Alexander Gorrod added a comment - Dec 15 2015 06:34:21 AM +00:00 Keith Bostic I've reverted the merge, since it caused a Jenkins failure: http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer/7972/changes The failure is: ==4943==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6070000f1da8 at pc 0x000000bec44e bp 0x7ffcfadab170 sp 0x7ffcfadab168 READ of size 8 at 0x6070000f1da8 thread T0 #0 0xbec44d in __check_leaf_key_range /home/alexg/work/wiredtiger/build_posix/../src/btree/row_srch.c:167:6 #1 0xbe4462 in __wt_row_search /home/alexg/work/wiredtiger/build_posix/../src/btree/row_srch.c:262:4 #2 0xeff509 in __cursor_row_search /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_cursor.c:251:2 #3 0xefd796 in __wt_btcur_search /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_cursor.c:329:3 #4 0xc89353 in __curfile_search /home/alexg/work/wiredtiger/build_posix/../src/cursor/cur_file.c:200:2 #5 0x4dfbd2 in read_row /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/ops.c:650:9 #6 0x4de64d in wts_read_scan /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/ops.c:602:14 #7 0x4ef6e5 in main /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/t.c:213:5 #8 0x7f37a1a7378f in __libc_start_main (/lib64/libc.so.6+0x2078f) #9 0x4c3808 in _start (/home/alexg/work/wiredtiger/build_posix/test/format/t+0x4c3808)   0x6070000f1da8 is located 0 bytes to the right of 72-byte region [0x6070000f1d60,0x6070000f1da8) allocated by thread T0 here: #0 0x4a62d0 in calloc (/home/alexg/work/wiredtiger/build_posix/test/format/t+0x4a62d0) #1 0x6f23b2 in __wt_calloc /home/alexg/work/wiredtiger/build_posix/../src/os_posix/os_alloc.c:60:11 #2 0xa56948 in __wt_page_alloc /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_page.c:82:3 #3 0xa59a7d in __wt_page_inmem /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_page.c:194:2 #4 0xa73aaf in __page_read /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_read.c:392:2 #5 0xa6f89e in __wt_page_in_func /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_read.c:486:4 #6 0xbf2a71 in __wt_page_swap_func /home/alexg/work/wiredtiger/build_posix/../src/include/btree.i:1307:8 #7 0xbe7166 in __wt_row_search /home/alexg/work/wiredtiger/build_posix/../src/btree/row_srch.c:430:14 #8 0xeff509 in __cursor_row_search /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_cursor.c:251:2 #9 0xefdcac in __wt_btcur_search /home/alexg/work/wiredtiger/build_posix/../src/btree/bt_cursor.c:337:3 #10 0xc89353 in __curfile_search /home/alexg/work/wiredtiger/build_posix/../src/cursor/cur_file.c:200:2 #11 0x4dfbd2 in read_row /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/ops.c:650:9 #12 0x4de64d in wts_read_scan /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/ops.c:602:14 #13 0x4ef6e5 in main /home/alexg/work/wiredtiger/build_posix/test/format/../../../test/format/t.c:213:5 #14 0x7f37a1a7378f in __libc_start_main (/lib64/libc.so.6+0x2078f)   SUMMARY: AddressSanitizer: heap-buffer-overflow /home/alexg/work/wiredtiger/build_posix/../src/btree/row_srch.c:167 __check_leaf_key_range The failure reproduces for me with an address sanitizer build. The test/format config is: ############################################ # RUN PARAMETERS ############################################ abort=0 auto_throttle=0 backups=0 bitcnt=1 bloom=1 bloom_bit_count=53 bloom_hash_count=15 bloom_oldest=0 cache=41 checkpoints=1 checksum=uncompressed chunk_size=6 compaction=0 compression=zlib-noraw data_extend=1 data_source=table delete_pct=37 dictionary=0 direct_io=0 encryption=rotn-7 evict_max=3 file_type=row-store firstfit=0 huffman_key=0 huffman_value=0 in_memory=0 insert_pct=24 internal_key_truncation=1 internal_page_max=9 isolation=read-uncommitted key_gap=6 key_max=256 key_min=256 leaf_page_max=9 leak_memory=0 logging=1 logging_archive=0 logging_compression=zlib logging_prealloc=1 long_running_txn=0 lsm_worker_threads=3 merge_max=15 mmap=1 ops=100000 prefix_compression=1 prefix_compression_min=8 repeat_data_pct=30 reverse=0 rows=100000 runs=1 salvage=1 split_pct=44 statistics=0 statistics_server=0 threads=29 timer=20 value_max=3232 value_min=10 verify=1 wiredtiger_config= write_pct=56 ############################################ I think the fix is: --- a/src/btree/row_srch.c +++ b/src/btree/row_srch.c @@ -164,7 +164,7 @@ __check_leaf_key_range(WT_SESSION_IMPL *session, */ WT_INTL_INDEX_GET(session, leaf->home, pindex); indx = leaf->pindex_hint; - if (indx > pindex->entries || pindex->index[indx] != leaf) + if (indx >= pindex->entries || pindex->index[indx] != leaf) return (0);   /* If you agree, please open a new pull request (still on this ticket is fine), and add the content back in. The complexity in doing the check of how much content belongs on this page is making me question the benefit of this optimization. I see that in a case with leaf pages that have a lot of entries it can save binary search steps. Do you have real world examples where this will help noticeably?

Githook User added a comment - Dec 15 2015 03:10:10 PM +00:00 Author: {u'username': u'keithbostic', u'name': u'Keith Bostic', u'email': u'keith@wiredtiger.com'} Message: Revert "Revert " WT-2289 : fix for the fast key check"" This reverts commit 604a45f8d82d3ea3a42cab830ecec5ab9068da8f. Branch: develop https://github.com/wiredtiger/wiredtiger/commit/9d26e0502861019580a3299d931f1bc778b67983

Githook User added a comment - Dec 15 2015 03:10:12 PM +00:00 Author: {u'username': u'keithbostic', u'name': u'Keith Bostic', u'email': u'keith.bostic@mongodb.com'} Message: Merge pull request #2393 from wiredtiger/wt-2289-parent-key-check-fix-second WT-2289 : second try at fixing the "fast key check" code. Branch: develop https://github.com/wiredtiger/wiredtiger/commit/ebb5b2e4294dc107433ac9de17822cfa6334cdec

Githook User added a comment - Jan 07 2016 09:44:15 PM +00:00 Author: {u'name': u'Ramon Fernandez', u'email': u'ramon@mongodb.com'} Message: Import wiredtiger-wiredtiger-2.7.0-269-g44463c5.tar.gz from wiredtiger branch mongodb-3.4 ref: 3c2ad56..44463c5 SERVER-21833 Compact does not release space to the system with WiredTiger WT-2060 Simplify aggregation of statistics WT-2099 Seeing memory underflow messages WT-2113 truncate01 sometimes fails WT-2177 Add a per-thread seed to random number generator WT-2198 bulk load and column store appends WT-2231 pinned page cursor searches could check parent keys WT-2235 wt printlog option without unicode WT-2245 WTPERF Truncate has no ability to catch up when it falls behind WT-2246 column-store append searches the leaf page; the maximum record number fails CRUD operations WT-2256 WTPERFs throttle option fires in bursts WT-2257 wtperf doesn't handle overriding workload config WT-2259 __wt_evict_file_exclusive_on() should clear WT_BTREE_NO_EVICTION on error WT-2260 Workloads evict internal pages unexpectedly WT-2262 Random sampling is skewed by tree shape WT-2265 Wiredtiger related change in ppc64le specific code block in gcc.h WT-2266 Add wtperf config to set if perf thresholds are fatal WT-2269 wtperf should dump its config everytime it runs WT-2272 Stress test assertion in the sweep server WT-2275 broken DB after application crash WT-2276 tool to decode checkpoint addr WT-2277 Remove WT check against big-endian systems WT-2279 Define WT_PAUSE(), WT_FULL_BARRIER(), etc when s390x is defined WT-2281 wtperf smoke.sh fails on ppc64le WT-2282 error in wt_txn_update_oldest verbose message test WT-2283 retry in txn_update_oldest results in a hang WT-2285 configure should set BUFFER_ALIGNMENT_DEFAULT to 4kb on linux WT-2289 failure in fast key check WT-2290 WT_SESSION.compact could be more effective. WT-2291 Random cursor walk inefficient in skip list only trees WT-2297 Fix off-by-one error in Huffman config file parsing WT-2299 upper-level WiredTiger code is reaching into the block manager WT-2301 Add reading a range to wtperf WT-2303 Build warning in wtperf WT-2304 wtperf crash dumping config WT-2307 Internal page splits can corrupt cursor iteration WT-2311 Support Sparc Branch: master https://github.com/mongodb/mongo/commit/d845b75e5f0837f801bdf371babd985308a1ad80

Githook User added a comment - Jan 29 2016 07:25:45 PM +00:00 Author: {u'name': u'Ramon Fernandez', u'email': u'ramon@mongodb.com'} Message: Import wiredtiger-wiredtiger-2.7.0-559-g07966a4.tar.gz from wiredtiger branch mongodb-3.2 ref: 3c2ad56..07966a4 WT-1517 schema format edge cases WT-1801 Add a directory sync after rollback of a WT_SESSION::rename operation WT-2060 Simplify aggregation of statistics WT-2073 metadata cleanups WT-2099 Seeing memory underflow messages WT-2113 truncate01 sometimes fails WT-2142 Connection cleanup in Python tests WT-2177 Add an optional per-thread seed to random number generator WT-2198 bulk load and column store appends WT-2216 simplify row-store search loop slightly WT-2225 New split code performance impact WT-2231 pinned page cursor searches could check parent keys WT-2235 wt printlog option without unicode WT-2242 WiredTiger treats dead trees the same as other trees in eviction WT-2244 Trigger in-memory splits sooner WT-2245 WTPERF Truncate has no ability to catch up when it falls behind WT-2246 column-store append searches the leaf page; the maximum record number fails CRUD operations WT-2247 variable-length column-store in-memory page splits WT-2256 WTPERFs throttle option fires in bursts WT-2257 wtperf doesn't handle overriding workload config WT-2258 WiredTiger preloads pages even when direct-IO is configured. WT-2259 __wt_evict_file_exclusive_on() should clear WT_BTREE_NO_EVICTION on error WT-2260 Workloads evict internal pages unexpectedly WT-2262 Random sampling is skewed by tree shape WT-2265 Wiredtiger related change in ppc64le specific code block in gcc.h WT-2266 Add wtperf config to set if perf thresholds are fatal WT-2267 Improve wtperf throttling implementation to provide steady load WT-2269 wtperf should dump its config everytime it runs WT-2272 Stress test assertion in the sweep server WT-2275 broken DB after application crash WT-2276 tool to decode checkpoint addr WT-2277 Remove WT check against big-endian systems WT-2279 Define WT_PAUSE(), WT_FULL_BARRIER(), etc when s390x is defined WT-2281 wtperf smoke.sh fails on ppc64le WT-2282 error in wt_txn_update_oldest verbose message test WT-2283 retry in txn_update_oldest results in a hang WT-2284 Repeated macro definition WT-2285 configure should set BUFFER_ALIGNMENT_DEFAULT to 4kb on linux WT-2287 WT_SESSION.rebalance WT-2289 failure in fast key check WT-2290 WT_SESSION.compact could be more effective. WT-2291 Random cursor walk inefficient in skip list only trees WT-2295 WT_SESSION.create does a full-scan of the main table WT-2296 New log algorithm needs improving for sync/flush settings WT-2297 Fix off-by-one error in Huffman config file parsing WT-2299 upper-level WiredTiger code is reaching into the block manager WT-2301 Add reading a range to wtperf WT-2303 Build warning in wtperf WT-2304 wtperf crash dumping config WT-2305 Fix coverity scan issues on 23/12/2015 WT-2307 Internal page splits can corrupt cursor iteration WT-2308 custom extractor for ref_cursors in join cursor WT-2311 Support Sparc WT-2312 re-creating a deleted column-store page can corrupt the in-memory tree WT-2313 sweep-server: conn_dhandle.c, 610: dhandle != conn->cache->evict_file_next WT-2314 page-swap error handling is inconsistent WT-2316 stress test failure: WT_CURSOR.prev out-of-order returns WT-2320 Only check copyright when cutting releases WT-2321 WT-2321 : race between eviction and worker threads on the eviction queue WT-2326 Change WTPERF to use new memory allocation functions instead of the standard WT-2328 schema drop does direct unlink, it should use a block manager interface. WT-2331 Checking of search() result for reference cursors before join() WT-2332 Bug in logging write-no-sync mode WT-2333 Add a flag so drop doesn't block WT-2335 NULL pointer crash in config_check_search with invalid configuration string WT-2338 Disable using pre-allocated log files when backup cursor is open WT-2339 format post-rebalance verify failure (stress run #11586) WT-2340 Add logging guarantee assertions, whitespace WT-2342 Enhance wtperf to support background create and drop operations WT-2344 OS X compiler warning WT-2347 Java: schema format edge cases WT-2348 xargs -P isn't portable WT-2355 Fix minor scratch buffer usage in logging SERVER-21833 Compact does not release space to the system with WiredTiger SERVER-21887 $sample takes disproportionately long time on newly created collection SERVER-22064 Coverity analysis defect 77699: Unchecked return value SERVER-21944 WiredTiger changes for 3.2.2 Branch: v3.2 https://github.com/mongodb/mongo/commit/5d6532f3d5227ff76f62c4810c98a4ef4d0c8c56