Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use-after-free in DynamicTruncation::preliminaryFit (backport of 75X #9282 ) #10027

Conversation

slava77
Copy link
Contributor

@slava77 slava77 commented Jul 2, 2015

From 75X #9282 message

On the first iteration we used end() of STL container. end() returns
a pointer after the last element in container. In this case, we were
starting iteration from the last removed TrackingRecHit.

Signed-off-by: David Abdurachmanov David.Abdurachmanov@cern.ch

Somewhat anecdotal addendum:
I stumbled across this one while following up on a crash reported in
https://hypernews.cern.ch/HyperNews/CMS/get/tier0-Ops/1010/1/1/1/1/1/1/1/1/1/1/1/1/1/2/1/1/1/1/1/1/1/1/1/1/1/1/1/2/2/1/1/1/1/1.html
The FSQDiJetAve config had a crash in this part of DYT code when running with random memory allocation pattern

 export MALLOC_CHECK_=3 
 export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
cmsRunGlibC PSet.py

the crash on this event, however is not on the same event ("6578th record") nor in the same module as the one in the tier0-Ops.

On the first iteration we used end() of STL container. end() returns
a pointer after the last element in container. In this case, we were
starting iteration from the last __removed__ `TrackingRecHit`.

Signed-off-by: David Abdurachmanov <David.Abdurachmanov@cern.ch>
@slava77
Copy link
Contributor Author

slava77 commented Jul 2, 2015

+1

for #10027 43582b4

@slava77
Copy link
Contributor Author

slava77 commented Jul 2, 2015

@cmsbuild please test

@cmsbuild cmsbuild added this to the Next CMSSW_7_4_X milestone Jul 2, 2015
@cmsbuild
Copy link
Contributor

cmsbuild commented Jul 2, 2015

The tests are being triggered in jenkins.

@cmsbuild
Copy link
Contributor

cmsbuild commented Jul 2, 2015

This pull request is fully signed and it will be integrated in one of the next CMSSW_7_4_X IBs once checked with relvals in the development release cycle of CMSSW or unless it breaks tests. This pull request requires discussion in the ORP meeting before it's merged. @davidlange6, @Degano, @smuzaffar

@cmsbuild
Copy link
Contributor

cmsbuild commented Jul 3, 2015

This pull request is fully signed and it will be integrated in one of the next CMSSW_7_4_X IBs once checked with relvals in the development release cycle of CMSSW or unless it breaks tests. This pull request requires discussion in the ORP meeting before it's merged. @davidlange6, @Degano, @smuzaffar

davidlange6 added a commit that referenced this pull request Jul 4, 2015
…070115/fix-9282-bp

Fix use-after-free in DynamicTruncation::preliminaryFit (backport of 75X #9282 )
@davidlange6 davidlange6 merged commit e4cfafa into cms-sw:CMSSW_7_4_X Jul 4, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants