-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: Cursors
-
Storage Engines, Storage Engines - Foundations
-
SE Foundations - Q3+ Backlog
-
3
Context:
- Enable disagg, which generate cursor type of layered.
- wts_verify failed, which will call __wt_debug_cursor_page to dump a page.
Error point:
Inside __wt_debug_cursor_page , the cursor is falsely assumed to be a btree_cursor, which is not true for layered_cursor, and then the following heap-buffer-overflow fault will be triggered.
[2025/10/09 11:43:38.139] format.sh: ./t -c /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/CONFIG.stress -h /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/RUNDIR.6 cache.maximum=3135 quiet=1 [2025/10/09 11:44:38.041] ./format.sh: line 707: 4534 Aborted nohup setsid $cmd > $log 2>&1 [2025/10/09 11:44:40.216] format.sh: job in /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/RUNDIR.3 killed with signal FORMAT_FAILED_TO_KILL_PARENT_THREAD [2025/10/09 11:44:40.216] format.sh: there may be a core dump associated with this failure [2025/10/09 11:44:40.216] format.sh: job in /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/RUNDIR.3 failed [2025/10/09 11:44:40.226] t: process 4534 running [2025/10/09 11:44:40.226] table.2 skipped verify because verify does not support disagg delta pages. [2025/10/09 11:44:40.226] table.3 skipped verify because verify does not support disagg delta pages. [2025/10/09 11:44:40.226] table.2 skipped verify because verify does not support disagg delta pages. [2025/10/09 11:44:40.226] table.3 skipped verify because verify does not support disagg delta pages. [2025/10/09 11:44:40.226] mirror: 277694/277692 mismatch: table:T00001: {0000277694.00/opqrstuvwxyzabcdefghijkl}/{0000277694/MMNOPQRSTUVWXYZ}, table:T00002: {0000277692.00/opqrstuvwxyzabcdefg}/{0000277692/uMNOPQRSTUVWXYZA} [2025/10/09 11:44:40.226] last successful match was 277691 [2025/10/09 11:44:40.226] mirror error: base cursor (table 1): dumping to /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/RUNDIR.3/FAIL.pagedump.1 [2025/10/09 11:44:40.226] mirror error: table cursor (table 2): dumping to /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/RUNDIR.3/FAIL.pagedump.2 [2025/10/09 11:44:40.226] ================================================================= [2025/10/09 11:44:40.226] ==4534==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5160005818d8 at pc 0xffff7fb3b9a8 bp 0xfffff5da3280 sp 0xfffff5da3278 [2025/10/09 11:44:40.226] READ of size 8 at 0x5160005818d8 thread T0 [2025/10/09 11:44:40.226] #0 0xffff7fb3b9a4 in __wt_debug_cursor_page /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/src/btree/bt_debug.c:1076:14 [2025/10/09 11:44:40.226] #1 0xaaaae56f5b04 in cursor_dump_page /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/test/format/format_util.c:283:5 [2025/10/09 11:44:40.226] #2 0xaaaae5732520 in table_verify_mirror /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/test/format/verify.c:388:21 [2025/10/09 11:44:40.226] #3 0xaaaae57309f4 in wts_verify /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/test/format/verify.c:474:13 [2025/10/09 11:44:40.226] #4 0xaaaae572cf14 in main /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/test/format/t.c:415:9 [2025/10/09 11:44:40.226] #5 0xffff7f662554 in __libc_start_call_main (/lib64/libc.so.6+0x30554) (BuildId: 7f46fcd5f30f2f31235144f8192c97c839732436) [2025/10/09 11:44:40.226] #6 0xffff7f662638 in __libc_start_main@GLIBC_2.17 (/lib64/libc.so.6+0x30638) (BuildId: 7f46fcd5f30f2f31235144f8192c97c839732436) [2025/10/09 11:44:40.226] #7 0xaaaae55f082c in _start (/data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/cmake_build/test/format/t+0x6082c) [2025/10/09 11:44:40.226] 0x5160005818d8 is located 568 bytes after 544-byte region [0x516000581480,0x5160005816a0) [2025/10/09 11:44:40.226] allocated by thread T0 here: [2025/10/09 11:44:40.226] #0 0xaaaae56904c8 in calloc /data/mci/01bb46477e468e9b17d7d0a0c518db71/toolchain-builder/tmp/build-llvm-v5.sh-42U/llvm-project-llvmorg/compiler-rt/lib/asan/asan_malloc_linux.cpp:75:3 [2025/10/09 11:44:40.226] #1 0xffff801dc0c8 in __wt_calloc /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/src/os_common/os_alloc.c:68:14 [2025/10/09 11:44:40.226] #2 0xffff7ff95f28 in __wt_clayered_open /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/src/cursor/cur_layered.c:2184:5 [2025/10/09 11:44:40.226] #3 0xffff803cc000 in __session_open_cursor_int /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/src/session/session_api.c:678:13 [2025/10/09 11:44:40.226] #4 0xffff803caf2c in __wt_open_cursor /data/mci/eef067d261e29deab33357a064d2c282/wiredtiger/src/session/session_api.c:805:13