ASAN: AddressSanitizer CHECK failed: ((m)) != (0)" (0x0, 0x0)

[vitalybuka]

Very rarely we've seen this CHECK failed in asan allocator
There is no known reproducer yet.

==4979==AddressSanitizer CHECK failed: llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:1042 "((m)) != (0)" (0x0, 0x0)
Tracer caught signal 11: addr=0x8 pc=0x7f524740f420 sp=0x7f5235268160
==4971==LeakSanitizer has encountered a fatal error.
==4971==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==4971==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
E0206 05:42:07.026651 4971 allocator.cc:232] RAW:

Internal Google bug: http://b/149237057

[jzern]

I just got this with a note to update this issue:
chunk: 0x7f8dc206a000 caller 0x56245194de32 __lsan_current_stage CollectIgnoredCb
==1566==AddressSanitizer CHECK failed: third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:1053 "((m)) != (0)" (0x0, 0x0)
Tracer caught signal 11: addr=0x0 pc=0x7f911d152e91 sp=0x7f8dc2024550

sponge2/c301a9e8-8839-4215-b0aa-b01c99883e93

[vitalybuka]

Thanks, I'll take a look.

[vitalybuka]

Reproducer

// RUN: %clangxx_asan -O2 %s -o %t && %run %t

#include <atomic>
#include <memory>
#include <thread>
#include <vector>
#include <sanitizer/lsan_interface.h>

std::atomic<bool> done;

void foo() {
  std::vector<std::unique_ptr<char[]>> mem(100);

  while (!done)
    mem[rand() % mem.size()].reset(new char[1000000]);
}

int main() {
  std::vector<std::thread> first;
  for (int i = 0; i < 100; ++i)
    first.emplace_back(foo);

  for (int i = 0; i < 1000; ++i)
    __lsan_do_recoverable_leak_check();

  done = true;
  for (auto &f : first)
    f.join();

  return 0;
}

[vitalybuka]

Problem is here https://github.com/llvm/llvm-project/blob/63844c116a0acf8a75ebe4ed6f25fced3c655710/compiler-rt/lib/asan/asan_allocator.cpp#L465-L522

1. allocator.Allocate allocate memblock under internal lock
2. lsan waits for that lock, see LockAllocator
3. allocator.Allocate release the lock and returns
4. lsan "stops the word"
5. allocator.Allocate is stopped somewhere before line 522 (meta[1] = chunk_beg)
6. lsan calls GetUserBegin
7. m is meta[1]
8. So we fail CHECK(m)