search

Syndica / sig

a Solana validator client implementation written in Zig
https://syndica.io/sig
Apache License 2.0
199 stars 33 forks source link

gossip: table value double free when using mainnet entrypoints #156

Open InKryption opened 3 months ago

InKryption commented 3 months ago

Description

Specifically manifests when on mainnet, does not manifest on testnet nor devnet.

How to Reproduce the Bug

❯ zig build run -- gossip -e 34.83.231.102:8001 -e 145.40.67.83:8001

error(gpa): Double free detected. Allocation:  
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:192:56: 0x100d61e2b in read__anon_30232 (sig)
                   const entries = try allocator.alloc(info.child, try bincode.read(allocator, usize, reader, params));
                                                      ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:145:64: 0x100d62503 in read__anon_30231 (sig)
                   @field(data, field.name) = try bincode.read(allocator, field.type, reader, params);
                                                              ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:145:64: 0x100d62797 in read__anon_30230 (sig)
                   @field(data, field.name) = try bincode.read(allocator, field.type, reader, params);
                                                              ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:80:53: 0x100d6e52f in read__anon_30112 (sig)
                   const payload = try bincode.read(allocator, field.type, reader, params);
                                                   ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:145:64: 0x100d6f1df in read__anon_30108 (sig)
                   @field(data, field.name) = try bincode.read(allocator, field.type, reader, params);
                                                              ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:195:51: 0x100d6f70b in read__anon_30328 (sig)
                       entry.* = try bincode.read(allocator, info.child, reader, params);
                                                 ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:145:64: 0x100d6fa7b in read__anon_30324 (sig)
                   @field(data, field.name) = try bincode.read(allocator, field.type, reader, params);
                                                              ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:80:53: 0x100d710e7 in read__anon_30081 (sig)
                   const payload = try bincode.read(allocator, field.type, reader, params);
                                                   ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:29:24: 0x100d717db in readFromSlice__anon_30080 (sig)
   return bincode.read(allocator, T, stream.reader(), params);
                      ^
/Users/trevor/projects/zig/sig/src/gossip/service.zig:394:52: 0x100d7dc4f in callback (sig)
               var message = bincode.readFromSlice(
                                                  ^
/Users/trevor/projects/zig/sig/src/utils/thread.zig:77:46: 0x100d4d6db in callback (sig)
           self.result = self.entry.callback();
                                            ^
/Users/trevor/projects/zig/sig/src/sync/thread_pool.zig:672:36: 0x100e9451b in run (sig)
                   (task.callback)(task);
                                  ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:408:13: 0x100e352ab in callFn__anon_33227 (sig)
           @call(.auto, f, args);
           ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:674:30: 0x100dc64af in entryFn (sig)
               return callFn(f, args_ptr.*);
                            ^
???:?:?: 0x181e6ef93 in ??? (libsystem_pthread.dylib)
???:?:?: 0x5d7d000181e69d33 in ??? (???)
First free:  
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:391:35: 0x100d49d7f in free__anon_30020 (sig)
                   allocator.free(value);
                                 ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:369:33: 0x100cef2a3 in free__anon_29232 (sig)
                   bincode.free(allocator, @field(value, field.name));
                               ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:369:33: 0x100c9065b in free__anon_28043 (sig)
                   bincode.free(allocator, @field(value, field.name));
                               ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:381:40: 0x100c2ce83 in free__anon_26725 (sig)
                   return bincode.free(allocator, @field(value, field.name));
                                      ^
/Users/trevor/projects/zig/sig/src/gossip/table.zig:699:21: 0x100e1d0c7 in remove (sig)
       bincode.free(self.allocator, versioned_value.value.data);
                   ^
/Users/trevor/projects/zig/sig/src/gossip/table.zig:732:24: 0x100da35eb in attemptTrim (sig)
           self.remove(label) catch unreachable;
                      ^
/Users/trevor/projects/zig/sig/src/gossip/service.zig:1730:41: 0x100db8763 in trimMemory (sig)
           try gossip_table.attemptTrim(UNIQUE_PUBKEY_CAPACITY);
                                       ^
/Users/trevor/projects/zig/sig/src/gossip/service.zig:839:32: 0x100db798b in buildMessages (sig)
           try self.trimMemory(getWallclockMs());
                              ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:429:13: 0x100cf2c53 in callFn__anon_29341 (sig)
           @call(.auto, f, args) catch |err| {
           ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:674:30: 0x100c947cb in entryFn (sig)
               return callFn(f, args_ptr.*);
                            ^
???:?:?: 0x181e6ef93 in ??? (libsystem_pthread.dylib)
???:?:?: 0x396a000181e69d33 in ??? (???)
Second free:  
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:391:35: 0x100d49d7f in free__anon_30020 (sig)
                   allocator.free(value);
                                 ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:369:33: 0x100cef2a3 in free__anon_29232 (sig)
                   bincode.free(allocator, @field(value, field.name));
                               ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:369:33: 0x100c9065b in free__anon_28043 (sig)
                   bincode.free(allocator, @field(value, field.name));
                               ^
/Users/trevor/projects/zig/sig/src/bincode/bincode.zig:381:40: 0x100c2ce83 in free__anon_26725 (sig)
                   return bincode.free(allocator, @field(value, field.name));
                                      ^
/Users/trevor/projects/zig/sig/src/gossip/table.zig:699:21: 0x100e1d0c7 in remove (sig)
       bincode.free(self.allocator, versioned_value.value.data);
                   ^
/Users/trevor/projects/zig/sig/src/gossip/table.zig:732:24: 0x100da35eb in attemptTrim (sig)
           self.remove(label) catch unreachable;
                      ^
/Users/trevor/projects/zig/sig/src/gossip/service.zig:1730:41: 0x100db8763 in trimMemory (sig)
           try gossip_table.attemptTrim(UNIQUE_PUBKEY_CAPACITY);
                                       ^
/Users/trevor/projects/zig/sig/src/gossip/service.zig:839:32: 0x100db798b in buildMessages (sig)
           try self.trimMemory(getWallclockMs());
                              ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:429:13: 0x100cf2c53 in callFn__anon_29341 (sig)
           @call(.auto, f, args) catch |err| {
           ^
/Users/trevor/ziglang/zig/zig-out/lib/zig/std/Thread.zig:674:30: 0x100c947cb in entryFn (sig)
               return callFn(f, args_ptr.*);
                            ^
???:?:?: 0x181e6ef93 in ??? (libsystem_pthread.dylib)
???:?:?: 0x396a000181e69d33 in ??? (???)

the same double free is reported a multitude of times, indicating a large number of double frees through this codepath.

Additional Context

No response

InKryption commented 3 months ago

I've confirmed this goes back to at least 5e78c2a1fa52fc3c803dbaa24298cb6eff8e1d0a.