Regressions: ck_epoch validate: heap-use-after-free

[LebedevRI]

$ LDFLAGS="-fsanitize=address -g -ggdb -O4 -fno-omit-frame-pointer" CFLAGS="${LDFLAGS}" CXXFLAGS="${LDFLAGS}" CPPFLAGS="${LDFLAGS}" ./configure 
Detecting operating system.......success [linux]
Detecting machine architecture...success [x86_64]
Finding dirname command..........success [/usr/bin/dirname]
Determining build directory......success [/home/lebedevri/src/ck]
Finding gzip tool................success [/bin/gzip]
Finding suitable compiler........success [/usr/bin/cc]
Detecting VMA bits...............success [48]
Checking header file usability...success [stdbool.h]
Checking header file usability...success [stddef.h]
Checking header file usability...success [stdint.h]
Checking header file usability...success [string.h]
Detecting git SHA................success [7f625a6]
Generating header files..........success
Generating build files...........success

           VERSION = 0.5.1
           GIT_SHA = 7f625a6
         BUILD_DIR = /home/lebedevri/src/ck
           SRC_DIR = /home/lebedevri/src/ck
            SYSTEM = linux
           PROFILE = x86_64
                CC = /usr/bin/cc
          COMPILER = gcc
            CFLAGS = -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -std=gnu99 -pedantic -Wall -W -Wundef -Wendif-labels -Wshadow -Wpointer-arith -Wcast-align -Wcast-qual -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wnested-externs -Winline -Wdisabled-optimization -fstrict-aliasing -O2 -pipe -Wno-parentheses -fsanitize=address -g -ggdb -O4 -fno-omit-frame-pointer -fPIC
    PTHREAD_CFLAGS = -pthread
                LD = /usr/bin/cc
            LDNAME = libck.so
    LDNAME_VERSION = libck.so.0.5.1
      LDNAME_MAJOR = libck.so.0
           LDFLAGS = -Wl,-soname,libck.so.0 -m64 -fsanitize=address -g -ggdb -O4 -fno-omit-frame-pointer -shared -fPIC
              GZIP = /bin/gzip -c
             CORES = 8
      POINTER_PACK = CK_MD_POINTER_PACK_DISABLE
          VMA_BITS = 48
      MEMORY_MODEL = CK_MD_TSO
               RTM = CK_MD_RTM_DISABLE

Headers will be installed in /usr/local/include
Libraries will be installed in /usr/local/lib
Documentation will be installed in /usr/local/share/man

$ cc -v
Using built-in specs.
COLLECT_GCC=cc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/5/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 5.3.1-7' --with-bugurl=file:///usr/share/doc/gcc-5/README.Bugs --enable-languages=c,ada,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-5 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-5-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-5-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-5-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --with-arch-32=i586 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 5.3.1 20160121 (Debian 5.3.1-7)

----[ Testing epoch....
make[2]: Entering directory '/home/lebedevri/src/ck/regressions/ck_epoch/validate'
./ck_stack 8 1
Deferrals: 4629421 (0.93)
Deferrals: 4690919 (0.94)
Peak: 22938 (0.46%), 908 pending
Reclamations: 4999092

Deferrals: 4657749 (0.93)
Peak: 18423 (0.37%), 16 pending
Reclamations: 4999984

Deferrals: 4670424 (0.93)
Peak: 16095 (0.32%), 15 pending
Reclamations: 4999985

Deferrals: 4514228 (0.90)
Peak: 18808 (0.38%), 4 pending
Reclamations: 4999996

Deferrals: 4491884 (0.90)
Deferrals: 4593448 (0.92)
Peak: 19770 (0.40%), 0 pending
Reclamations: 5000000

Peak: 20551 (0.41%), 6 pending
Reclamations: 4999994

Deferrals: 4544868 (0.91)
Peak: 23832 (0.48%), 16 pending
Reclamations: 4999984

Peak: 17372 (0.35%), 2 pending
Reclamations: 4999998

./ck_epoch_synchronize `expr 8 / 2` `expr 8 / 2` 1
[W] 0.45: |=================================================================
==7693==ERROR: AddressSanitizer: heap-use-after-free on address 0x603001119618 at pc 0x000000401aab bp 0x7fedcd7adc30 sp 0x7fedcd7adc28
READ of size 8 at 0x603001119618 thread T7
    #0 0x401aaa in ck_stack_pop_upmc ../../../include/ck_stack.h:105
    #1 0x401aaa in write_thread /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:189
    #2 0x7fedd395e283 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7283)
    #3 0x7fedd369797c in clone (/lib/x86_64-linux-gnu/libc.so.6+0xe897c)

0x603001119618 is located 8 bytes inside of 32-byte region [0x603001119610,0x603001119630)
freed by thread T5 here:
    #0 0x7fedd3c0abfa in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x93bfa)
    #1 0x4019ca in destructor /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:81
    #2 0x4019ca in write_thread /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:206
    #3 0x7fedd395e283 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7283)

previously allocated by thread T6 here:
    #0 0x7fedd3c0ae9a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x93e9a)
    #1 0x4016b9 in write_thread /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:169
    #2 0x7fedd395e283 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7283)

Thread T7 created by T0 here:
    #0 0x7fedd3bacef4 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x35ef4)
    #1 0x400ea0 in main /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:249
    #2 0x7fedd35cf86f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2086f)

Thread T5 created by T0 here:
    #0 0x7fedd3bacef4 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x35ef4)
    #1 0x400ea0 in main /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:249
    #2 0x7fedd35cf86f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2086f)

Thread T6 created by T0 here:
    #0 0x7fedd3bacef4 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x35ef4)
    #1 0x400ea0 in main /home/lebedevri/src/ck/regressions/ck_epoch/validate/ck_epoch_synchronize.c:249
    #2 0x7fedd35cf86f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2086f)

SUMMARY: AddressSanitizer: heap-use-after-free ../../../include/ck_stack.h:105 ck_stack_pop_upmc
Shadow bytes around the buggy address:
  0x0c068021b270: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c068021b280: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
  0x0c068021b290: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x0c068021b2a0: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c068021b2b0: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 00 00
=>0x0c068021b2c0: fa fa fd[fd]fd fd fa fa 00 00 00 00 fa fa 00 00
  0x0c068021b2d0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c068021b2e0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x0c068021b2f0: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c068021b300: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c068021b310: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==7693==ABORTING
Makefile:10: recipe for target 'check' failed
make[2]: *** [check] Error 1
make[2]: Leaving directory '/home/lebedevri/src/ck/regressions/ck_epoch/validate'

[sbahra]

This is resolved now. Let me know if you see it!