Skip to content

AddressSanitizer: heap-use-after-free on address 0x5140002f77ec at pc 0x62b92f82fb5b bp 0x73673f27d7c0 sp 0x73673f27d7b8 #10707

@ligurio

Description

@ligurio

Bug description

heap-use-after-free

  • OS: Linux
  • OS Version: Ubuntu 24.04
  • Architecture: amd64

Tarantool 3.3.0-entrypoint-161-gbf09135880
Target: Linux-x86_64-Debug
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE
Compiler: Clang-18.1.3
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -fsanitize=address -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/ubuntu/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -fsanitize=address -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/ubuntu/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0

Steps to reproduce

./build/src/tarantool ./test/fuzz/lua/test_engine.lua --workers 800 --test_duration $((60*60*10)) --engine vinyl --verbose --seed 5582

Actual behavior

==574672==ERROR: AddressSanitizer: heap-use-after-free on address 0x5140002f77ec at pc 0x62b92f82fb5b bp 0x73673f27d7c0 sp 0x73673f27d7b8
READ of size 1 at 0x5140002f77ec thread T0                                                                                                         
    #0 0x62b92f82fb5a in space_is_sync /home/ubuntu/tarantool/src/box/space.h:424:22
    #1 0x62b92f834f6e in txn_journal_entry_new /home/ubuntu/tarantool/src/box/txn.c:1008:12      
    #2 0x62b92f82c655 in txn_commit_impl /home/ubuntu/tarantool/src/box/txn.c:1179:8
    #3 0x62b92f82e691 in box_txn_commit_ex /home/ubuntu/tarantool/src/box/txn.c:1405:9                                                    
    #4 0x62b92fb133b0 in lbox_commit /home/ubuntu/tarantool/src/box/lua/init.c:518:6
    #5 0x62b92fd31586 in lj_BC_FUNCC /home/ubuntu/tarantool/build/third_party/luajit/src/lj_vm.S:811
    #6 0x62b92fd5c11a in lua_pcall /home/ubuntu/tarantool/third_party/luajit/src/lj_api.c:1173:12
    #7 0x62b92fbcb202 in luaT_call /home/ubuntu/tarantool/src/lua/utils.c:695:6
    #8 0x62b92fbb5cce in lua_fiber_run_f /home/ubuntu/tarantool/src/lua/fiber.c:435:11
    #9 0x62b92f504049 in fiber_cxx_invoke(int (*)(__va_list_tag*), __va_list_tag*) /home/ubuntu/tarantool/src/lib/core/fiber.h:1324:10
    #10 0x62b92fc2f3f9 in fiber_loop /home/ubuntu/tarantool/src/lib/core/fiber.c:1162:18
    #11 0x62b93067f559 in coro_init /home/ubuntu/tarantool/third_party/coro/coro.c:108:3

0x5140002f77ec is located 428 bytes inside of 436-byte region [0x5140002f7640,0x5140002f77f4)
freed by thread T0 here:
    #0 0x62b92f4bf3ba in free (/home/ubuntu/tarantool/build/src/tarantool+0x2cd3ba) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)
    #1 0x62b9306104da in small_asan_free /home/ubuntu/tarantool/src/lib/small/small/util.c:137:2
    #2 0x62b93060c40e in mempool_free /home/ubuntu/tarantool/src/lib/small/small/mempool_asan.c:83:2
    #3 0x62b92f93710b in tx_complete_batch /home/ubuntu/tarantool/src/box/wal.c:378:2
    #4 0x62b92fc4a3bd in cmsg_deliver /home/ubuntu/tarantool/src/lib/core/cbus.c:350:2
    #5 0x62b92fc4c2ba in cbus_process /home/ubuntu/tarantool/src/lib/core/cbus.c:601:3
    #6 0x62b92f884473 in tx_prio_cb(ev_loop*, ev_watcher*, int) /home/ubuntu/tarantool/src/box/box.cc:5642:2
    #7 0x62b93064fae5 in ev_invoke_pending /home/ubuntu/tarantool/third_party/libev/ev.c:3797:11
    #8 0x62b93065104d in ev_run /home/ubuntu/tarantool/third_party/libev/ev.c:4221:7
    #9 0x62b92fbaafdb in tarantool_lua_run_script /home/ubuntu/tarantool/src/lua/init.c:1218:2
    #10 0x62b92f50319a in main /home/ubuntu/tarantool/src/main.cc:1060:7
    #11 0x73678022a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x73678022a28a in __libc_start_main csu/../csu/libc-start.c:360:3 
    #13 0x62b92f424804 in _start (/home/ubuntu/tarantool/build/src/tarantool+0x232804) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)

previously allocated by thread T0 here:
    #0 0x62b92f4bf653 in malloc (/home/ubuntu/tarantool/build/src/tarantool+0x2cd653) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)
    #1 0x62b93061001c in small_asan_alloc /home/ubuntu/tarantool/src/lib/small/small/util.c:94:24
    #2 0x62b93060c305 in mempool_alloc /home/ubuntu/tarantool/src/lib/small/small/mempool_asan.c:67:4
    #3 0x62b92f933a8d in wal_write_async /home/ubuntu/tarantool/src/box/wal.c:1353:29
    #4 0x62b92f835c5c in journal_write_submit /home/ubuntu/tarantool/src/box/journal.h:277:9
    #5 0x62b92f82cea9 in txn_commit_impl /home/ubuntu/tarantool/src/box/txn.c:1221:6
    #6 0x62b92f82d756 in txn_commit /home/ubuntu/tarantool/src/box/txn.c:1291:9
    #7 0x62b92f852bc3 in box_process_rw /home/ubuntu/tarantool/src/box/box.cc:516:23
    #8 0x62b92f866855 in box_process1 /home/ubuntu/tarantool/src/box/box.cc:3785:9
    #9 0x62b92f869182 in box_delete /home/ubuntu/tarantool/src/box/box.cc:3996:9
    #10 0x62b92fb3d290 in lbox_index_delete /home/ubuntu/tarantool/src/box/lua/index.c:168:11
    #11 0x62b92fd31586 in lj_BC_FUNCC /home/ubuntu/tarantool/build/third_party/luajit/src/lj_vm.S:811

SUMMARY: AddressSanitizer: heap-use-after-free /home/ubuntu/tarantool/src/box/space.h:424:22 in space_is_sync
Shadow bytes around the buggy address:
  0x5140002f7500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7600: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x5140002f7680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x5140002f7700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x5140002f7780: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fa
  0x5140002f7800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5140002f7a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==574672==ABORTING

log and tarantool binary: https://drive.google.com/file/d/1ZRlGXpOoliSt6J_2th3N2tGnJAWAdjJ2/view?usp=drive_link

Expected behavior

no heap-use-after-free

Metadata

Metadata

Assignees

Labels

3.2Target is 3.2 and all newer release/master branchesbugSomething isn't workingcrashfuzzingvinyl

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions