-
Type:
Bug
-
Resolution: Done
-
Priority:
Major - P3
-
Affects Version/s: 2.7.7
-
Component/s: Concurrency
-
ALL
-
None
-
0
-
None
-
None
-
None
-
None
-
None
-
None
Output from address sanitizer:
==18019==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000046930 at pc 0x1012aba67 bp 0x7fff5fbfa350 sp 0x7fff5fbfa348 READ of size 8 at 0x603000046930 thread T0 ==18019==WARNING: Trying to symbolize code, but external symbolizer is not initialized! #0 0x1012aba66 in mongo::newlm::ResourceId::operator== const resource_id.h:81 #1 0x1012ab5ab in std::equal_to<mongo::newlm::ResourceId>::operator const stl_function.h:200 #2 0x1012e1cb4 in std::tr1::__detail::_Hash_code_base<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, false>::_M_compare const hashtable_policy.h:805 #3 0x1012df876 in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::erase hashtable:1067 #4 0x1012c3d51 in mongo::newlm::LockerImpl::_unlockAndUpdateRequestsList lock_state.cpp:686 #5 0x1012c46b5 in mongo::newlm::LockerImpl::unlock lock_state.cpp:540 #6 0x1012c12e7 in mongo::newlm::LockerImpl::unlockAll lock_state.cpp:397 #7 0x1012127ec in mongo::Lock::DBLock::unlockDB d_concurrency.cpp:276 #8 0x10121223f in mongo::Lock::DBLock::~DBLock d_concurrency.cpp:253 #9 0x101211ff2 in mongo::Lock::DBLock::~DBLock d_concurrency.cpp:252 #10 0x100cf59a0 in mongo::AutoGetCollectionForRead::~AutoGetCollectionForRead client.cpp:257 #11 0x100cf5292 in mongo::AutoGetCollectionForRead::~AutoGetCollectionForRead client.cpp:248 #12 0x1008e3316 in mongo::AuthzManagerExternalStateMongod::findOne authz_manager_external_state_d.cpp:91 #13 0x1008f2071 in mongo::AuthzManagerExternalStateLocal::getStoredAuthorizationVersion authz_manager_external_state_local.cpp:66 #14 0x1008323f1 in mongo::AuthorizationManager::getAuthorizationVersion authorization_manager.cpp:271 #15 0x100829ac7 in mongo::authindex::configureSystemIndexes auth_index_d.cpp:77 #16 0x1000068e8 in mongo::_initAndListen db.cpp:537 #17 0x100001b24 in mongo::initAndListen db.cpp:580 #18 0x100009071 in mongoDbMain db.cpp:816 #19 0x100007e8d in main db.cpp:629 #20 0x1000017d3 in start (in mongod) + 51 #21 0x2 in 0x00000002 (in mongod) 0x603000046930 is located 0 bytes inside of 32-byte region [0x603000046930,0x603000046950) freed by thread T0 here: #0 0x10e150563 in wrap_free (in libclang_rt.asan_osx_dynamic.dylib) + 115 #1 0x1012e2883 in __gnu_cxx::new_allocator<std::tr1::__detail::_Hash_node<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, false> >::deallocate new_allocator.h:97 #2 0x1012e203a in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_deallocate_node hashtable:476 #3 0x1012df9dc in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::erase hashtable:1071 #4 0x1012c3d51 in mongo::newlm::LockerImpl::_unlockAndUpdateRequestsList lock_state.cpp:686 #5 0x1012c46b5 in mongo::newlm::LockerImpl::unlock lock_state.cpp:540 #6 0x1012c12e7 in mongo::newlm::LockerImpl::unlockAll lock_state.cpp:397 #7 0x1012127ec in mongo::Lock::DBLock::unlockDB d_concurrency.cpp:276 #8 0x10121223f in mongo::Lock::DBLock::~DBLock d_concurrency.cpp:253 #9 0x101211ff2 in mongo::Lock::DBLock::~DBLock d_concurrency.cpp:252 #10 0x100cf59a0 in mongo::AutoGetCollectionForRead::~AutoGetCollectionForRead client.cpp:257 #11 0x100cf5292 in mongo::AutoGetCollectionForRead::~AutoGetCollectionForRead client.cpp:248 #12 0x1008e3316 in mongo::AuthzManagerExternalStateMongod::findOne authz_manager_external_state_d.cpp:91 #13 0x1008f2071 in mongo::AuthzManagerExternalStateLocal::getStoredAuthorizationVersion authz_manager_external_state_local.cpp:66 #14 0x1008323f1 in mongo::AuthorizationManager::getAuthorizationVersion authorization_manager.cpp:271 #15 0x100829ac7 in mongo::authindex::configureSystemIndexes auth_index_d.cpp:77 #16 0x1000068e8 in mongo::_initAndListen db.cpp:537 #17 0x100001b24 in mongo::initAndListen db.cpp:580 #18 0x100009071 in mongoDbMain db.cpp:816 #19 0x100007e8d in main db.cpp:629 #20 0x1000017d3 in start (in mongod) + 51 #21 0x2 in 0x00000002 (in mongod) previously allocated by thread T0 here: #0 0x10e150495 in wrap_malloc (in libclang_rt.asan_osx_dynamic.dylib) + 117 #1 0x7fff8ddde36d in operator new(unsigned long) (in libc++abi.dylib) + 29 #2 0x1012fe6f0 in __gnu_cxx::new_allocator<std::tr1::__detail::_Hash_node<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, false> >::allocate new_allocator.h:91 #3 0x1012f98aa in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_allocate_node hashtable:452 #4 0x1012f8b12 in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_insert_bucket hashtable:877 #5 0x1012f7b77 in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_insert hashtable:920 #6 0x1012dbfda in std::tr1::_Hashtable<mongo::newlm::ResourceId, std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*>, std::allocator<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::_Select1st<std::pair<mongo::newlm::ResourceId const, mongo::newlm::LockRequest*> >, std::equal_to<mongo::newlm::ResourceId>, std::tr1::hash<mongo::newlm::ResourceId>, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::insert hashtable:398 #7 0x1012c2a63 in mongo::newlm::LockerImpl::lock lock_state.cpp:442 #8 0x100cf3d28 in mongo::AutoGetCollectionForRead::_init client.cpp:232 #9 0x100cf4e10 in mongo::AutoGetCollectionForRead::AutoGetCollectionForRead client.cpp:217 #10 0x100cf475b in mongo::AutoGetCollectionForRead::AutoGetCollectionForRead client.cpp:218 #11 0x1008e2a30 in mongo::AuthzManagerExternalStateMongod::findOne authz_manager_external_state_d.cpp:79 #12 0x1008f2071 in mongo::AuthzManagerExternalStateLocal::getStoredAuthorizationVersion authz_manager_external_state_local.cpp:66 #13 0x1008323f1 in mongo::AuthorizationManager::getAuthorizationVersion authorization_manager.cpp:271 #14 0x100829ac7 in mongo::authindex::configureSystemIndexes auth_index_d.cpp:77 #15 0x1000068e8 in mongo::_initAndListen db.cpp:537 #16 0x100001b24 in mongo::initAndListen db.cpp:580 #17 0x100009071 in mongoDbMain db.cpp:816 #18 0x100007e8d in main db.cpp:629 #19 0x1000017d3 in start (in mongod) + 51 #20 0x2 in 0x00000002 (in mongod) SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ?? Shadow bytes around the buggy address: 0x1c0600008cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c0600008ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c0600008cf0: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 fa 0x1c0600008d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c0600008d10: fa fa fa fa 00 00 00 fa fa fa fd fd fd fd fa fa =>0x1c0600008d20: 00 00 00 00 fa fa[fd]fd fd fd fa fa fd fd fd fd 0x1c0600008d30: fa fa 00 00 00 00 fa fa fd fd fd fd fa fa 00 00 0x1c0600008d40: 00 06 fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 0x1c0600008d50: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x1c0600008d60: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00 0x1c0600008d70: 00 fa fa fa 00 00 00 fa fa fa fd fd fd fd fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==18019==ABORTING