Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-5078

format heap-use-after-free in __wt_txn_upd_visible_type

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None

      http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer/24647/

      ==5717==ERROR: AddressSanitizer: heap-use-after-free on address 0x604005457d75 at pc 0x000000a23e1b bp 0x7fa82e4e3750 sp 0x7fa82e4e3748
      READ of size 1 at 0x604005457d75 thread T18
          #0 0xa23e1a in __wt_txn_upd_visible_type /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/txn.i:778:9
          #1 0xa23cbc in __wt_txn_upd_visible /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/txn.i:803:13
          #2 0xa1f6ad in __wt_txn_update_check /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/txn.i:1057:28
          #3 0xa1dd56 in __wt_row_modify /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:91:13
          #4 0x8f92e6 in __cursor_row_modify /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:422:7
          #5 0x8fb47b in __wt_btcur_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:1030:42
          #6 0xac7cef in __curfile_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:397:5
          #7 0x52fabd in row_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1730:15
          #8 0x527638 in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:809:23
          #9 0x4e8ede in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4e8ede)
          #10 0x7fa83b1196da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
          #11 0x7fa83a24b88e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      
      0x604005457d75 is located 37 bytes inside of 38-byte region [0x604005457d50,0x604005457d76)
      freed by thread T19 here:
          #0 0x4db0e0 in __interceptor_free.localalias.0 (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4db0e0)
          #1 0x6b22e8 in __wt_free_int /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:302:5
          #2 0x91c156 in __wt_free_update_list /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:427:9
          #3 0xa215bd in __wt_update_serial /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/serial.i:293:9
          #4 0xa1e1e3 in __wt_row_modify /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:123:9
          #5 0x8f92e6 in __cursor_row_modify /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:422:7
          #6 0x8fb47b in __wt_btcur_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:1030:42
          #7 0xac7cef in __curfile_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:397:5
          #8 0x52fabd in row_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1730:15
          #9 0x527638 in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:809:23
          #10 0x4e8ede in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4e8ede)
      
      previously allocated by thread T9 here:
          #0 0x4db4d8 in calloc (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4db4d8)
          #1 0x6b0a7a in __wt_calloc /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:50:14
          #2 0xa1ff3c in __wt_update_alloc /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:271:9
          #3 0x95fe69 in __las_page_instantiate /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:178:9
          #4 0x961ec2 in __page_read_lookaside /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:404:5
          #5 0x959d4b in __page_read /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:530:9
          #6 0x956a8c in __wt_page_in_func /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:644:13
          #7 0xa324ce in __wt_page_swap_func /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/btree.i:1637:11
          #8 0xa2dd63 in __wt_row_search /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_srch.c:437:20
          #9 0x8f2471 in __cursor_row_search /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:376:5
          #10 0x8fb5c0 in __wt_btcur_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:1053:15
          #11 0xac7cef in __curfile_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:397:5
          #12 0x52fabd in row_remove /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1730:15
          #13 0x527638 in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:809:23
          #14 0x4e8ede in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4e8ede)
      
      Thread T18 created by T0 here:
          #0 0x434480 in pthread_create (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x434480)
          #1 0x6cf965 in __wt_thread_create /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_posix/os_thread.c:28:5
          #2 0x5233d0 in wts_ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:170:9
          #3 0x53ef5f in main /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/t.c:213:17
          #4 0x7fa83a14bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
      
      Thread T19 created by T0 here:
          #0 0x434480 in pthread_create (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x434480)
          #1 0x6cf965 in __wt_thread_create /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_posix/os_thread.c:28:5
          #2 0x5233d0 in wts_ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:170:9
          #3 0x53ef5f in main /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/t.c:213:17
          #4 0x7fa83a14bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
      
      Thread T9 created by T0 here:
          #0 0x434480 in pthread_create (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x434480)
          #1 0x6cf965 in __wt_thread_create /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_posix/os_thread.c:28:5
          #2 0x5233d0 in wts_ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:170:9
          #3 0x53ef5f in main /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/t.c:213:17
          #4 0x7fa83a14bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
      
      ############################################
      #  RUN PARAMETERS
      ############################################
      abort=0
      alter=0
      assert_commit_timestamp=1
      assert_read_timestamp=0
      auto_throttle=1
      backups=1
      bitcnt=7
      bloom=1
      bloom_bit_count=5
      bloom_hash_count=28
      bloom_oldest=0
      cache=620
      cache_minimum=20
      checkpoints=wiredtiger
      checkpoint_log_size=71
      checkpoint_wait=59
      checksum=on
      chunk_size=10
      compaction=0
      compression=none
      data_extend=0
      data_source=table
      delete_pct=33
      dictionary=0
      direct_io=0
      encryption=none
      evict_max=2
      file_type=row-store
      firstfit=0
      huffman_key=0
      huffman_value=0
      independent_thread_rng=0
      in_memory=0
      insert_pct=25
      internal_key_truncation=1
      internal_page_max=12
      isolation=snapshot
      key_gap=5
      key_max=28
      key_min=14
      leaf_page_max=10
      leak_memory=0
      logging=0
      logging_archive=0
      logging_compression=none
      logging_file_max=436785
      logging_prealloc=1
      long_running_txn=0
      lsm_worker_threads=3
      memory_page_max=10
      merge_max=15
      mmap=1
      modify_pct=22
      ops=0
      prefix_compression=0
      prefix_compression_min=1
      prepare=0
      quiet=1
      read_pct=16
      rebalance=1
      repeat_data_pct=27
      reverse=1
      rows=1000000
      runs=1
      salvage=1
      split_pct=98
      statistics=0
      statistics_server=0
      threads=31
      timer=4
      timing_stress_aggressive_sweep=0
      timing_stress_checkpoint=0
      timing_stress_lookaside_sweep=0
      timing_stress_split_1=0
      timing_stress_split_2=0
      timing_stress_split_3=0
      timing_stress_split_4=0
      timing_stress_split_5=0
      timing_stress_split_6=0
      timing_stress_split_7=0
      timing_stress_split_8=0
      transaction_timestamps=1
      transaction-frequency=100
      truncate=1
      value_max=883
      value_min=2
      verify=1
      wiredtiger_config=
      write_pct=4
      ############################################
      

            Assignee:
            backlog-server-storage-engines [DO NOT USE] Backlog - Storage Engines Team
            Reporter:
            keith.bostic@mongodb.com Keith Bostic (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: