-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Storage 2017-10-23
-
None
lookaside with timestamps: heap-use-after-free
It looks like the truncation of the update list can race with transaction commit when re-building a page in-memory.
Build #17238 origin/wt-3435-lookaside-with-timestamps (Oct 2, 2017 6:51:42 AM)
http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer/17238/
==17403==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600004413c at pc 0x00000072e149 bp 0x7f29a4082e90 sp 0x7f29a4082e88
READ of size 1 at 0x60600004413c thread T15
#0 0x72e148 in __wt_txn_commit /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:684:19
#1 0x6ce0a6 in __session_commit_transaction /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/session/session_api.c:1451:9
#2 0x529381 in commit_transaction /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:498:3
#3 0x527a2f in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:949:4
#4 0x7f29b418adc4 in start_thread (/lib64/libpthread.so.0+0x7dc4)
#5 0x7f29b337176c in __clone (/lib64/libc.so.6+0xf776c)
0x60600004413c is located 28 bytes inside of 53-byte region [0x606000044120,0x606000044155)
freed by thread T15 here:
#0 0x4df510 in __interceptor_free /home/bostic/src/llvm40/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47
#1 0x607d19 in __wt_free_int /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:327:2
#2 0x87827d in __wt_update_obsolete_free /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:363:3
#3 0x8118e5 in __split_multi_inmem /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_split.c:1496:5
#4 0x81266b in __wt_split_rewrite /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_split.c:2242:2
#5 0x5cedf2 in __evict_page_dirty_update /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_page.c:340:4
#6 0x5cc5a9 in __wt_evict /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_page.c:186:3
#7 0x5b20e3 in __evict_page /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_lru.c:2235:2
#8 0x5b007c in __wt_cache_eviction_worker /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_lru.c:2334:17
#9 0xa111d8 in __wt_cache_eviction_check /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/cache.i:398:10
#10 0xa108c6 in __cursor_enter /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/cursor.i:152:3
#11 0xa00a8c in __cursor_func_init /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/cursor.i:343:4
#12 0xa032f6 in __wt_btcur_insert /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:731:8
#13 0x8d574a in __curfile_insert /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:240:2
#14 0x52aa50 in row_insert /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1653:16
#15 0x5266da in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:778:11
#16 0x7f29b418adc4 in start_thread (/lib64/libpthread.so.0+0x7dc4)
previously allocated by thread T15 here:
#0 0x4dfa0d in calloc /home/bostic/src/llvm40/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
#1 0x606572 in __wt_calloc /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:52:11
#2 0x875af6 in __wt_update_alloc /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:280:3
#3 0x873cc9 in __wt_row_modify /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:94:4
#4 0xa12dc7 in __cursor_row_modify_v /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:376:10
#5 0xa08d0c in __btcur_update /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:1106:9
#6 0xa0a8c4 in __wt_btcur_update /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:1342:10
#7 0x8d63a8 in __curfile_update /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:327:2
#8 0x52ccc7 in row_update /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1453:16
#9 0x5274f4 in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:886:11
#10 0x7f29b418adc4 in start_thread (/lib64/libpthread.so.0+0x7dc4)
Thread T15 created by T0 here:
#0 0x437361 in __interceptor_pthread_create /home/bostic/src/llvm40/projects/compiler-rt/lib/asan/asan_interceptors.cc:305
#1 0x61cc30 in __wt_thread_create /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_posix/os_thread.c:30:2
#2 0x522466 in wts_ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:162:3
#3 0x533556 in main /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/t.c:210:5
#4 0x7f29b329bb34 in __libc_start_main (/lib64/libc.so.6+0x21b34)
SUMMARY: AddressSanitizer: heap-use-after-free /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:684:19 in __wt_txn_commit
Shadow bytes around the buggy address:
0x0c0c800007d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800007e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c800007f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c80000800: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x0c0c80000810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0c80000820: fa fa fa fa fd fd fd[fd]fd fd fd fa fa fa fa fa
0x0c0c80000830: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd
0x0c0c80000840: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c80000850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c80000860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c80000870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==17403==ABORTING
Here's the CONFIG:
############################################ # RUN PARAMETERS ############################################ abort=0 alter=0 auto_throttle=1 backups=1 bitcnt=3 bloom=1 bloom_bit_count=63 bloom_hash_count=13 bloom_oldest=0 cache=18 checkpoints=1 checksum=uncompressed chunk_size=9 compaction=0 compression=zlib data_extend=0 data_source=file delete_pct=12 dictionary=0 direct_io=0 encryption=none evict_max=5 file_type=row-store firstfit=0 huffman_key=0 huffman_value=0 independent_thread_rng=0 in_memory=0 insert_pct=13 internal_key_truncation=1 internal_page_max=12 isolation=random key_gap=2 key_max=47 key_min=25 leaf_page_max=17 leak_memory=0 logging=1 logging_archive=1 logging_compression=zlib logging_prealloc=1 long_running_txn=0 lsm_worker_threads=4 merge_max=17 mmap=1 modify_pct=0 ops=100000 prefix_compression=1 prefix_compression_min=2 quiet=1 read_pct=2 rebalance=1 repeat_data_pct=64 reverse=0 rows=100000 runs=1 salvage=1 split_pct=84 statistics=0 statistics_server=0 threads=11 timer=360 transaction_timestamps=0 transaction-frequency=40 value_max=3570 value_min=17 verify=1 wiredtiger_config= write_pct=73 ############################################
- is depended on by
-
WT-3435 Lookaside eviction should be able to save unstable updates
-
- Closed
-