Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-25206

Heap use after free in Cookie::validate() during test

    XMLWordPrintable

Details

    • Untriaged
    • Unknown

    Description

      http://cv.jenkins.couchbase.com/job/kv_engine-addresssanitizer-master/1339/consoleFull#1579566642b106e815-6d27-4a01-8b14-4b94513c99be

      http://cv.jenkins.couchbase.com/job/kv_engine-addresssanitizer-master/1334/consoleFull#1579566642b106e815-6d27-4a01-8b14-4b94513c99be

      ==727==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000eeaf8 at pc 0x00000057a919 bp 0x7ff610f10c70 sp 0x7ff610f10c68
      READ of size 8 at 0x6190000eeaf8 thread T2123 (ewb:pendingQ)
          #0 0x57a918 in Cookie::validate() const /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/cookie.h:39:13
          #1 0x57a918 in notify_io_complete(void const*, ENGINE_ERROR_CODE) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:428
          #2 0x7ff615726412 in EWB_Engine::process_notifications() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/engines/ewouldblock_engine/ewouldblock_engine.cc:1774:13
          #3 0x7ff61f74cdb5 in Couchbase::Thread::thread_entry() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/thread.cc:45:5
          #4 0x7ff61f738a1d in CouchbaseThread::run() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:59:9
          #5 0x7ff61f7375fe in platform_thread_wrap(void*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:72:14
          #6 0x7ff61f0cf6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #7 0x7ff61d41382c in clone /build/glibc-9tT8Do/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
       
      0x6190000eeaf8 is located 888 bytes inside of 1016-byte region [0x6190000ee780,0x6190000eeb78)
      freed by thread T2 (mc:worker_0) here:
          #0 0x525a90 in operator delete(void*) (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x525a90)
          #1 0x5b6846 in conn_destructor(Connection*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:427:5
          #2 0x5b6846 in release_connection(Connection*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:524
          #3 0x5b6846 in run_event_loop /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:167
          #4 0x52cf8b in event_handler(int, short, void*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:1071:5
          #5 0x7ff61e794e83 in event_process_active_single_queue.isra.26 (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/install/lib/libevent_core.so.2.1.8+0x19e83)
       
      previously allocated by thread T2 (mc:worker_0) here:
          #0 0x525410 in operator new(unsigned long) (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x525410)
          #1 0x5b7057 in allocate_connection(int, event_base*, ListeningPort const&) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:441:15
          #2 0x5b7057 in conn_new /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:204
          #3 0x57a34d in dispatch_new_connections(LIBEVENT_THREAD*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:269:17
          #4 0x57cfb9 in thread_libevent_process(int, short, void*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:310:5
          #5 0x7ff61e794e83 in event_process_active_single_queue.isra.26 (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/install/lib/libevent_core.so.2.1.8+0x19e83)
       
      Thread T2123 (ewb:pendingQ) created by T2122 (mc:bucket_add) here:
          #0 0x44cced in pthread_create (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x44cced)
          #1 0x7ff61f737555 in cb_create_named_thread /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:110:11
          #2 0x7ff61f74d0a1 in Couchbase::Thread::start() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/thread.cc:72:9
          #3 0x7ff615723a9c in EWB_Engine::EWB_Engine(server_handle_v1_t* (*)()) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/engines/ewouldblock_engine/ewouldblock_engine.cc:1289:23
          #4 0x7ff615725dc3 in create_instance /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/engines/ewouldblock_engine/ewouldblock_engine.cc:1712:34
          #5 0x7ff620c464d8 in create_engine_instance /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/utilities/engine_loader.cc:125:31
          #6 0x5bb928 in Engine::createInstance(server_handle_v1_t* (*)(), engine_interface**) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/enginemap.cc:44:16
          #7 0x5bb928 in new_engine_instance /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/enginemap.cc:85
          #8 0x52de26 in CreateBucketThread::create() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:2117:9
          #9 0x52ed3a in CreateBucketThread::run() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:2184:5
          #10 0x7ff61f74cdb5 in Couchbase::Thread::thread_entry() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/thread.cc:45:5
          #11 0x7ff61f738a1d in CouchbaseThread::run() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:59:9
          #12 0x7ff61f7375fe in platform_thread_wrap(void*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:72:14
          #13 0x7ff61f0cf6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
       
      Thread T2122 (mc:bucket_add) created by T5 (mc:worker_3) here:
          #0 0x44cced in pthread_create (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x44cced)
          #1 0x7ff61f737555 in cb_create_named_thread /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:110:11
          #2 0x7ff61f74d0a1 in Couchbase::Thread::start() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/thread.cc:72:9
          #3 0x5f82f5 in McbpCreateBucketTask::start() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/protocol/mcbp/create_remove_bucket_command_context.cc:39:16
          #4 0x5f82f5 in CreateRemoveBucketCommandContext::create() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/protocol/mcbp/create_remove_bucket_command_context.cc:83
          #5 0x5f9a59 in CreateRemoveBucketCommandContext::step() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/protocol/mcbp/create_remove_bucket_command_context.cc:126:23
          #6 0x623017 in SteppableCommandContext::drive() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/protocol/mcbp/steppable_command_context.cc:33:19
          #7 0x62b5a3 in conn_execute(McbpConnection*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/statemachine_mcbp.cc:306:5
          #8 0x5b271d in McbpStateMachine::execute(McbpConnection&) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/statemachine_mcbp.h:43:16
          #9 0x5b271d in McbpConnection::runStateMachinery() /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connection_mcbp.cc:873
          #10 0x5b271d in McbpConnection::runEventLoop(short) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connection_mcbp.cc:1169
          #11 0x5b6670 in run_event_loop /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/connections.cc:154:8
          #12 0x52cf8b in event_handler(int, short, void*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:1071:5
          #13 0x7ff61e794e83 in event_process_active_single_queue.isra.26 (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/install/lib/libevent_core.so.2.1.8+0x19e83)
       
      Thread T5 (mc:worker_3) created by T0 here:
          #0 0x44cced in pthread_create (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x44cced)
          #1 0x7ff61f737555 in cb_create_named_thread /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:110:11
          #2 0x57bf98 in create_worker(void (*)(void*), void*, unsigned long*, char const*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:101:16
          #3 0x57bf98 in thread_init(int, event_base*, void (*)(int, short, void*)) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:546
          #4 0x5367b9 in memcached_main /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:2820:5
          #5 0x7ff61d32d82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291
       
      Thread T2 (mc:worker_0) created by T0 here:
          #0 0x44cced in pthread_create (/home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/build/kv_engine/memcached+0x44cced)
          #1 0x7ff61f737555 in cb_create_named_thread /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/platform/src/cb_pthreads.cc:110:11
          #2 0x57bf98 in create_worker(void (*)(void*), void*, unsigned long*, char const*) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:101:16
          #3 0x57bf98 in thread_init(int, event_base*, void (*)(int, short, void*)) /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/thread.cc:546
          #4 0x5367b9 in memcached_main /home/couchbase/jenkins/workspace/kv_engine-addresssanitizer-master/kv_engine/daemon/memcached.cc:2820:5
          #5 0x7ff61d32d82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291
      

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            drigby Dave Rigby (Inactive)
            james.harrison James Harrison (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty