-
Notifications
You must be signed in to change notification settings - Fork 403
Description
Bug description
heap-use-after-free
- OS: Linux
- OS Version: Ubuntu 24.04
- Architecture: amd64
Tarantool 3.3.0-entrypoint-161-gbf09135880
Target: Linux-x86_64-Debug
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE
Compiler: Clang-18.1.3
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -fsanitize=address -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/ubuntu/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -fsanitize=address -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/ubuntu/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
Steps to reproduce
./build/src/tarantool ./test/fuzz/lua/test_engine.lua --workers 800 --test_duration $((60*60*10)) --engine vinyl --verbose --seed 5582
Actual behavior
==574672==ERROR: AddressSanitizer: heap-use-after-free on address 0x5140002f77ec at pc 0x62b92f82fb5b bp 0x73673f27d7c0 sp 0x73673f27d7b8
READ of size 1 at 0x5140002f77ec thread T0
#0 0x62b92f82fb5a in space_is_sync /home/ubuntu/tarantool/src/box/space.h:424:22
#1 0x62b92f834f6e in txn_journal_entry_new /home/ubuntu/tarantool/src/box/txn.c:1008:12
#2 0x62b92f82c655 in txn_commit_impl /home/ubuntu/tarantool/src/box/txn.c:1179:8
#3 0x62b92f82e691 in box_txn_commit_ex /home/ubuntu/tarantool/src/box/txn.c:1405:9
#4 0x62b92fb133b0 in lbox_commit /home/ubuntu/tarantool/src/box/lua/init.c:518:6
#5 0x62b92fd31586 in lj_BC_FUNCC /home/ubuntu/tarantool/build/third_party/luajit/src/lj_vm.S:811
#6 0x62b92fd5c11a in lua_pcall /home/ubuntu/tarantool/third_party/luajit/src/lj_api.c:1173:12
#7 0x62b92fbcb202 in luaT_call /home/ubuntu/tarantool/src/lua/utils.c:695:6
#8 0x62b92fbb5cce in lua_fiber_run_f /home/ubuntu/tarantool/src/lua/fiber.c:435:11
#9 0x62b92f504049 in fiber_cxx_invoke(int (*)(__va_list_tag*), __va_list_tag*) /home/ubuntu/tarantool/src/lib/core/fiber.h:1324:10
#10 0x62b92fc2f3f9 in fiber_loop /home/ubuntu/tarantool/src/lib/core/fiber.c:1162:18
#11 0x62b93067f559 in coro_init /home/ubuntu/tarantool/third_party/coro/coro.c:108:3
0x5140002f77ec is located 428 bytes inside of 436-byte region [0x5140002f7640,0x5140002f77f4)
freed by thread T0 here:
#0 0x62b92f4bf3ba in free (/home/ubuntu/tarantool/build/src/tarantool+0x2cd3ba) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)
#1 0x62b9306104da in small_asan_free /home/ubuntu/tarantool/src/lib/small/small/util.c:137:2
#2 0x62b93060c40e in mempool_free /home/ubuntu/tarantool/src/lib/small/small/mempool_asan.c:83:2
#3 0x62b92f93710b in tx_complete_batch /home/ubuntu/tarantool/src/box/wal.c:378:2
#4 0x62b92fc4a3bd in cmsg_deliver /home/ubuntu/tarantool/src/lib/core/cbus.c:350:2
#5 0x62b92fc4c2ba in cbus_process /home/ubuntu/tarantool/src/lib/core/cbus.c:601:3
#6 0x62b92f884473 in tx_prio_cb(ev_loop*, ev_watcher*, int) /home/ubuntu/tarantool/src/box/box.cc:5642:2
#7 0x62b93064fae5 in ev_invoke_pending /home/ubuntu/tarantool/third_party/libev/ev.c:3797:11
#8 0x62b93065104d in ev_run /home/ubuntu/tarantool/third_party/libev/ev.c:4221:7
#9 0x62b92fbaafdb in tarantool_lua_run_script /home/ubuntu/tarantool/src/lua/init.c:1218:2
#10 0x62b92f50319a in main /home/ubuntu/tarantool/src/main.cc:1060:7
#11 0x73678022a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x73678022a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#13 0x62b92f424804 in _start (/home/ubuntu/tarantool/build/src/tarantool+0x232804) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)
previously allocated by thread T0 here:
#0 0x62b92f4bf653 in malloc (/home/ubuntu/tarantool/build/src/tarantool+0x2cd653) (BuildId: ad3fa14f33098c75c1c9c78c695a98f1be89dd8e)
#1 0x62b93061001c in small_asan_alloc /home/ubuntu/tarantool/src/lib/small/small/util.c:94:24
#2 0x62b93060c305 in mempool_alloc /home/ubuntu/tarantool/src/lib/small/small/mempool_asan.c:67:4
#3 0x62b92f933a8d in wal_write_async /home/ubuntu/tarantool/src/box/wal.c:1353:29
#4 0x62b92f835c5c in journal_write_submit /home/ubuntu/tarantool/src/box/journal.h:277:9
#5 0x62b92f82cea9 in txn_commit_impl /home/ubuntu/tarantool/src/box/txn.c:1221:6
#6 0x62b92f82d756 in txn_commit /home/ubuntu/tarantool/src/box/txn.c:1291:9
#7 0x62b92f852bc3 in box_process_rw /home/ubuntu/tarantool/src/box/box.cc:516:23
#8 0x62b92f866855 in box_process1 /home/ubuntu/tarantool/src/box/box.cc:3785:9
#9 0x62b92f869182 in box_delete /home/ubuntu/tarantool/src/box/box.cc:3996:9
#10 0x62b92fb3d290 in lbox_index_delete /home/ubuntu/tarantool/src/box/lua/index.c:168:11
#11 0x62b92fd31586 in lj_BC_FUNCC /home/ubuntu/tarantool/build/third_party/luajit/src/lj_vm.S:811
SUMMARY: AddressSanitizer: heap-use-after-free /home/ubuntu/tarantool/src/box/space.h:424:22 in space_is_sync
Shadow bytes around the buggy address:
0x5140002f7500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7600: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x5140002f7680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x5140002f7700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x5140002f7780: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fa
0x5140002f7800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x5140002f7a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==574672==ABORTINGlog and tarantool binary: https://drive.google.com/file/d/1ZRlGXpOoliSt6J_2th3N2tGnJAWAdjJ2/view?usp=drive_link
Expected behavior
no heap-use-after-free