Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-8330

Fix double free in test_wt4803_history_store_abort

    • Type: Icon: Build Failure Build Failure
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None

      An ASAN run in Evergreen detected a double memory free in test_wt4803_history_store_abort:

       https://evergreen.mongodb.com/task/wiredtiger_ubuntu2004_asan_csuite_wt4803_history_store_abort_test_a5581e759002efc42ac455c3e0a3b8cc58cf569a_21_11_02_02_08_01/0

      Here's the ASAN report:

      ==635294==ERROR: AddressSanitizer: attempting double-free on 0x619000000080 in thread T2:
          #0 0x4c5332 in free /data/mci/93089ed2cad95b7804e0b342ca4d9507/toolchain-builder/tmp/build-llvm.sh-dH0/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
          #1 0x7fa81d1a7ad2  (/lib/x86_64-linux-gnu/libc.so.6+0x49ad2)
          #2 0x7fa81d1a7bdf in exit (/lib/x86_64-linux-gnu/libc.so.6+0x49bdf)
          #3 0x4f6637 in handle_message /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/test/csuite/../../../test/csuite/wt4803_history_store_abort/main.c:69:13
          #4 0x7fa81e003b47 in __eventv /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/support/err.c:263:15
          #5 0x7fa81e004634 in __wt_panic_func /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/support/err.c:352:5
          #6 0x7fa81dd61d04 in __wt_hs_insert_updates /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/history/hs_rec.c:753:9
          #7 0x7fa81df42792 in __rec_hs_wrapup /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/reconcile/rec_write.c:2332:13
          #8 0x7fa81df28afc in __rec_write_wrapup /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/reconcile/rec_write.c:2108:9
          #9 0x7fa81df17ed7 in __reconcile /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/reconcile/rec_write.c:226:28
          #10 0x7fa81df15ebd in __wt_reconcile /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/reconcile/rec_write.c:97:11
          #11 0x7fa81dd39532 in __evict_review /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_page.c:744:9
          #12 0x7fa81dd33cd0 in __wt_evict /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_page.c:159:5
          #13 0x7fa81dd14249 in __evict_page /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:2317:5
          #14 0x7fa81dd0c606 in __evict_lru_pages /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:1130:20
          #15 0x7fa81dd18243 in __evict_pass /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:732:13
          #16 0x7fa81dd0b94c in __evict_server /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:389:5
          #17 0x7fa81dd0b0a5 in __wt_evict_thread_run /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:297:15
          #18 0x7fa81e0725f3 in __thread_run /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/support/thread_group.c:31:9
          #19 0x7fa81d4a8608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
          #20 0x7fa81d280292 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
      0x619000000080 is located 0 bytes inside of 1040-byte region [0x619000000080,0x619000000490)
      freed by thread T0 here:
          #0 0x4c5332 in free /data/mci/93089ed2cad95b7804e0b342ca4d9507/toolchain-builder/tmp/build-llvm.sh-dH0/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
          #1 0x7fa81d1a7ad2  (/lib/x86_64-linux-gnu/libc.so.6+0x49ad2)
      previously allocated by thread T0 here:
          #0 0x4c58aa in calloc /data/mci/93089ed2cad95b7804e0b342ca4d9507/toolchain-builder/tmp/build-llvm.sh-dH0/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:155:3
          #1 0x7fa81d1a7dc1  (/lib/x86_64-linux-gnu/libc.so.6+0x49dc1)
      Thread T2 created by T0 here:
          #0 0x4adfcd in pthread_create /data/mci/93089ed2cad95b7804e0b342ca4d9507/toolchain-builder/tmp/build-llvm.sh-dH0/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
          #1 0x7fa81de7cea5 in __wt_thread_create /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5
          #2 0x7fa81e06fb93 in __thread_group_resize /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/support/thread_group.c:200:9
          #3 0x7fa81e07068a in __wt_thread_group_create /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/support/thread_group.c:286:5
          #4 0x7fa81dd0dcd0 in __wt_evict_create /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/evict/evict_lru.c:497:5
          #5 0x7fa81db45d07 in __wt_connection_workers /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/conn/conn_open.c:244:5
          #6 0x7fa81dada8c9 in wiredtiger_open /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/../src/conn/conn_api.c:2928:5
          #7 0x4f5238 in hs_workload /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/test/csuite/../../../test/csuite/wt4803_history_store_abort/main.c:88:5
          #8 0x4f4dce in test_hs_workload /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/test/csuite/../../../test/csuite/wt4803_history_store_abort/main.c:160:9
          #9 0x4f4b1b in main /data/mci/a09989fa52e1a7c8d31462cf3326351d/wiredtiger/build_posix/test/csuite/../../../test/csuite/wt4803_history_store_abort/main.c:209:5
          #10 0x7fa81d1850b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      SUMMARY: AddressSanitizer: double-free /data/mci/93089ed2cad95b7804e0b342ca4d9507/toolchain-builder/tmp/build-llvm.sh-dH0/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3 in free
      ==635294==ABORTING

            Assignee:
            backlog-server-storage-engines [DO NOT USE] Backlog - Storage Engines Team
            Reporter:
            xgen-evg-user Xgen-Evergreen-User
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: