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb08fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb08fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb08fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb08ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10000cb09000: 00 00 00 00 00 00 00 00[f1]f1 f1 f1 f8 f8 f8 f3
0x10000cb09010: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb09020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000cb09030: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8
0x10000cb09040: f8 f8 f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8
0x10000cb09050: f2 f2 00 f2 f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==122799==ABORTING