liburing4cpp icon indicating copy to clipboard operation
liburing4cpp copied to clipboard

heap-use-after-free crash in test application

Open MatthiasMann opened this issue 5 years ago • 4 comments

I have compiled https://github.com/CarterLi/liburing4cpp/commit/1e2be4deaba366da45e55248ff440f8daf2ff1d3 for ARM 32 user space on an AARCH 64 kernel (Linux C300 5.8.0-20200922-1 #1 SMP PREEMPT 2020-09-01T00:00:00+00:00 aarch64 GNU/Linux) using https://github.com/axboe/liburing/commit/bd62cfb9a22cdb82b8ebff407ec98c2e22960753 with OSELAS.Toolchain-2020.08.0/arm-v7a-linux-gnueabihf/gcc-10.2.1-clang-10.0.1-glibc-2.32-binutils-2.35-kernel-5.8-sanitized/bin/arm-v7a-linux-gnueabihf-g++ in -std=c++20 mode.

And I get the following crash report from asan: https://gist.github.com/MatthiasMann/419fa12bbff6f21f94cc4367e82ddc9b

MatthiasMann avatar Nov 03 '20 13:11 MatthiasMann

Strange, but I have no arm devices ( expect an android phone running Linux 4.19 ) to test. Did you try any other examples?

CarterLi avatar Nov 03 '20 13:11 CarterLi

Yes, in the file_server I also get crashes which I can 'solve' by removing when_all. But then I get other crashes :( I also get the following warning on compile:

$ make
/opt/OSELAS.Toolchain-2020.08.0/arm-v7a-linux-gnueabihf/gcc-10.2.1-clang-10.0.1-glibc-2.32-binutils-2.35-kernel-5.8-sanitized/bin/arm-v7a-linux-gnueabihf-g++ ./file_server.cpp ./mime_dicts.cpp -o file_server -O0 -rdynamic -D_LIBCPP_DEBUG_LEVEL=1 -fno-omit-frame-pointer -fsanitize=address -fcoroutines -g -Wall -std=c++20 -I../liburing/src/include -I.. -L/home/matthias/Documents/HDIOBox/OSELAS.BSP-NXP/platform-at1130/sysroot-target/usr/lib -I/home/matthias/Documents/HDIOBox/OSELAS.BSP-NXP/platform-at1130/sysroot-target/usr/include  -L../liburing/src -lfmt -luring -pthread
./file_server.cpp: In function 'task<> http_send_file(io_service&, std::string, int, int)':
./file_server.cpp:76:1: warning: statement has no effect []8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wunused-value-Wunused-value]8;;]
   76 | }
      | ^
./file_server.cpp:76:1: warning: statement has no effect []8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wunused-value-Wunused-value]8;;]

these compiler warning go away when I remove the usages of when_all.

MatthiasMann avatar Nov 03 '20 14:11 MatthiasMann

Yes, in the file_server I also get crashes which I can 'solve' by removing when_all. But then I get other crashes :( I also get the following warning on compile:

$ make
/opt/OSELAS.Toolchain-2020.08.0/arm-v7a-linux-gnueabihf/gcc-10.2.1-clang-10.0.1-glibc-2.32-binutils-2.35-kernel-5.8-sanitized/bin/arm-v7a-linux-gnueabihf-g++ ./file_server.cpp ./mime_dicts.cpp -o file_server -O0 -rdynamic -D_LIBCPP_DEBUG_LEVEL=1 -fno-omit-frame-pointer -fsanitize=address -fcoroutines -g -Wall -std=c++20 -I../liburing/src/include -I.. -L/home/matthias/Documents/HDIOBox/OSELAS.BSP-NXP/platform-at1130/sysroot-target/usr/lib -I/home/matthias/Documents/HDIOBox/OSELAS.BSP-NXP/platform-at1130/sysroot-target/usr/include  -L../liburing/src -lfmt -luring -pthread
./file_server.cpp: In function 'task<> http_send_file(io_service&, std::string, int, int)':
./file_server.cpp:76:1: warning: statement has no effect [�]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wunused-value-Wunused-value�]8;;]
   76 | }
      | ^
./file_server.cpp:76:1: warning: statement has no effect [�]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wunused-value-Wunused-value�]8;;]

these compiler warning go away when I remove the usages of when_all.

when_{all,any} definitely need more work. I'll remove them for now.

CarterLi avatar Nov 03 '20 14:11 CarterLi

May relate to http://clang-developers.42468.n3.nabble.com/Miscompilation-heap-use-after-free-in-C-coroutines-td4070320.html

Ref: https://github.com/CarterLi/liburing4cpp/blob/async/task.hpp#L33

CarterLi avatar Feb 08 '21 02:02 CarterLi