search

tokio-rs / loom

Concurrency permutation testing tool for Rust.
MIT License
2.14k stars 111 forks source link

ASan reports a stack-use-after-scope error #174

Open parasyte opened 4 years ago

parasyte commented 4 years ago

minimal repro:

use loom::thread;

fn main() {
    loom::model(|| {
        thread::spawn(|| ()).join().unwrap();
    });
}
Debug session log on macOS ``` $ RUSTFLAGS='-Zsanitizer=address' cargo build Updating crates.io index Compiling semver-parser v0.7.0 Compiling cc v1.0.60 Compiling libc v0.2.77 Compiling log v0.4.11 Compiling cfg-if v0.1.10 Compiling scoped-tls v1.0.0 Compiling semver v0.9.0 Compiling rustc_version v0.2.3 Compiling generator v0.6.22 Compiling loom v0.3.5 Compiling loom-asan-test v0.1.0 (/Users/parasyte/other-projects/loom-asan-test) Finished dev [unoptimized + debuginfo] target(s) in 8.19s $ lldb target/debug/loom-asan-test (lldb) target create "target/debug/loom-asan-test" Current executable set to '/Users/parasyte/other-projects/loom-asan-test/target/debug/loom-asan-test' (x86_64). (lldb) r Process 40279 launched: '/Users/parasyte/other-projects/loom-asan-test/target/debug/loom-asan-test' (x86_64) Completed in 1 iterations ==40279==WARNING: ASan is ignoring requested __asan_handle_no_return: stack type: default top: 0x7ffeefc00000; bottom 0x000104106000; size: 0x7ffdebafa000 (140728557608960) False positive error reports may follow For details see https://github.com/google/sanitizers/issues/189 ================================================================= ==40279==ERROR: AddressSanitizer: stack-use-after-scope on address 0x000104107b28 at pc 0x0001003ccd4d bp 0x000104107600 sp 0x000104106dc0 READ of size 168 at 0x000104107b28 thread T0 #0 0x1003ccd4c in wrap_memmove+0x16c (librustc-nightly_rt.asan.dylib:x86_64+0x17d4c) Address 0x000104107b28 is a wild pointer. SUMMARY: AddressSanitizer: stack-use-after-scope (librustc-nightly_rt.asan.dylib:x86_64+0x17d4c) in wrap_memmove+0x16c Shadow bytes around the buggy address: 0x100020820f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x100020820f60: f1 f1 f1 f1 f8[f8]f2 f2 00 00 f3 f3 00 00 00 00 0x100020820f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100020820fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc 2020-09-21 01:30:56.687976-0700 loom-asan-test[40279:9567333] ==40279==WARNING: ASan is ignoring requested __asan_handle_no_return: stack type: default top: 0x7ffeefc00000; bottom 0x000104106000; size: 0x7ffdebafa000 (140728557608960) 2020-09-21 01:30:56.688357-0700 loom-asan-test[40279:9567333] False positive error reports may follow 2020-09-21 01:30:56.688365-0700 loom-asan-test[40279:9567333] For details see https://github.com/google/sanitizers/issues/189 2020-09-21 01:30:56.688371-0700 loom-asan-test[40279:9567333] ================================================================= 2020-09-21 01:30:56.688377-0700 loom-asan-test[40279:9567333] ==40279==ERROR: AddressSanitizer: stack-use-after-scope on address 0x000104107b28 at pc 0x0001003ccd4d bp 0x000104107600 sp 0x000104106dc0 2020-09-21 01:30:56.688383-0700 loom-asan-test[40279:9567333] READ of size 168 at 0x000104107b28 thread T0 2020-09-21 01:30:56.688388-0700 loom-asan-test[40279:9567333] #0 0x1003ccd4c in wrap_memmove+0x16c (librustc-nightly_rt.asan.dylib:x86_64+0x17d4c) 2020-09-21 01:30:56.688393-0700 loom-asan-test[40279:9567333] 2020-09-21 01:30:56.688399-0700 loom-asan-test[40279:9567333] Address 0x000104107b28 is a wild pointer. 2020-09-21 01:30:56.688405-0700 loom-asan-test[40279:9567333] SUMMARY: AddressSanitizer: stack-use-after-scope (librustc-nightly_rt.asan.dylib:x86_64+0x17d4c) in wrap_memmove+0x16c 2020-09-21 01:30:56.688410-0700 loom-asan-test[40279:9567333] Shadow bytes around the buggy address: 2020-09-21 01:30:56.688442-0700 loom-asan-test[40279:9567333] 0x100020820f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688447-0700 loom-asan-test[40279:9567333] 0x100020820f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688452-0700 loom-asan-test[40279:9567333] 0x100020820f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688472-0700 loom-asan-test[40279:9567333] 0x100020820f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688477-0700 loom-asan-test[40279:9567333] 0x100020820f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688503-0700 loom-asan-test[40279:9567333] =>0x100020820f60: f1 f1 f1 f1 f8[f8]f2 f2 00 00 f3 f3 00 00 00 00 2020-09-21 01:30:56.688508-0700 loom-asan-test[40279:9567333] 0x100020820f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688514-0700 loom-asan-test[40279:9567333] 0x100020820f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688519-0700 loom-asan-test[40279:9567333] 0x100020820f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688525-0700 loom-asan-test[40279:9567333] 0x100020820fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688530-0700 loom-asan-test[40279:9567333] 0x100020820fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2020-09-21 01:30:56.688535-0700 loom-asan-test[40279:9567333] Shadow byte legend (one shadow byte represents 8 application bytes): 2020-09-21 01:30:56.688541-0700 loom-asan-test[40279:9567333] Addressable: 00 2020-09-21 01:30:56.688547-0700 loom-asan-test[40279:9567333] Partially addressable: 01 02 03 04 05 06 07 2020-09-21 01:30:56.688552-0700 loom-asan-test[40279:9567333] Heap left redzone: fa 2020-09-21 01:30:56.688557-0700 loom-asan-test[40279:9567333] Freed heap region: fd 2020-09-21 01:30:56.688561-0700 loom-asan-test[40279:9567333] Stack left redzone: f1 2020-09-21 01:30:56.688567-0700 loom-asan-test[40279:9567333] Stack mid redzone: f2 2020-09-21 01:30:56.688572-0700 loom-asan-test[40279:9567333] Stack right redzone: f3 2020-09-21 01:30:56.688577-0700 loom-asan-test[40279:9567333] Stack after return: f5 2020-09-21 01:30:56.688582-0700 loom-asan-test[40279:9567333] Stack use after scope: f8 2020-09-21 01:30:56.688601-0700 loom-asan-test[40279:9567333] Global redzone: f9 2020-09-21 01:30:56.688605-0700 loom-asan-test[40279:9567333] Global init order: f6 2020-09-21 01:30:56.688629-0700 loom-asan-test[40279:9567333] Poisoned by user: f7 2020-09-21 01:30:56.688633-0700 loom-asan-test[40279:9567333] Container overflow: fc 2020-09-21 01:30:56.688638-0700 loom-asan-test[40279:9567333] Array cookie: ac 2020-09-21 01:30:56.688651-0700 loom-asan-test[40279:9567333] Intra object redzone: bb 2020-09-21 01:30:56.688657-0700 loom-asan-test[40279:9567333] ASan internal: fe 2020-09-21 01:30:56.688676-0700 loom-asan-test[40279:9567333] Left alloca redzone: ca 2020-09-21 01:30:56.688681-0700 loom-asan-test[40279:9567333] Right alloca redzone: cb 2020-09-21 01:30:56.688704-0700 loom-asan-test[40279:9567333] Shadow gap: cc ==40279==ABORTING Process 40279 stopped * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT frame #0: 0x00007fff6b0ad33a libsystem_kernel.dylib`__pthread_kill + 10 libsystem_kernel.dylib`__pthread_kill: -> 0x7fff6b0ad33a <+10>: jae 0x7fff6b0ad344 ; <+20> 0x7fff6b0ad33c <+12>: movq %rax, %rdi 0x7fff6b0ad33f <+15>: jmp 0x7fff6b0a7629 ; cerror_nocancel 0x7fff6b0ad344 <+20>: retq Target 0: (loom-asan-test) stopped. (lldb) bt error: need to add support for DW_TAG_base_type '()' encoded with DW_ATE = 0x7, bit_size = 0 error: need to add support for DW_TAG_base_type '()' encoded with DW_ATE = 0x7, bit_size = 0 error: need to add support for DW_TAG_base_type '()' encoded with DW_ATE = 0x7, bit_size = 0 error: need to add support for DW_TAG_base_type '()' encoded with DW_ATE = 0x7, bit_size = 0 * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT * frame #0: 0x00007fff6b0ad33a libsystem_kernel.dylib`__pthread_kill + 10 frame #1: 0x00007fff6b169e60 libsystem_pthread.dylib`pthread_kill + 430 frame #2: 0x00007fff6b034808 libsystem_c.dylib`abort + 120 frame #3: 0x0000000100417176 librustc-nightly_rt.asan.dylib`__sanitizer::Abort() + 70 frame #4: 0x0000000100416ab4 librustc-nightly_rt.asan.dylib`__sanitizer::Die() + 196 frame #5: 0x00000001003fe954 librustc-nightly_rt.asan.dylib`__asan::ScopedInErrorReport::~ScopedInErrorReport() + 420 frame #6: 0x00000001003fe1ee librustc-nightly_rt.asan.dylib`__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) + 1198 frame #7: 0x00000001003ccd6c librustc-nightly_rt.asan.dylib`wrap_memmove + 396 frame #8: 0x00007fff6b197b84 libunwind.dylib`unw_init_local + 33 frame #9: 0x00007fff6b198563 libunwind.dylib`unwind_phase2 + 41 frame #10: 0x00007fff6b19be79 libunwind.dylib`_Unwind_Resume + 51 frame #11: 0x0000000100067fed loom-asan-test`generator::yield_::yield_::h44b204ac82d88f36(v=) at yield_.rs:0:1 frame #12: 0x000000010002955a loom-asan-test`loom::rt::scheduler::spawn_threads::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h78704182e038d361((null)=closure-0 @ 0x0000000104108220) at scheduler.rs:138:56 frame #13: 0x00000001001193b6 loom-asan-test`generator::gen_impl::GeneratorImpl$LT$A$C$T$GT$::init_code::_$u7b$$u7b$closure$u7d$$u7d$::h9b912bd353b5bf3b at gen_impl.rs:308:21 frame #14: 0x00000001000e54fc loom-asan-test`generator::stack::StackBox$LT$F$GT$::call_once::h30684f411b2ff6b2(data=0x0000000104108e80) at mod.rs:135:13 frame #15: 0x0000000100121407 loom-asan-test`generator::stack::Func::call_once::h4daec637ff184991(self=Func @ 0x0000000104108620) at mod.rs:117:9 frame #16: 0x0000000100138f4d loom-asan-test`generator::gen_impl::gen_init::_$u7b$$u7b$closure$u7d$$u7d$::h83bb20a1b69e36a1 at gen_impl.rs:513:9 frame #17: 0x000000010012b57c loom-asan-test`core::ops::function::FnOnce::call_once::h1e673fc2980aed3f((null)=closure-0 @ 0x0000000104108820, (null)=) at function.rs:227:5 frame #18: 0x0000000100126e1a loom-asan-test`std::panicking::try::do_call::hff3b691df2061b12(data="�\x8f\x10\x04\x01") at panicking.rs:381:40 frame #19: 0x0000000100127b9d loom-asan-test`__rust_try + 29 frame #20: 0x0000000100126b18 loom-asan-test`std::panicking::try::hf89589518d2a7178(f=closure-0 @ 0x0000000104108b20) at panicking.rs:345:19 frame #21: 0x000000010012b2a1 loom-asan-test`std::panic::catch_unwind::hd2813c5b6faf7255(f=closure-0 @ 0x0000000104108ba8) at panic.rs:382:14 frame #22: 0x00000001001387f8 loom-asan-test`generator::gen_impl::gen_init::hc5eedddfe516064c((null)=0, f=0x0000000104108fa0) at gen_impl.rs:527:25 ```

AFAICT, this is caused by the way the generator crate is used. The error can be worked around by enabling the detect_stack_use_after_return option:

$ RUSTFLAGS='-Zsanitizer=address' ASAN_OPTIONS=detect_stack_use_after_return=1 cargo run
   Compiling semver-parser v0.7.0
   Compiling cc v1.0.60
   Compiling libc v0.2.77
   Compiling log v0.4.11
   Compiling semver v0.9.0
   Compiling rustc_version v0.2.3
   Compiling generator v0.6.22
   Compiling loom v0.3.5
   Compiling loom-asan-test v0.1.0 (/Users/parasyte/other-projects/loom-asan-test)
    Finished dev [unoptimized + debuginfo] target(s) in 6.77s
     Running `target/debug/loom-asan-test`
Completed in 1 iterations
==42679==WARNING: ASan is ignoring requested __asan_handle_no_return: stack type: default top: 0x7ffee4596000; bottom 0x00010fdb5000; size: 0x7ffdd47e1000 (140728168484864)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189

The above warning is also printed on Linux, even without the macOS workaround.

parasyte commented 4 years ago

It looks like std needs to be built with ASan, as well. Building with the build-std flag causes the failure to occur on Linux. The same workaround posted for macOS also works for Linux.