While simulating out-of-memory conditions in __wt_calloc, I triggered a NULL pointer dereference in __block_destroy.
Sequence of events:
- __wt_block_open calls __wt_calloc_one to initialize a block handle (line 200)
- __wt_calloc_one fails with ENOMEM and the err block is jumped to (line 267)
- __block_destroy is called with block == NULL, which leads to a NULL pointer dereference (line 133)
Excerpted code:
static int __block_destroy(WT_SESSION_IMPL *session, WT_BLOCK *block) { 128 WT_CONNECTION_IMPL *conn; 129 WT_DECL_RET; 130 uint64_t bucket; 131 132 conn = S2C(session); 133 bucket = block->name_hash % WT_HASH_ARRAY_SIZE; [....snip....] int __wt_block_open(WT_SESSION_IMPL *session, const char *filename, const char *cfg[], int forced_salvage, int readonly, uint32_t allocsize, WT_BLOCK **blockp) { WT_BLOCK *block; WT_CONFIG_ITEM cval; WT_CONNECTION_IMPL *conn; WT_DECL_RET; uint64_t bucket, hash; [....snip....] 199 /* Basic structure allocation, initialization. */ 200 WT_ERR(__wt_calloc_one(session, &block)); [....snip....] 267 err: WT_TRET(__block_destroy(session, block));
ASan report:
==31572== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x000002d64834 sp 0x7fff86097be0 bp 0x7fff86097c20 T0) AddressSanitizer can not provide additional info. #0 0x2d64833 in __block_destroy /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/block/block_open.c:133 #1 0x2d6585d in __wt_block_open /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/block/block_open.c:267 #2 0x2d63aec in __wt_block_manager_open /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/block/block_mgr.c:427 #3 0x2d9bb03 in __wt_btree_open /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/btree/bt_handle.c:70 #4 0x2e22789 in __wt_conn_btree_open /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/conn/conn_dhandle.c:331 #5 0x2f65a28 in __wt_session_get_btree /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/session/session_dhandle.c:456 #6 0x2f65636 in __wt_session_get_btree /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/session/session_dhandle.c:447 #7 0x2f33606 in __create_file /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/schema/schema_create.c:119 #8 0x2f372ef in __wt_schema_create /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/schema/schema_create.c:631 #9 0x2f347a9 in __create_colgroup /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/schema/schema_create.c:250 #10 0x2f36bb5 in __create_table /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/schema/schema_create.c:556 #11 0x2f37565 in __wt_schema_create /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/schema/schema_create.c:637 #12 0x2f5772c in __session_create /home/s/code/mongo/mongo/src/third_party/wiredtiger/src/session/session_api.c:441 #13 0x2054605 in mongo::WiredTigerKVEngine::createRecordStore(mongo::OperationContext*, mongo::StringData, mongo::StringData, mongo::CollectionOptions const&) /home/s/code/mongo/mongo/src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp:270 #14 0x1f568a9 in mongo::KVStorageEngine::KVStorageEngine(mongo::KVEngine*, mongo::KVStorageEngineOptions const&) /home/s/code/mongo/mongo/src/mongo/db/storage/kv/kv_storage_engine.cpp:88 #15 0x2051acd in mongo::(anonymous namespace)::WiredTigerFactory::create(mongo::StorageGlobalParams const&, mongo::StorageEngineLockFile const&) const /home/s/code/mongo/mongo/src/mongo/db/storage/wiredtiger/wiredtiger_init.cpp:76 #16 0x1f01dae in mongo::ServiceContextMongoD::initializeGlobalStorageEngine() /home/s/code/mongo/mongo/src/mongo/db/service_context_d.cpp:144 #17 0x15ae561 in mongo::_initAndListen(int) /home/s/code/mongo/mongo/src/mongo/db/db.cpp:416 #18 0x15afb33 in mongo::initAndListen(int) /home/s/code/mongo/mongo/src/mongo/db/db.cpp:594 #19 0x15b1304 in mongoDbMain(int, char**, char**) /home/s/code/mongo/mongo/src/mongo/db/db.cpp:823 #20 0x15afedd in main /home/s/code/mongo/mongo/src/mongo/db/db.cpp:639 #21 0x7fe86d94dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287 #22 0x15ab728 in _start (/home/s/code/mongo/mongo/mongod+0x15ab728)
Version: 6c49d69bbae5d8807fc205dbca12eecf1a60258b
- is depended on by
-
SERVER-19282 WiredTiger changes in MongoDB 3.1.6
- Closed
- links to