Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

prov/sockets: use after free #6053

Closed
shefty opened this issue Jul 2, 2020 · 0 comments
Closed

prov/sockets: use after free #6053

shefty opened this issue Jul 2, 2020 · 0 comments

Comments

@shefty
Copy link
Member

shefty commented Jul 2, 2020

caught by CI on OS X
https://travis-ci.org/github/ofiwg/libfabric/builds/704164676

name: fi_shared_ctx -p "sockets"
result: Fail
time: 3
server_cmd: fi_shared_ctx -p "sockets" -s 127.0.0.1
server_stdout: |
=================================================================
==94143==ERROR: AddressSanitizer: heap-use-after-free on address 0x6270000072e0 at pc 0x000105ed963c bp 0x700008c1fc30 sp 0x700008c1fc28
READ of size 4 at 0x6270000072e0 thread T2
#0 0x105ed963b in sock_conn_listener_thread (libfabric.1.dylib:x86_64+0xdc63b)
#1 0x7fff5882e660 in _pthread_body (libsystem_pthread.dylib:x86_64+0x3660)
#2 0x7fff5882e50c in _pthread_start (libsystem_pthread.dylib:x86_64+0x350c)
#3 0x7fff5882dbf8 in thread_start (libsystem_pthread.dylib:x86_64+0x2bf8)

0x6270000072e0 is located 480 bytes inside of 12944-byte region [0x627000007100,0x62700000a390)
freed by thread T0 here:
    #0 0x1060a3a9d in wrap_free (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x56a9d)
    #1 0x105eb42cf in sock_ep_close (libfabric.1.dylib:x86_64+0xb72cf)
    #2 0x105dabbff in fi_close fabric.h:589
    #3 0x105dab38c in main shared_ctx.c:649
    #4 0x7fff58516014 in start (libdyld.dylib:x86_64+0x1014)

previously allocated by thread T0 here:
    #0 0x1060a3e27 in wrap_calloc (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x56e27)
    #1 0x105eb9a04 in sock_alloc_endpoint (libfabric.1.dylib:x86_64+0xbca04)
    #2 0x105ea7b19 in sock_rdm_ep (libfabric.1.dylib:x86_64+0xaab19)
    #3 0x105daee03 in fi_endpoint fi_endpoint.h:164
    #4 0x105dae914 in alloc_ep shared_ctx.c:123
    #5 0x105dadd45 in init_fabric shared_ctx.c:340
    #6 0x105dabb3d in run shared_ctx.c:575
    #7 0x105dab29e in main shared_ctx.c:647
    #8 0x7fff58516014 in start (libdyld.dylib:x86_64+0x1014)

Thread T2 created by T0 here:
    #0 0x10609b99d in wrap_pthread_create (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x4e99d)
    #1 0x105ed8b9b in sock_conn_start_listener_thread (libfabric.1.dylib:x86_64+0xdbb9b)
    #2 0x105e9aac2 in sock_domain (libfabric.1.dylib:x86_64+0x9dac2)
    #3 0x105db2193 in fi_domain fi_domain.h:286
    #4 0x105db1f7f in ft_open_fabric_res shared.c:520
    #5 0x105dadc74 in init_fabric shared_ctx.c:330
    #6 0x105dabb3d in run shared_ctx.c:575
    #7 0x105dab29e in main shared_ctx.c:647
    #8 0x7fff58516014 in start (libdyld.dylib:x86_64+0x1014)

SUMMARY: AddressSanitizer: heap-use-after-free (libfabric.1.dylib:x86_64+0xdc63b) in sock_conn_listener_thread
Shadow bytes around the buggy address:
  0x1c4e00000e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c4e00000e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c4e00000e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c4e00000e50: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x1c4e00000e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4e00000ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==94143==ABORTING
Posting recv #0 for shared rx ctx
Posting recv #1 for shared rx ctx
Posting recv #2 for shared rx ctx
Posting recv #3 for shared rx ctx
Posting send #0 to shared tx ctx
Posting send #1 to shared tx ctx
Posting send #2 to shared tx ctx
Posting send #3 to shared tx ctx
./scripts/runfabtests.sh: line 434: 94142 Abort trap: 6           timeout 120 fi_shared_ctx -p "sockets" -s 127.0.0.1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant