skupperproject / skupper-router

An application-layer router for Skupper networks
https://skupper.io
Apache License 2.0
14 stars 18 forks source link

AddressSanitizer: use-after-poison accessing qdr_link_t during second attach work handling #713

Open kgiusti opened 2 years ago

kgiusti commented 2 years ago

https://github.com/kgiusti/skupper-router/runs/8252166205?check_suite_focus=true#step:29:1045

Apparently the qdr_link_t pointed to by the QDR_CONNECTION_WORK_SECOND_ATTACH has been freed before the work item gets serviced:

connections.c:
        case QDR_CONNECTION_WORK_SECOND_ATTACH :
            conn->protocol_adaptor->second_attach_handler(conn->protocol_adaptor->user_context, **work->link**, work->source, work->target)

40: ==3266==ERROR: AddressSanitizer: use-after-poison on address 0x6170000e20b0 at pc 0x0000005fe1fb bp 0x7f22a54bfe10 sp 0x7f22a54bfe08
40: READ of size 8 at 0x6170000e20b0 thread T5
40:     #0 0x5fe1fa in qdr_link_get_context /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_core/connections.c:511
40:     #1 0x6b7ec1 in CORE_link_second_attach /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_node.c:1662
40:     #2 0x5f9d6e in qdr_connection_process /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_core/connections.c:350
40:     #3 0x53050f in writable_handler /home/runner/work/skupper-router/skupper-router/skupper-router/src/container.c:388
40:     #4 0x6da932 in thread_run /home/runner/work/skupper-router/skupper-router/skupper-router/src/server.c:1105
40:     #5 0x7f22b1dda821 in start_thread (/lib64/libc.so.6+0x9f821)
40:     #6 0x7f22b1d7a44f in clone3 (/lib64/libc.so.6+0x3f44f)
40: 
40: 0x6170000e20b0 is located 176 bytes inside of 704-byte region [0x6170000e2000,0x6170000e22c0)
40: allocated by thread T5 here:
40:     #0 0x7f22b34bd4fc in __interceptor_posix_memalign (/lib64/libasan.so.6+0xaf4fc)
40:     #1 0x504a25 in qd_alloc /home/runner/work/skupper-router/skupper-router/skupper-router/src/alloc_pool.c:397
40:     #2 0x5fe8a1 in qdr_link_first_attach /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_core/connections.c:606
40:     #3 0x6b7a04 in AMQP_outgoing_link_handler /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_node.c:934
40:     #4 0x6d30f1 in handle /home/runner/work/skupper-router/skupper-router/skupper-router/src/server.c:1064
40:     #5 0x6da6ef in thread_run /home/runner/work/skupper-router/skupper-router/skupper-router/src/server.c:1089
40:     #6 0x7f22b1dda821 in start_thread (/lib64/libc.so.6+0x9f821)
40: 
40: Thread T5 created by T0 here:
40:     #0 0x7f22b3464866 in pthread_create (/lib64/libasan.so.6+0x56866)
40:     #1 0x5b23f9 in sys_thread /home/runner/work/skupper-router/skupper-router/skupper-router/src/posix/threading.c:166
40:     #2 0x6dcbb4 in qd_server_run /home/runner/work/skupper-router/skupper-router/skupper-router/src/server.c:1486
40:     #3 0x43599d in main_process /home/runner/work/skupper-router/skupper-router/skupper-router/router/src/main.c:109
40:     #4 0x4347d2 in main /home/runner/work/skupper-router/skupper-router/skupper-router/router/src/main.c:363
40:     #5 0x7f22b1d7aeaf in __libc_start_call_main (/lib64/libc.so.6+0x3feaf)
40: 
40: SUMMARY: AddressSanitizer: use-after-poison /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_core/connections.c:511 in qdr_link_get_context
jiridanek commented 2 years ago

https://github.com/jiridanek/skupper-router/runs/8269487368?check_suite_focus=true#step:9:1621

jiridanek commented 8 months ago

Here is a crash probably caused by this

Ha, there is gdb backtrace in one of the centos runs, https://github.com/skupperproject/skupper-router/actions/runs/7617561604/job/20746830854#step:39:71 not sure if thats already known

     Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x00000000004c717c in qdr_link_get_context (link=0x7fe464048010) at /home/runner/work/skupper-router/skupper-router/skupper-router/src/router_core/connections.c:555
    555                return safe_deref_qd_link_t(*safe_qdl);