Re: [Boost-users] [test] Use-after-free with --log_sink=file, reported by gcc 7.2

Subject: Re: [Boost-users] [test] Use-after-free with --log_sink=file, reported by gcc 7.2
From: Raffi Enficiaud (raffi.enficiaud_at_[hidden])
Date: 2017-12-30 22:30:13

Le 25.12.17 à 16:33, Avi Kivity via Boost-users a écrit :
> When static destructors are called, as the program exits, we destroy
> boost::unit_test::(anonymous namespace)::s_log_impl()::the_inst. This
> has a member vector, m_log_formatter_data. When destroying the second
> member, we run an ios_base_all_saver destructor, which attempts to
> restore a stream's format, however that stream has already been
> deallocated.
> 
> 
> Maybe that stream is in another static destructor, which was not ordered
> wrt. this one? Or maybe it was destroyed even earlier, when
> unit_test_main() exited.
> 
> 
> From ASan log, it loofs like the former. One static destructor is run
> from /usr/include/boost/test/impl/framework.ipp:459, while the other is
> run from /unit_test_log.ipp:122, so there is no ordering abong them.
> 
> *** No errors detected
> =================================================================
> ==1745==ERROR: AddressSanitizer: heap-use-after-free on address
> 0x6160000016a8 at pc 0x0000015f8892 bp 0x7ffecdb0b720 sp 0x7ffecdb0b710
> READ of size 8 at 0x6160000016a8 thread T0
> Â Â Â  #0 0x15f8891 in std::ios_base::width(long)
> /usr/include/c++/7/bits/ios_base.h:723
> Â Â Â  #1 0x161dea0 in boost::io::ios_base_all_saver::restore()
> /usr/include/boost/io/ios_state.hpp:340
> Â Â Â  #2 0x161dda6 in boost::io::ios_base_all_saver::~ios_base_all_saver()
> /usr/include/boost/io/ios_state.hpp:336
> Â Â Â  #3 0x168a22e in void
> boost::checked_delete<boost::io::ios_base_all_saver>(boost::io::ios_base_all_saver*)
> /usr/include/boost/core/checked_delete.hpp:34
> Â Â Â  #4 0x171b7c5 in
> boost::detail::sp_counted_impl_p<boost::io::ios_base_all_saver>::dispose()
> /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:78
> Â Â Â  #5 0x58b2c4 in boost::detail::sp_counted_base::release()
> /usr/include/boost/smart_ptr/detail/sp_counted_base_std_atomic.hpp:109
> Â Â Â  #6 0x58b51e in boost::detail::shared_count::~shared_count()
> /usr/include/boost/smart_ptr/detail/shared_count.hpp:419
> Â Â Â  #7 0x161eadc in
> boost::shared_ptr<boost::io::ios_base_all_saver>::~shared_ptr()
> /usr/include/boost/smart_ptr/shared_ptr.hpp:337
> Â Â Â  #8 0x1589a8a in ~unit_test_log_data_helper_impl
> /usr/include/boost/test/impl/unit_test_log.ipp:87
> Â Â Â  #9 0x15f0891 in _Destroy<boost::unit_test::(anonymous
> namespace)::unit_test_log_data_helper_impl>
> /usr/include/c++/7/bits/stl_construct.h:98
> Â Â Â  #10 0x15eb8ad in __destroy<boost::unit_test::(anonymous
> namespace)::unit_test_log_data_helper_impl*>
> /usr/include/c++/7/bits/stl_construct.h:108
> Â Â Â  #11 0x15e32c7 in _Destroy<boost::unit_test::(anonymous
> namespace)::unit_test_log_data_helper_impl*>
> /usr/include/c++/7/bits/stl_construct.h:137
> Â Â Â  #12 0x15cd317 in _Destroy<boost::unit_test::(anonymous
> namespace)::unit_test_log_data_helper_impl*,
> boost::unit_test::(anonymous namespace)::unit_test_log_data_helper_impl>
> /usr/include/c++/7/bits/stl_construct.h:206
> Â Â Â  #13 0x15c0de2 in ~vector /usr/include/c++/7/bits/stl_vector.h:434
> Â Â Â  #14 0x158aa72 in ~unit_test_log_impl
> /usr/include/boost/test/impl/unit_test_log.ipp:122
> Â Â Â  #15 0x7f6c2db90b57 in __run_exit_handlers (/lib64/libc.so.6+0x3bb57)
> Â Â Â  #16 0x7f6c2db90ba9 in exit (/lib64/libc.so.6+0x3bba9)
> Â Â Â  #17 0x7f6c2db76010 in __libc_start_main (/lib64/libc.so.6+0x21010)
> Â Â Â  #18 0x4172e9 in _start
> (/home/avi/seastar/build/debug/tests/memcached/test_ascii_parser_g+0x4172e9)
> 
> 
> 0x6160000016a8 is located 296 bytes inside of 544-byte region
> [0x616000001580,0x6160000017a0)
> freed by thread T0 here:
> Â Â Â  #0 0x7f6c32c9d6d8 in operator delete(void*, unsigned long)
> (/lib64/libasan.so.4+0xe16d8)
> Â Â Â  #1 0x1717f1e in
> boost::detail::sp_counted_impl_pd<std::basic_ofstream<char,
> std::char_traits<char> >*,
> boost::detail::sp_ms_deleter<std::basic_ofstream<char,
> std::char_traits<char> > > >::~sp_counted_impl_pd()
> /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:127
> Â Â Â  #2 0xc1563b in boost::detail::sp_counted_base::destroy()
> /usr/include/boost/smart_ptr/detail/sp_counted_base_std_atomic.hpp:89
> Â Â Â  #3 0x58b3e4 in boost::detail::sp_counted_base::weak_release()
> /usr/include/boost/smart_ptr/detail/sp_counted_base_std_atomic.hpp:123
> Â Â Â  #4 0x58b2f3 in boost::detail::sp_counted_base::release()
> /usr/include/boost/smart_ptr/detail/sp_counted_base_std_atomic.hpp:110
> Â Â Â  #5 0x58b51e in boost::detail::shared_count::~shared_count()
> /usr/include/boost/smart_ptr/detail/shared_count.hpp:419
> Â Â Â  #6 0x15fe350 in boost::shared_ptr<std::basic_ofstream<char,
> std::char_traits<char> > >::~shared_ptr()
> /usr/include/boost/smart_ptr/shared_ptr.hpp:337
> Â Â Â  #7 0x160f9ec in
> boost::unit_test::runtime_config::stream_holder::~stream_holder()
> /usr/include/boost/test/unit_test_parameters.hpp:96
> Â Â Â  #8 0x16fb8fc in std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>::~pair()
> /usr/include/c++/7/bits/stl_pair.h:198
> Â Â Â  #9 0x16fb964 in void
> __gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> >
>>::destroy<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>
>>(std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>*)
> /usr/include/c++/7/ext/new_allocator.h:140
> Â Â Â  #10 0x16ef009 in void
> std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> > >
>>::destroy<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>
>>(std::allocator<std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> > >&,
> std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>*)
> /usr/include/c++/7/bits/alloc_traits.h:487
> Â Â Â  #11 0x16d81bc in std::_Rb_tree<boost::unit_test::output_format,
> std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>,
> std::_Select1st<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >,
> std::less<boost::unit_test::output_format>,
> std::allocator<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >
>>::_M_destroy_node(std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> >*)
> /usr/include/c++/7/bits/stl_tree.h:650
> Â Â Â  #12 0x16adac7 in std::_Rb_tree<boost::unit_test::output_format,
> std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>,
> std::_Select1st<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >,
> std::less<boost::unit_test::output_format>,
> std::allocator<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >
>>::_M_drop_node(std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> >*)
> /usr/include/c++/7/bits/stl_tree.h:658
> Â Â Â  #13 0x167e5af in std::_Rb_tree<boost::unit_test::output_format,
> std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>,
> std::_Select1st<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >,
> std::less<boost::unit_test::output_format>,
> std::allocator<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >
>>::_M_erase(std::_Rb_tree_node<std::pair<boost::unit_test::output_format
> const, boost::unit_test::runtime_config::stream_holder> >*)
> /usr/include/c++/7/bits/stl_tree.h:1858
> Â Â Â  #14 0x1649760 in std::_Rb_tree<boost::unit_test::output_format,
> std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder>,
> std::_Select1st<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> >,
> std::less<boost::unit_test::output_format>,
> std::allocator<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> > >::~_Rb_tree()
> /usr/include/c++/7/bits/stl_tree.h:949
> Â Â Â  #15 0x160f988 in std::map<boost::unit_test::output_format,
> boost::unit_test::runtime_config::stream_holder,
> std::less<boost::unit_test::output_format>,
> std::allocator<std::pair<boost::unit_test::output_format const,
> boost::unit_test::runtime_config::stream_holder> > >::~map()
> /usr/include/c++/7/bits/stl_map.h:294
> Â Â Â  #16 0x161009b in boost::unit_test::framework::state::~state()
> /usr/include/boost/test/impl/framework.ipp:459
> Â Â Â  #17 0x7f6c2db90b57 in __run_exit_handlers (/lib64/libc.so.6+0x3bb57)
> 
> previously allocated by thread T0 here:
> Â Â Â  #0 0x7f6c32c9c158 in operator new(unsigned long)
> (/lib64/libasan.so.4+0xe0158)
> Â Â Â  #1 0x169dfd6 in
> boost::detail::shared_count::shared_count<std::basic_ofstream<char,
> std::char_traits<char> >*,
> boost::detail::sp_ms_deleter<std::basic_ofstream<char,
> std::char_traits<char> > > >(std::basic_ofstream<char,
> std::char_traits<char> >*,
> boost::detail::sp_inplace_tag<boost::detail::sp_ms_deleter<std::basic_ofstream<char,
> std::char_traits<char> > > >)
> /usr/include/boost/smart_ptr/detail/shared_count.hpp:206
> Â Â Â  #2 0x16728db in boost::shared_ptr<std::basic_ofstream<char,
> std::char_traits<char> > >::shared_ptr<std::basic_ofstream<char,
> std::char_traits<char> >,
> boost::detail::sp_inplace_tag<boost::detail::sp_ms_deleter<std::basic_ofstream<char,
> std::char_traits<char> > > > >(std::basic_ofstream<char,
> std::char_traits<char> >*,
> boost::detail::sp_inplace_tag<boost::detail::sp_ms_deleter<std::basic_ofstream<char,
> std::char_traits<char> > > >)
> /usr/include/boost/smart_ptr/shared_ptr.hpp:372
> Â Â Â  #3 0x163c6e6 in
> boost::detail::sp_if_not_array<std::basic_ofstream<char,
> std::char_traits<char> > >::type
> boost::make_shared<std::basic_ofstream<char, std::char_traits<char> >>()
> /usr/include/boost/smart_ptr/make_shared_object.hpp:250
> Â Â Â  #4 0x15fe6ad in
> boost::unit_test::runtime_config::stream_holder::setup(boost::unit_test::basic_cstring<char
> const> const&) /usr/include/boost/test/unit_test_parameters.hpp:114
> Â Â Â  #5 0x155cd45 in boost::unit_test::framework::impl::setup_loggers()
> /usr/include/boost/test/impl/framework.ipp:861
> Â Â Â  #6 0x1561113 in boost::unit_test::framework::init(bool (*)(), int,
> char**) /usr/include/boost/test/impl/framework.ipp:1033
> Â Â Â  #7 0x1599d40 in boost::unit_test::unit_test_main(bool (*)(), int,
> char**) /usr/include/boost/test/impl/unit_test_main.ipp:189
> Â Â Â  #8 0x15c067f in main tests/test-utils.cc:84
> Â Â Â  #9 0x7f6c2db76009 in __libc_start_main (/lib64/libc.so.6+0x21009)
> 
> SUMMARY: AddressSanitizer: heap-use-after-free
> /usr/include/c++/7/bits/ios_base.h:723 in std::ios_base::width(long)
> Shadow bytes around the buggy address:
> Â  0x0c2c7fff8280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Â  0x0c2c7fff8290: 00 00 00 00 06 fa fa fa fa fa fa fa fa fa fa fa
> Â  0x0c2c7fff82a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Â  0x0c2c7fff82b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
> Â  0x0c2c7fff82c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
> =>0x0c2c7fff82d0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
> Â  0x0c2c7fff82e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
> Â  0x0c2c7fff82f0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
> Â  0x0c2c7fff8300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Â  0x0c2c7fff8310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
> Â  0x0c2c7fff8320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
> Shadow byte legend (one shadow byte represents 8 application bytes):
> Â  Addressable:Â Â Â Â Â Â Â Â Â Â  00
> Â  Partially addressable: 01 02 03 04 05 06 07
> Â  Heap left redzone:Â Â Â Â Â Â  fa
> Â  Freed heap region:Â Â Â Â Â Â  fd
> Â  Stack left redzone:Â Â Â Â Â  f1
> Â  Stack mid redzone:Â Â Â Â Â Â  f2
> Â  Stack right redzone:Â Â Â Â  f3
> Â  Stack after return:Â Â Â Â Â  f5
> Â  Stack use after scope:Â Â  f8
> Â  Global redzone:Â Â Â Â Â Â Â Â Â  f9
> Â  Global init order:Â Â Â Â Â Â  f6
> Â  Poisoned by user:Â Â Â Â Â Â Â  f7
> Â  Container overflow:Â Â Â Â Â  fc
> Â  Array cookie:Â Â Â Â Â Â Â Â Â Â Â  ac
> Â  Intra object redzone:Â Â Â  bb
> Â  ASan internal:Â Â Â Â Â Â Â Â Â Â  fe
> Â  Left alloca redzone:Â Â Â Â  ca
> Â  Right alloca redzone:Â Â Â  cb
> ==1745==ABORTING

Thanks for the report. I also see this in a similar report, I think
those reports have the same cause:
http://www.boost.org/development/tests/develop/developer/Marshall-ASAN-test-clang-darwin-darwin-asan-result-report-test-variants_.html

Would you mind creating a ticket?

Raffi