================================================================= ==13107==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100047a598 at pc 0x7f555aa14e48 bp 0x7f554a9027c0 sp 0x7f554a9027b0 WRITE of size 8 at 0x61100047a598 thread T24 llvm-symbolizer: for the -functions option: Cannot find option named 'true'! #0 0x7f555aa14e47 in dblayer_close_indexes /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/dblayer.c:2518 #1 0x7f555aa15343 in dblayer_instance_close /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/dblayer.c:2562 #2 0x7f555aabe3f8 in ldbm_instance_delete_instance_entry_callback /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1239 #3 0x7f556a2cc072 in dse_call_callback /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:2634 #4 0x7f556a2cb798 in dse_delete /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:2496 #5 0x7f556a2b11db in op_shared_delete /home/william/development/389ds/ds/ldap/servers/slapd/delete.c:333 #6 0x7f556a2b02ab in do_delete /home/william/development/389ds/ds/ldap/servers/slapd/delete.c:97 #7 0x41f74d in connection_dispatch_operation /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:617 #8 0x4252d2 in connection_threadmain /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:1759 #9 0x7f55677857de in _pt_root /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:216 #10 0x7f55675456b9 in start_thread /usr/src/debug/glibc-2.24-91-g7e625f7/nptl/pthread_create.c:333 #11 0x7f55672803ce in __GI___clone /usr/src/debug////////glibc-2.24-91-g7e625f7/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:105 0x61100047a598 is located 24 bytes inside of 208-byte region [0x61100047a580,0x61100047a650) freed by thread T20 here: #0 0x7f556a804ba0 in __interceptor_free _asan_rtl_ #1 0x7f556a2a4e72 in slapi_ch_free /home/william/development/389ds/ds/ldap/servers/slapd/ch_malloc.c:292 #2 0x7f555aa8640e in attrinfo_delete /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/ldbm_attr.c:62 #3 0x7f555ab0a620 in vlvIndex_delete /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv_srch.c:547 #4 0x7f555ab0902e in vlvSearch_delete /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv_srch.c:224 #5 0x7f555aafbf31 in vlv_DeleteSearchEntry /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv.c:123 #6 0x7f556a2cc072 in dse_call_callback /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:2634 #7 0x7f556a2cb798 in dse_delete /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:2496 #8 0x7f556a2b11db in op_shared_delete /home/william/development/389ds/ds/ldap/servers/slapd/delete.c:333 #9 0x7f556a2b02ab in do_delete /home/william/development/389ds/ds/ldap/servers/slapd/delete.c:97 #10 0x41f74d in connection_dispatch_operation /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:617 #11 0x4252d2 in connection_threadmain /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:1759 #12 0x7f55677857de in _pt_root /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:216 previously allocated by thread T33 here: #0 0x7f556a8050c0 in calloc _asan_rtl_ #1 0x7f556a2a49ca in slapi_ch_calloc /home/william/development/389ds/ds/ldap/servers/slapd/ch_malloc.c:188 #2 0x7f555aa861e9 in attrinfo_new /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/ldbm_attr.c:37 #3 0x7f555ab09ff7 in vlvIndex_new /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv_srch.c:509 #4 0x7f555aafca38 in vlv_init_index_entry /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv.c:243 #5 0x7f556a2cc072 in dse_call_callback /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:2634 #6 0x7f556a2c883a in do_dse_search /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:1643 #7 0x7f556a2c8ef9 in dse_search /home/william/development/389ds/ds/ldap/servers/slapd/dse.c:1757 #8 0x7f556a35be36 in op_shared_search /home/william/development/389ds/ds/ldap/servers/slapd/opshared.c:807 #9 0x7f556a3983f3 in search_internal_callback_pb /home/william/development/389ds/ds/ldap/servers/slapd/plugin_internal_op.c:783 #10 0x7f556a3979b6 in search_internal_pb /home/william/development/389ds/ds/ldap/servers/slapd/plugin_internal_op.c:636 #11 0x7f556a397229 in slapi_search_internal /home/william/development/389ds/ds/ldap/servers/slapd/plugin_internal_op.c:480 #12 0x7f555aafd7d2 in vlv_init /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/vlv.c:397 #13 0x7f555aa6c43d in bulk_import_start /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/import-threads.c:3146 #14 0x7f555aa6e08f in ldbm_back_wire_import /home/william/development/389ds/ds/ldap/servers/slapd/back-ldbm/import-threads.c:3418 #15 0x7f556a2a25a0 in process_bulk_import_op /home/william/development/389ds/ds/ldap/servers/slapd/bulk_import.c:140 #16 0x7f556a2a2188 in slapi_start_bulk_import /home/william/development/389ds/ds/ldap/servers/slapd/bulk_import.c:47 #17 0x7f555977eb1b in multimaster_extop_StartNSDS50ReplicationRequest /home/william/development/389ds/ds/ldap/servers/plugins/replication/repl_extop.c:955 #18 0x7f556a383d9b in plugin_call_exop_plugins /home/william/development/389ds/ds/ldap/servers/slapd/plugin.c:546 #19 0x43bcab in do_extended /home/william/development/389ds/ds/ldap/servers/slapd/extendop.c:354 #20 0x41faf8 in connection_dispatch_operation /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:680 #21 0x4252d2 in connection_threadmain /home/william/development/389ds/ds/ldap/servers/slapd/connection.c:1759 #22 0x7f55677857de in _pt_root /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:216 Thread T24 created by T0 here: #0 0x7f556a76f538 in pthread_create _asan_rtl_ #1 0x7f55677854ba in _PR_CreateThread /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:457 Thread T20 created by T0 here: #0 0x7f556a76f538 in pthread_create _asan_rtl_ #1 0x7f55677854ba in _PR_CreateThread /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:457 Thread T33 created by T0 here: #0 0x7f556a76f538 in pthread_create _asan_rtl_ #1 0x7f55677854ba in _PR_CreateThread /usr/src/debug/nspr-4.12.0/pr/src/pthreads/../../../nspr/pr/src/pthreads/ptthread.c:457 SUMMARY: AddressSanitizer: heap-use-after-free (/opt/dirsrv/lib/dirsrv/plugins/libback-ldbm.so+0x70e47) Shadow bytes around the buggy address: 0x0c2280087460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280087470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280087480: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2280087490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800874a0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c22800874b0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800874c0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x0c22800874d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c22800874e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800874f0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa 0x0c2280087500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==13107==ABORTING
Triggered by ticket47966_test.py
Here is the code in question that triggers the use after free:
{{{
next = handle->dblayer_handle_next; *((dblayer_handle )handle->dblayer_handle_ai_backpointer) = NULL; //<<-- This one slapi_ch_free((void)&handle);
}}}
Now, according to the header:
{{{ struct tag_dblayer_handle { ... void dblayer_handle_ai_backpointer; / Voodo magic pointer to the place where we store a· pointer to this handle in the attrinfo structure / }; }}}
Which doesn't make a lot of sense. Looking at it, this value is only in three places:
{{{ ./ldap/servers/slapd/back-ldbm/back-ldbm.h:685: void dblayer_handle_ai_backpointer; / Voodo magic pointer to the place where we store a ./ldap/servers/slapd/back-ldbm/dblayer.c:2519: ((dblayer_handle )handle->dblayer_handle_ai_backpointer) = NULL; ./ldap/servers/slapd/back-ldbm/dblayer.c:3145: handle->dblayer_handle_ai_backpointer = &(a->ai_dblayer); }}}
Looking at this, we can see one is the definition, one is the clearing of the pointer. It looks like we set this value in dblayer.c 3145, but never use it.
{{{ int dblayer_get_index_file(backend be, struct attrinfo a, DB** ppDB, int open_flags) ... a->ai_dblayer = handle; handle->dblayer_handle_ai_backpointer = &(a->ai_dblayer); }}}
So thinking about it, I think there are a few possibilities.
First, we NULL the dblayer_handle_ai_backpointer in attrinfo_delete(), because we have access to it via a->ai_dblayer->dblayer_handle_ai_backpointer, and we can then remove the offending code in dblayer.c:2519.
Alternately, we can not call attrinfo_delete in vlvIndex_delete() and various other places, opting to use attrinfo_delete in dblayer.c:2519
Or finally, we can not set the backpointer at all. We don't use it, or reference it anywhere! So why both setting something that we don't use?
Thoughts?
git patch file (master) -- tentative 0001-Ticket-48987-Heap-use-after-free-in-dblayer_close_in.patch
Could it be possible to run the test with this patch? 0001-Ticket-48987-Heap-use-after-free-in-dblayer_close_in.patch
Thanks!!
Hmmm I think that patch causes a different issue to occur now.
I think I'll have to investigate this later when I have more time to spend on the problem.
attachment 0001-Ticket-48987-Heap-use-after-free-in-dblayer_close_in.2.patch
Looks good to me. Thanks!
commit 753f7c5bbee286dab2a2321a7eb7e46d3df5e652 Writing objects: 100% (17/17), 2.53 KiB | 0 bytes/s, done. Total 17 (delta 13), reused 0 (delta 0) To ssh://git.fedorahosted.org/git/389/ds.git 4d448d3..9917640 master -> master
fa54d0c..f4b2a54 389-ds-base-1.2.11 -> 389-ds-base-1.2.11 commit f4b2a54 Author: Noriko Hosoi nhosoi@redhat.com Date: Wed Sep 28 15:28:28 2016 -0700
2dd62a7..85f4cd6 389-ds-base-1.3.4 -> 389-ds-base-1.3.4 commit 85f4cd6
60a4fa0..6c39c95 389-ds-base-1.3.5 -> 389-ds-base-1.3.5 commit 6c39c95
Metadata Update from @nhosoi: - Issue assigned to firstyear - Issue set to the milestone: 1.3.6 backlog
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/2046
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix (was: Fixed)
Login to comment on this ticket.