Skip to content

[ASAN] heap-use-after-free in SpinLockTest.correctness test case #786

Closed as not planned
@JoeLoser

Description

@JoeLoser

Running Address Sanitizer on the locks_test test executable led to:

SUMMARY: AddressSanitizer: heap-use-after-free in folly::SingletonThreadLocal<folly::ThreadLocalPRNG::operator()()::Wrapper, folly::(anonymous namespace)::RandomTag, folly::detail::DefaultMake<folly::ThreadLocalPRNG::operator()()::Wrapper> >::Wrapper::~Wrapper()
Shadow bytes around the buggy address:
  0x1c08000003b0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x1c08000003c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x1c08000003d0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x1c08000003e0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x1c08000003f0: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
=>0x1c0800000400: fa fa fd[fd]fd fd fd fa fa fa 00 00 00 00 00 fa
  0x1c0800000410: fa fa 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
  0x1c0800000420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0800000430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0800000440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0800000450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

How to reproduce:
Simply set -fsanitize=address to cxx and link flags for that target, build, and run the locks_test text executable. Setting -fno-omit-frame-pointer to cxx flags would be helpful too.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions