-
Type: Bug
-
Resolution: Duplicate
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
A heap-use-after-free error was captured by the format stress sanitizer job after merging durable history branch into develop. The error fired while attempting a cursor modify on a variable length column-store.
http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer-ppc/9258/
==12897==ERROR: AddressSanitizer: heap-use-after-free on address 0x0a38000615c7 at pc 0x0000100dd38c bp 0x3fff7a1fb970 sp 0x3fff7a1fb990 READ of size 34 at 0x0a38000615c7 thread T6 #0 0x100dd388 in __asan_memcpy /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_interceptors.cc:463 #1 0x101e9fc4 in __wt_update_alloc /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/row_modify.c:273:9 #2 0x1084f518 in __wt_col_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/col_modify.c:187:13 #3 0x10704758 in __cursor_col_modify_v /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:428:13 #4 0x106f5330 in __btcur_update /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:1341:15 #5 0x106f6228 in __wt_btcur_reserve /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:1558:11 #6 0x102a0fb8 in __curfile_reserve /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/cursor/cur_file.c:446:5 #7 0x10162a04 in col_reserve /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/test/format/../../../test/format/ops.c:1329:16 #8 0x1015b084 in ops /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/test/format/../../../test/format/ops.c:745:23 #9 0x1010df9c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_thread.cc:257 #10 0x1003a778 in asan_thread_start(void*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_interceptors.cc:305 #11 0x3fff7fbb8940 in start_thread (/lib64/power8/libpthread.so.0+0x8940) #12 0x3fff7f90763c in __clone (/lib64/power8/libc.so.6+0x11763c) 0x0a38000615c7 is located 39 bytes inside of 73-byte region [0x0a38000615a0,0x0a38000615e9) freed by thread T4 here: #0 0x100f8f7c in __interceptor_cfree.localalias.1 /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:55 #1 0x103e6734 in __wt_free_int /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/os_common/os_alloc.c:301:5 #2 0x1071c050 in __wt_free_update_list /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:423:9 #3 0x1071d25c in __free_skip_list /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:383:13 #4 0x1071d74c in __free_skip_array /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:363:13 #5 0x10719d38 in __free_page_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:186:13 #6 0x10717e38 in __wt_page_out /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:107:9 #7 0x10716f00 in __wt_ref_out /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_discard.c:41:5 #8 0x10323848 in __evict_page_dirty_update /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/evict/evict_page.c:395:13 #9 0x1031e0f0 in __wt_evict /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/evict/evict_page.c:192:9 #10 0x102f8a28 in __evict_page /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/evict/evict_lru.c:2231:5 #11 0x102f01f8 in __evict_lru_pages /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/evict/evict_lru.c:1102:20 #12 0x102eef64 in __wt_evict_thread_run /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/evict/evict_lru.c:311:9 #13 0x10584938 in __thread_run /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/support/thread_group.c:31:9 #14 0x1010df9c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_thread.cc:257 #15 0x1003a778 in asan_thread_start(void*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_interceptors.cc:305 #16 0x3fff7fbb8940 in start_thread (/lib64/power8/libpthread.so.0+0x8940) #17 0x3fff7f90763c in __clone (/lib64/power8/libc.so.6+0x11763c) previously allocated by thread T6 here: #0 0x100f93bc in calloc /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74 #1 0x103e4954 in __wt_calloc /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/os_common/os_alloc.c:50:14 #2 0x101e9d74 in __wt_update_alloc /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/row_modify.c:270:5 #3 0x1084f518 in __wt_col_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/col_modify.c:187:13 #4 0x10704758 in __cursor_col_modify_v /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:428:13 #5 0x106f4600 in __btcur_update /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:1266:42 #6 0x106f3660 in __wt_btcur_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_cursor.c:1516:15 #7 0x102a5c64 in __curfile_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/cursor/cur_file.c:333:5 #8 0x10165130 in col_modify /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/test/format/../../../test/format/ops.c:1405:16 #9 0x1015b750 in ops /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/test/format/../../../test/format/ops.c:798:23 #10 0x1010df9c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_thread.cc:257 #11 0x1003a778 in asan_thread_start(void*) /home/dhows/llvm-git/projects/compiler-rt/lib/asan/asan_interceptors.cc:305 #12 0x3fff7fbb8940 in start_thread (/lib64/power8/libpthread.so.0+0x8940)
Format configuration:
############################################ # RUN PARAMETERS ############################################ abort=0 alter=0 assert_commit_timestamp=0 assert_read_timestamp=0 auto_throttle=1 backups=0 bitcnt=7 bloom=1 bloom_bit_count=42 bloom_hash_count=9 bloom_oldest=0 cache=84 cache_minimum=20 checkpoints=on checkpoint_log_size=29 checkpoint_wait=17 checksum=uncompressed chunk_size=6 compaction=0 compression=lz4 data_extend=0 data_source=table delete_pct=2 dictionary=1 direct_io=0 encryption=none evict_max=4 file_type=variable-length column-store firstfit=0 huffman_key=0 huffman_value=0 independent_thread_rng=1 in_memory=0 insert_pct=2 internal_key_truncation=1 internal_page_max=9 isolation=snapshot key_gap=7 key_max=63 key_min=25 leaf_page_max=14 leak_memory=0 logging=0 logging_archive=0 logging_compression=none logging_file_max=312351 logging_prealloc=0 lsm_worker_threads=4 major_timeout=0 memory_page_max=7 merge_max=4 mmap=0 modify_pct=5 ops=0 prefix_compression=1 prefix_compression_min=6 prepare=0 quiet=1 random_cursor=0 read_pct=69 rebalance=1 repeat_data_pct=80 reverse=0 rows=1000000 runs=1 salvage=1 split_pct=85 statistics=0 statistics_server=0 threads=6 timer=4 timing_stress_aggressive_sweep=0 timing_stress_checkpoint=0 timing_stress_hs_sweep=0 timing_stress_split_1=0 timing_stress_split_2=0 timing_stress_split_3=0 timing_stress_split_4=0 timing_stress_split_5=0 timing_stress_split_6=0 timing_stress_split_7=0 timing_stress_split_8=0 transaction_timestamps=1 transaction-frequency=100 truncate=1 value_max=4070 value_min=6 verify=1 wiredtiger_config= write_pct=22 ############################################