Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] lru cache ut failed #8571

Closed
3 tasks done
caiconghui opened this issue Mar 21, 2022 · 0 comments · Fixed by #8569
Closed
3 tasks done

[Bug] lru cache ut failed #8571

caiconghui opened this issue Mar 21, 2022 · 0 comments · Fixed by #8569

Comments

@caiconghui
Copy link
Contributor

Search before asking

  • I had searched in the issues and found no similar issues.

Version

master

What's Wrong?

=================================================================
==3693262==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000021e30 at pc 0x56437f626dd9 bp 0x7ffe401016d0 sp 0x7ffe401016c0
READ of size 8 at 0x60b000021e30 thread T0
#0 0x56437f626dd8 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:372
#1 0x56437f629697 in doris::ShardedLRUCache::erase(doris::CacheKey const&) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:499
#2 0x56437f60e8ae in doris::CacheTest::Erase(int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8648ae)
#3 0x56437f5e73fc in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:147
#4 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#5 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#6 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#7 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#8 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#9 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#10 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#11 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#12 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#13 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#14 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#15 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#16 0x56437f50dd39 in _start (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf763d39)

0x60b000021e30 is located 48 bytes inside of 99-byte region [0x60b000021e00,0x60b000021e63)
freed by thread T0 here:
#0 0x56437f59c77f in free (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf7f277f)
#1 0x56437f632665 in doris::LRUHandle::free() /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.h:256
#2 0x56437f626da7 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:367
#3 0x56437f629697 in doris::ShardedLRUCache::erase(doris::CacheKey const&) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:499
#4 0x56437f60e8ae in doris::CacheTest::Erase(int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8648ae)
#5 0x56437f5e73fc in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:147
#6 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#7 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#8 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#9 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#10 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#11 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#12 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#13 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#14 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#15 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#16 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#17 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)

previously allocated by thread T0 here:
#0 0x56437f59cad7 in malloc (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf7f2ad7)
#1 0x56437f6261f0 in doris::LRUCache::insert(doris::CacheKey const&, unsigned int, void*, unsigned long, void ()(doris::CacheKey const&, void), doris::CachePriority) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:298
#2 0x56437f6293a3 in doris::ShardedLRUCache::insert(doris::CacheKey const&, void*, unsigned long, void ()(doris::CacheKey const&, void), doris::CachePriority) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:484
#3 0x56437f60e11c in doris::CacheTest::Insert(int, int, int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf86411c)
#4 0x56437f5e73b8 in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:145
#5 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#6 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#7 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#8 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#9 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#10 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#11 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#12 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#13 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#14 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#15 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#16 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)

SUMMARY: AddressSanitizer: heap-use-after-free /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:372 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*)
Shadow bytes around the buggy address:
0x0c167fffc370: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fd fd
0x0c167fffc380: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c167fffc390: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fffc3a0: 00 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x0c167fffc3b0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
=>0x0c167fffc3c0: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fa fa fa
0x0c167fffc3d0: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x0c167fffc3e0: 00 00 03 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc3f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3693262==ABORTING

What You Expected?

run be ut succeed

How to Reproduce?

No response

Anything Else?

No response

Are you willing to submit PR?

  • Yes I am willing to submit a PR!

Code of Conduct
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[fix](lru_cache) fix heap-use-after-free problem for lru cache caiconghui/incubator-doris
1 participant
@caiconghui