-
Type: Bug
-
Resolution: Fixed
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: None
-
5
-
Storage Engines 2020-03-09
A heap-use-after-free error was captured by the format stress sanitizer smoke job after merging durable history branch into develop. The error occurred while attempting a row modify on a row-store file_type.
Evergreen failed log here
[2020/03/04 12:21:16.769] ==4896==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080008aab47 at pc 0x0000004c2996 bp 0x7f58dd8206f0 sp 0x7f58dd81fea0 [2020/03/04 12:21:16.769] READ of size 47 at 0x6080008aab47 thread T22 [2020/03/04 12:21:16.769] #0 0x4c2995 in __asan_memcpy /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3 [2020/03/04 12:21:16.769] #1 0x57d42e in __wt_update_alloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:276:9 [2020/03/04 12:21:16.769] #2 0x57aa9f in __wt_row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:102:13 [2020/03/04 12:21:16.769] #3 0x9e5fa5 in __cursor_row_modify_v /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:405:13 [2020/03/04 12:21:16.769] #4 0x9d96af in __btcur_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1305:15 [2020/03/04 12:21:16.769] #5 0x9da527 in __wt_btcur_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1537:11 [2020/03/04 12:21:16.769] #6 0x61c574 in __curfile_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/cursor/cur_file.c:446:5 [2020/03/04 12:21:16.769] #7 0x509fef in row_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1280:16 [2020/03/04 12:21:16.769] #8 0x504469 in ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:713:23 [2020/03/04 12:21:16.769] #9 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) [2020/03/04 12:21:16.769] #10 0x7f58e25e588e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95 [2020/03/04 12:21:16.769] 0x6080008aab47 is located 39 bytes inside of 86-byte region [0x6080008aab20,0x6080008aab76) [2020/03/04 12:21:16.769] freed by thread T1 here: [2020/03/04 12:21:16.769] #0 0x4c3562 in free /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3 [2020/03/04 12:21:16.769] #1 0x736f58 in __wt_free_int /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_common/os_alloc.c:301:5 [2020/03/04 12:21:16.769] #2 0x9f950c in __wt_free_update_list /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:446:9 [2020/03/04 12:21:16.769] #3 0x9fa833 in __free_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:428:13 [2020/03/04 12:21:16.769] #4 0x9f78ea in __free_page_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:202:13 [2020/03/04 12:21:16.769] #5 0x9f5cc0 in __wt_page_out /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:107:9 [2020/03/04 12:21:16.769] #6 0x9f4fb8 in __wt_ref_out /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:41:5 [2020/03/04 12:21:16.769] #7 0x69420a in __evict_page_dirty_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_page.c:396:13 [2020/03/04 12:21:16.769] #8 0x68f986 in __wt_evict /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_page.c:193:9 [2020/03/04 12:21:16.769] #9 0x670402 in __evict_page /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:2246:5 [2020/03/04 12:21:16.769] #10 0x669290 in __evict_lru_pages /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:1118:20 [2020/03/04 12:21:16.769] #11 0x673ed1 in __evict_pass /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:715:19 [2020/03/04 12:21:16.769] #12 0x6685ec in __evict_server /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:376:5 [2020/03/04 12:21:16.769] #13 0x667d58 in __wt_evict_thread_run /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:288:15 [2020/03/04 12:21:16.769] #14 0x8aa2c3 in __thread_run /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:31:9 [2020/03/04 12:21:16.769] #15 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) [2020/03/04 12:21:16.769] previously allocated by thread T22 here: [2020/03/04 12:21:16.769] #0 0x4c3ada in calloc /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:155:3 [2020/03/04 12:21:16.769] #1 0x7356da in __wt_calloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_common/os_alloc.c:50:14 [2020/03/04 12:21:16.769] #2 0x57d221 in __wt_update_alloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:273:5 [2020/03/04 12:21:16.769] #3 0x57aa9f in __wt_row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:102:13 [2020/03/04 12:21:16.769] #4 0x9e5fa5 in __cursor_row_modify_v /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:405:13 [2020/03/04 12:21:16.769] #5 0x9d8cc7 in __btcur_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1245:42 [2020/03/04 12:21:16.769] #6 0x9d7edc in __wt_btcur_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1495:15 [2020/03/04 12:21:16.769] #7 0x620d40 in __curfile_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/cursor/cur_file.c:333:5 [2020/03/04 12:21:16.769] #8 0x50bb2d in row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1350:16 [2020/03/04 12:21:16.769] #9 0x504a6b in ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:767:23 [2020/03/04 12:21:16.769] #10 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) [2020/03/04 12:21:16.769] Thread T22 created by T0 here: [2020/03/04 12:21:16.769] #0 0x4ac1fd in pthread_create /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3 [2020/03/04 12:21:16.769] #1 0x7557b5 in __wt_thread_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5 [2020/03/04 12:21:16.769] #2 0x5013fb in wts_ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:188:9 [2020/03/04 12:21:16.769] #3 0x51d7b6 in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:280:13 [2020/03/04 12:21:16.769] #4 0x7f58e24e5b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 [2020/03/04 12:21:16.769] Thread T1 created by T0 here: [2020/03/04 12:21:16.769] #0 0x4ac1fd in pthread_create /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3 [2020/03/04 12:21:16.769] #1 0x7557b5 in __wt_thread_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5 [2020/03/04 12:21:16.769] #2 0x8a78ed in __thread_group_resize /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:201:9 [2020/03/04 12:21:16.769] #3 0x8a8426 in __wt_thread_group_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:285:5 [2020/03/04 12:21:16.769] #4 0x66a89e in __wt_evict_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:477:5 [2020/03/04 12:21:16.769] #5 0x5d8161 in __wt_connection_workers /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/conn/conn_open.c:230:5 [2020/03/04 12:21:16.769] #6 0x5985cc in wiredtiger_open /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/conn/conn_api.c:2679:5 [2020/03/04 12:21:16.769] #7 0x52961c in wts_open /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/wts.c:272:5 [2020/03/04 12:21:16.769] #8 0x51d34a in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:271:9 [2020/03/04 12:21:16.769] #9 0x7f58e24e5b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 [2020/03/04 12:21:16.769] SUMMARY: AddressSanitizer: heap-use-after-free /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3 in __asan_memcpy [2020/03/04 12:21:16.769] Shadow bytes around the buggy address: [2020/03/04 12:21:16.769] 0x0c108010d510: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d520: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d530: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d540: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd [2020/03/04 12:21:16.769] 0x0c108010d550: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd [2020/03/04 12:21:16.769] =>0x0c108010d560: fa fa fa fa fd fd fd fd[fd]fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d570: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:21:16.769] 0x0c108010d580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d590: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:21:16.769] 0x0c108010d5a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa [2020/03/04 12:21:16.769] 0x0c108010d5b0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd [2020/03/04 12:21:16.769] Shadow byte legend (one shadow byte represents 8 application bytes): [2020/03/04 12:21:16.769] Addressable: 00 [2020/03/04 12:21:16.769] Partially addressable: 01 02 03 04 05 06 07 [2020/03/04 12:21:16.769] Heap left redzone: fa [2020/03/04 12:21:16.769] Freed heap region: fd [2020/03/04 12:21:16.769] Stack left redzone: f1 [2020/03/04 12:21:16.769] Stack mid redzone: f2 [2020/03/04 12:21:16.769] Stack right redzone: f3 [2020/03/04 12:21:16.769] Stack after return: f5 [2020/03/04 12:21:16.769] Stack use after scope: f8 [2020/03/04 12:21:16.769] Global redzone: f9 [2020/03/04 12:21:16.769] Global init order: f6 [2020/03/04 12:21:16.769] Poisoned by user: f7 [2020/03/04 12:21:16.769] Container overflow: fc [2020/03/04 12:21:16.769] Array cookie: ac [2020/03/04 12:21:16.769] Intra object redzone: bb [2020/03/04 12:21:16.769] ASan internal: fe [2020/03/04 12:21:16.769] Left alloca redzone: ca [2020/03/04 12:21:16.769] Right alloca redzone: cb [2020/03/04 12:21:16.769] Shadow gap: cc [2020/03/04 12:21:16.769] ==4896==ABORTING