Skip to content

Conversation

@bneradt
Copy link

@bneradt bneradt commented Jul 23, 2024

No description provided.

@maskit maskit merged commit 4db5772 into maskit:inc_inkapi_regression_test Jul 23, 2024
@bneradt bneradt deleted the fix_ink_api_unit_test branch July 23, 2024 22:20
maskit pushed a commit that referenced this pull request Mar 4, 2025
ASan reports a leak concerning the ImageMagick library for plugins that
link against it. The leak is associated with the ImageMagick library
itself as commenting everything out from the ATS plugin, leaving a bare
TSPluginInit, still results in the leak report. This patch suppresses
the leak report for the library we do not own and for a leak that has
not been seen to be any larger than the initialization bytes associated
with the library.

Here's the leak report this suppression file addresses:

  =================================================================
  ==18362==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 96 byte(s) in 1 object(s) allocated from:
      #0 0xffff9cf05218 in calloc (/lib64/libasan.so.8+0xc5218) (BuildId: f2ca9839b9f761d63a77efcab29bcdd4b221f3a9)
      #1 0xffff8db8273c  (<unknown module>)
      #2 0xffff8db81108  (<unknown module>)
      #3 0xffff8db811d0  (<unknown module>)
      trafficserver-doc-ja#4 0xffff9d53fee8 in call_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:74
      trafficserver-doc-ja#5 0xffff9d53fee8 in call_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:26
      trafficserver-doc-ja#6 0xffff9d540008 in _dl_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:121
      trafficserver-doc-ja#7 0xffff9d53c68c in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:211
      trafficserver-doc-ja#8 0xffff9d5461c0 in dl_open_worker /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-open.c:829
      trafficserver-doc-ja#9 0xffff9d53c614 in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:237
      trafficserver-doc-ja#10 0xffff9d5465fc in _dl_open /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-open.c:905
      trafficserver-doc-ja#11 0xffff9bbfbef4 in dlopen_doit (/lib64/libc.so.6+0x8bef4) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#12 0xffff9d53c614 in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:237
      trafficserver-doc-ja#13 0xffff9d53c73c in _dl_catch_error /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:256
      trafficserver-doc-ja#14 0xffff9bbfb924 in _dlerror_run (/lib64/libc.so.6+0x8b924) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#15 0xffff9bbfbfec in dlopen@GLIBC_2.17 (/lib64/libc.so.6+0x8bfec) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#16 0xffff9cea7bc4 in __interceptor_dlopen.part.0 (/lib64/libasan.so.8+0x67bc4) (BuildId: f2ca9839b9f761d63a77efcab29bcdd4b221f3a9)
      trafficserver-doc-ja#17 0xfdcc88 in plugin_dso_load(char const*, void*&, void*&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/proxy/Plugin.cc:104
      trafficserver-doc-ja#18 0x8bdab4 in try_loading_plugin /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1019
      trafficserver-doc-ja#19 0x8be954 in verify_plugin_helper /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1078
      trafficserver-doc-ja#20 0x8beac8 in cmd_verify_global_plugin /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1097
      trafficserver-doc-ja#21 0x8bf354 in cmd_mode /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1270
      trafficserver-doc-ja#22 0x8c57e0 in main /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:2122
      trafficserver-doc-ja#23 0xffff9bba09d8 in __libc_start_call_main (/lib64/libc.so.6+0x309d8) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#24 0xffff9bba0aac in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x30aac) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#25 0x89346c in _start (/home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/build/src/traffic_server/traffic_server+0x89346c) (BuildId: d86c4e46554f342afeb32ab378ad7f99940d848a)

  Direct leak of 8 byte(s) in 1 object(s) allocated from:
      #0 0xffff9cf057b0 in malloc (/lib64/libasan.so.8+0xc57b0) (BuildId: f2ca9839b9f761d63a77efcab29bcdd4b221f3a9)
      #1 0xffff8db826f4  (<unknown module>)
      #2 0xffff8db96758  (<unknown module>)
      #3 0xffff8db811b0  (<unknown module>)
      trafficserver-doc-ja#4 0xffff9d53fee8 in call_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:74
      trafficserver-doc-ja#5 0xffff9d53fee8 in call_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:26
      trafficserver-doc-ja#6 0xffff9d540008 in _dl_init /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-init.c:121
      trafficserver-doc-ja#7 0xffff9d53c68c in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:211
      trafficserver-doc-ja#8 0xffff9d5461c0 in dl_open_worker /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-open.c:829
      trafficserver-doc-ja#9 0xffff9d53c614 in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:237
      trafficserver-doc-ja#10 0xffff9d5465fc in _dl_open /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-open.c:905
      trafficserver-doc-ja#11 0xffff9bbfbef4 in dlopen_doit (/lib64/libc.so.6+0x8bef4) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#12 0xffff9d53c614 in __GI__dl_catch_exception /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:237
      trafficserver-doc-ja#13 0xffff9d53c73c in _dl_catch_error /usr/src/debug/glibc-2.38-17.fc39.aarch64/elf/dl-catch.c:256
      trafficserver-doc-ja#14 0xffff9bbfb924 in _dlerror_run (/lib64/libc.so.6+0x8b924) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#15 0xffff9bbfbfec in dlopen@GLIBC_2.17 (/lib64/libc.so.6+0x8bfec) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#16 0xffff9cea7bc4 in __interceptor_dlopen.part.0 (/lib64/libasan.so.8+0x67bc4) (BuildId: f2ca9839b9f761d63a77efcab29bcdd4b221f3a9)
      trafficserver-doc-ja#17 0xfdcc88 in plugin_dso_load(char const*, void*&, void*&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/proxy/Plugin.cc:104
      trafficserver-doc-ja#18 0x8bdab4 in try_loading_plugin /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1019
      trafficserver-doc-ja#19 0x8be954 in verify_plugin_helper /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1078
      trafficserver-doc-ja#20 0x8beac8 in cmd_verify_global_plugin /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1097
      trafficserver-doc-ja#21 0x8bf354 in cmd_mode /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:1270
      trafficserver-doc-ja#22 0x8c57e0 in main /home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/src/traffic_server/traffic_server.cc:2122
      trafficserver-doc-ja#23 0xffff9bba09d8 in __libc_start_call_main (/lib64/libc.so.6+0x309d8) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#24 0xffff9bba0aac in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x30aac) (BuildId: 4b1e6ff6c35f7fc7bd309e5e5a1f981e2515e4f0)
      trafficserver-doc-ja#25 0x89346c in _start (/home/bneradt/src/ts_asf_master_address_asan_unit_test_issues/build/src/traffic_server/traffic_server+0x89346c) (BuildId: d86c4e46554f342afeb32ab378ad7f99940d848a)

  SUMMARY: AddressSanitizer: 104 byte(s) leaked in 2 allocation(s).

(cherry picked from commit a2a5cbe)
maskit pushed a commit that referenced this pull request Mar 4, 2025
ASan reported a use-after-free in Do_upstream_rsp_body. This adds
clearing the Continuation's data of the State member upon destruction
because any use of it will be a use after free by definition.

```
=================================================================
==764533==ERROR: AddressSanitizer: heap-use-after-free on address 0x62d006090610 at pc 0x7f5702f4d0d2 bp 0x7f5833a15ca0 sp 0x7f5833a15c90
READ of size 8 at 0x62d006090610 thread T24 ([ET_NET 22])
    #0 0x7f5702f4d0d1 in operator() /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/plugins/experimental/txn_box/plugin/src/Machinery.cc:2579
    #1 0x7f5702f4d0d1 in _FUN /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/plugins/experimental/txn_box/plugin/src/Machinery.cc:2591
    #2 0x1251b2a in INKContInternal::handle_event(int, void*) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/api/InkContInternal.cc:153
    #3 0x116b304 in Continuation::handleEvent(int, void*) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/include/iocore/eventsystem/Continuation.h:228
    trafficserver-doc-ja#4 0x116b304 in Continuation::handleEvent(int, void*) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/include/iocore/eventsystem/Continuation.h:224
    trafficserver-doc-ja#5 0x116b304 in EThread::process_event(Event*, int) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEThread.cc:162
    trafficserver-doc-ja#6 0x116d132 in EThread::process_queue(Queue<Event, Event::Link_link>*, int*, int*) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEThread.cc:197
    trafficserver-doc-ja#7 0x116e07f in EThread::execute_regular() /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEThread.cc:255
    trafficserver-doc-ja#8 0x116f7d8 in EThread::execute() /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEThread.cc:348
    trafficserver-doc-ja#9 0x116f7d8 in EThread::execute() /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEThread.cc:326
    trafficserver-doc-ja#10 0x11684e7 in spawn_thread_internal /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/Thread.cc:75
    trafficserver-doc-ja#11 0x7f58493031c9 in start_thread (/lib64/libpthread.so.0+0x81c9) (BuildId: e08f397aa6b7de799209cd5bc35aabe0496678f1)
    trafficserver-doc-ja#12 0x7f5848f6fe72 in __clone (/lib64/libc.so.6+0x39e72) (BuildId: 574d156ec0c828321a4038189fc1cfe74d0bb2ec)

0x62d006090610 is located 528 bytes inside of 32752-byte region [0x62d006090400,0x62d0060983f0)
freed by thread T24 ([ET_NET 22]) here:
    #0 0x7f584aa05170 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xdc170) (BuildId: 71dbf393857c775be459ab5583ba7b5fcbd9c884)
    #1 0x7f5849b71665 in swoc::_1_5_12::MemArena::Block::operator delete(void*) _sdk/release_posix-x86_64_gcc_12/libswoc_1.5.12/include/swoc/MemArena.h:646
    #2 0x7f5849b71665 in swoc::_1_5_12::MemArena::~MemArena() _scm/libswoc/code/src/MemArena.cc:276

previously allocated by thread T24 ([ET_NET 22]) here:
    #0 0x7f584aa0662f in malloc (/lib64/libasan.so.8+0xdd62f) (BuildId: 71dbf393857c775be459ab5583ba7b5fcbd9c884)
    #1 0x7f5849b718ab in swoc::_1_5_12::MemArena::make_block(unsigned long) _scm/libswoc/code/src/MemArena.cc:99

Thread T24 ([ET_NET 22]) created by T0 ([TS_MAIN]) here:
    #0 0x7f584a971ea5 in __interceptor_pthread_create (/lib64/libasan.so.8+0x48ea5) (BuildId: 71dbf393857c775be459ab5583ba7b5fcbd9c884)
    #1 0x1168c0c in ink_thread_create /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/include/tscore/ink_thread.h:129
    #2 0x1168c0c in Thread::start(char const*, void*, unsigned long, std::function<void ()> const&) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/Thread.cc:92
    #3 0x117a904 in EventProcessor::spawn_event_threads(int, int, unsigned long) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEventProcessor.cc:467
    trafficserver-doc-ja#4 0x117b75a in EventProcessor::start(int, unsigned long) /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/iocore/eventsystem/UnixEventProcessor.cc:548
    trafficserver-doc-ja#5 0x56dc74 in main /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/src/traffic_server/traffic_server.cc:2104
    trafficserver-doc-ja#6 0x7f5848f70d84 in __libc_start_main (/lib64/libc.so.6+0x3ad84) (BuildId: 574d156ec0c828321a4038189fc1cfe74d0bb2ec)

SUMMARY: AddressSanitizer: heap-use-after-free /sd/workspace/src/git.ouryahoo.com/Edge/build/_scm/trafficserver10.0_asan/plugins/experimental/txn_box/plugin/src/Machinery.cc:2579 in operator()
Shadow bytes around the buggy address:
  0x62d006090380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x62d006090400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x62d006090600: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62d006090880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==764533==ABORTING
```

(cherry picked from commit 69e1c94)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants