Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-21568

use after free in bt_split.c

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 3.2.0-rc4
    • Affects Version/s: 3.2.0-rc3
    • Component/s: Storage
    • None
    • Fully Compatible
    • ALL
    • Hide

      Apply the attached patch that contains the election_timing_workload test and associated framework changes.

      run:

      ./mongo --nodb jstests/replsets/election_timing_workload.js
      Show
      Apply the attached patch that contains the election_timing_workload test and associated framework changes. run: ./mongo --nodb jstests/replsets/election_timing_workload.js

      Running election timing tests with a workload, the Primary will crash, frequently, after oplog truncation. Output from an ASAN build:

      2187817-d20000| 2015-11-19T12:01:29.785-0500 D STORAGE  [WT RecordStoreThread: local.oplog.rs] Truncating the oplog between RecordId(6218908474747668007) and RecordId(6218908479042628027) to remove approximately 20263 records totaling to 4194441 bytes
2188061-d20000| 2015-11-19T12:01:29.786-0500 D STORAGE  [WT RecordStoreThread: local.oplog.rs] Finished truncating the oplog, it now contains approximately 206347 records totaling to 42713539 bytes
2188251-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:collection-11-570436650327984530 res 16
2188371-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:index-12-570436650327984530 res 16
2188486-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:index-13-570436650327984530 res 16
2188601-d20000| 2015-11-19T12:01:30.008-0500 D STORAGE  [ftdc] WT queued drop of  table:index-14-570436650327984530 res 16
2188716-d20000| 2015-11-19T12:01:30.008-0500 D STORAGE  [ftdc] WT queued drop of  table:index-15-570436650327984530 res 16
2188831-d20000| =================================================================
2188905:d20000| ==27065== ERROR: AddressSanitizer: heap-use-after-free on address 0x6004000a4138 at pc 0x3f0f620 bp 0x7f05d763e290 sp 0x7f05d763e288
2189046-d20000| READ of size 8 at 0x6004000a4138 thread T79 
2189098-d20000|     #0 0x3f0f61f in __split_parent /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:887
2189222-d20000|     #1 0x3f1514a in __split_multi /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:1935
2189346-d20000|     #2 0x3f1514a in __wt_split_multi /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:1978
2189473-d20000|     #3 0x3fec912 in __evict_page_dirty_update /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_page.c:293
2189610-d20000|     #4 0x3fec912 in __wt_evict /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_page.c:123
2189732-d20000|     #5 0x3fe2b29 in __evict_page /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:1467
2189856-d20000|     #6 0x3fe3719 in __evict_lru_pages /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:818
2189984-d20000|     #7 0x3fe3719 in __evict_worker /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:434
2190109-d20000|     #8 0x7f0608a96b97 (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x18b97)
2190188-d20000|     #9 0x7f0607c3c181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312
2190286-d20000|     #10 0x7f060796947c in clone /build/buildd/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111
2190403-d20000| 0x6004000a4138 is located 8 bytes inside of 16-byte region [0x6004000a4130,0x6004000a4140)

      db version v3.2.0-rc3-49-ga0771ea
      git version: a0771ea5ec1b44537d3c409e3d712db24fd8e6bb

      mongod has the fix for WT-2224

        1. d20000-afterfix-3.log
          16 kB
          Michael Grundy
        2. ett_load.diff
          9 kB
          Michael Grundy

            Assignee:
            michael.cahill@mongodb.com Michael Cahill (Inactive)
            Reporter:
            michael.grundy Michael Grundy
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: