Use-after-free in RemoteServicesIntegrationTestSuite.InvokeRemoteCalcService

Open PengZheng opened this issue 2 years ago • 1 comments
[ RUN      ] RemoteServicesIntegrationTestSuite.InvokeRemoteCalcService
[2024-01-01T00:08:42] [   info] [celix_framework] [framework_start:474] Celix framework started
[2024-01-01T00:08:42] [   info] [celix_framework] [framework_start:474] Celix framework started
[2024-01-01T00:08:42] [   info] [celix_framework] Starting TestExportImportRemoteServiceFactory
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Created msg queue for ExportCalculator with qidSender=65536 and qidReceiver=65537
[2024-01-01T00:08:42] [   info] [celix_framework] Starting TestExportImportRemoteServiceFactory
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property service.exported.interfaces=ICalculator
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property endpoint.id=id-01
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property objectClass=ICalculator
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property endpoint.framework.uuid=9012302B-8B00-4C81-B126-4430D21550B6
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property service.imported=true
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property endpoint.provider.to.client.channel.id=1235
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property endpoint.client.to.provider.channel.id=1234
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Endpoint property service.imported.configs=ipc-mq
[2024-01-01T00:08:42] [   info] [celix::rsa::RemoteServiceFactory] Created msg queue for ImportedCalculator with qidSender=65537 and qidReceiver=65536
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 1.
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 2.
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 3.
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 4.
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 5.
[2024-01-01T00:08:42] [   info] [celix_framework] Testing remote C++ iteration 6.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 7.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 8.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 9.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 10.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 11.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 12.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 13.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 14.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 15.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 16.
[2024-01-01T00:08:43] [   info] [celix_framework] Testing remote C++ iteration 17.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 18.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 19.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 20.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 21.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 22.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 23.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 24.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 25.
[2024-01-01T00:08:44] [   info] [celix_framework] Testing remote C++ iteration 26.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 27.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 28.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 29.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 30.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 31.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 32.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 33.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 34.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 35.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 36.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 37.
[2024-01-01T00:08:45] [   info] [celix_framework] Testing remote C++ iteration 38.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 39.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 40.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 41.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 42.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 43.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 44.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 45.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 46.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 47.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 48.
[2024-01-01T00:08:46] [   info] [celix_framework] Testing remote C++ iteration 49.
[2024-01-01T00:08:47] [   info] [celix_framework] Testing remote C++ iteration 50.
[2024-01-01T00:08:47] [   info] [celix_framework] Testing remote C++ iteration 51.
[2024-01-01T00:08:47] [   info] [celix_framework] Testing remote C++ iteration 52.
[2024-01-01T00:08:47] [   info] [celix_framework] Testing remote C++ iteration 53.
[2024-01-01T00:08:47] [   info] [celix_framework] Testing remote C++ iteration 54.
=================================================================
==14326==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000056190 at pc 0x000101982486 bp 0x70000196eb70 sp 0x70000196eb68
READ of size 8 at 0x607000056190 thread T278
[2024-01-01T00:08:48] [   info] [celix_framework] Testing remote C++ iteration 55.
    #0 0x101982485 in celix::PushStream<double>::forEach(std::__1::function<void (double const&)>)::'lambda'(celix::PushEvent<double> const&)::operator()(celix::PushEvent<double> const&) const+0x7e5 (test_cxx_remote_services_integration:x86_64+0x10001a485)
    #1 0x1041d7238 in celix::BufferedPushStream<double>::startWorker()::'lambda'()::operator()() const+0x258 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x48238)
    #2 0x10420e3ab in std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >::__execute()+0x10b (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x7f3ab)
    #3 0x10420e82e in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void (std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >*> >(void*)+0xce (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x7f82e)
    #4 0x7ff816f9d4e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
    #5 0x7ff816f98f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)

0x607000056190 is located 48 bytes inside of 80-byte region [0x607000056160,0x6070000561b0)
freed by thread T8 here:
    #0 0x1020c662d in wrap__ZdlPv+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c62d)
    #1 0x101980db7 in celix::PushStream<double>::forEach(std::__1::function<void (double const&)>)+0x4f7 (test_cxx_remote_services_integration:x86_64+0x100018db7)
    #2 0x10197ed82 in auto RemoteServicesIntegrationTestSuite::invokeRemoteCalcService()::'lambda'(auto&)::operator()<ICalculator>(auto&) const+0x262 (test_cxx_remote_services_integration:x86_64+0x100016d82)
    #3 0x10197ce22 in celix::UseServiceBuilder<ICalculator>::build()::'lambda'(void*, void*, celix_properties const*, celix_bundle const*)::operator()(void*, void*, celix_properties const*, celix_bundle const*) const+0x2d2 (test_cxx_remote_services_integration:x86_64+0x100014e22)
    #4 0x101c9fcc9 in celix_serviceTracker_useHighestRankingService+0x289 (libcelix_framework.3.0.0.dylib:x86_64+0x3acc9)
    #5 0x101c78824 in celix_bundleContext_useServiceWithOptions_2_UseServiceTracker+0xd4 (libcelix_framework.3.0.0.dylib:x86_64+0x13824)
    #6 0x101c8e221 in fw_handleEvents+0xbc1 (libcelix_framework.3.0.0.dylib:x86_64+0x29221)
    #7 0x101c7eeb7 in fw_eventDispatcher+0x247 (libcelix_framework.3.0.0.dylib:x86_64+0x19eb7)
    #8 0x7ff816f9d4e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
    #9 0x7ff816f98f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)

previously allocated by thread T8 here:
    #0 0x1020c620d in wrap__Znwm+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c20d)
    #1 0x101980aa8 in celix::PushStream<double>::forEach(std::__1::function<void (double const&)>)+0x1e8 (test_cxx_remote_services_integration:x86_64+0x100018aa8)
    #2 0x10197ed82 in auto RemoteServicesIntegrationTestSuite::invokeRemoteCalcService()::'lambda'(auto&)::operator()<ICalculator>(auto&) const+0x262 (test_cxx_remote_services_integration:x86_64+0x100016d82)
    #3 0x10197ce22 in celix::UseServiceBuilder<ICalculator>::build()::'lambda'(void*, void*, celix_properties const*, celix_bundle const*)::operator()(void*, void*, celix_properties const*, celix_bundle const*) const+0x2d2 (test_cxx_remote_services_integration:x86_64+0x100014e22)
    #4 0x101c9fcc9 in celix_serviceTracker_useHighestRankingService+0x289 (libcelix_framework.3.0.0.dylib:x86_64+0x3acc9)
    #5 0x101c78824 in celix_bundleContext_useServiceWithOptions_2_UseServiceTracker+0xd4 (libcelix_framework.3.0.0.dylib:x86_64+0x13824)
    #6 0x101c8e221 in fw_handleEvents+0xbc1 (libcelix_framework.3.0.0.dylib:x86_64+0x29221)
    #7 0x101c7eeb7 in fw_eventDispatcher+0x247 (libcelix_framework.3.0.0.dylib:x86_64+0x19eb7)
    #8 0x7ff816f9d4e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
    #9 0x7ff816f98f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)

Thread T278 created by T12 here:
    #0 0x1020ae99c in wrap_pthread_create+0x5c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4499c)
    #1 0x10420e6a2 in std::__1::thread::thread<void (std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >::*)(), std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >*, void>(void (std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >::*&&)(), std::__1::__async_assoc_state<void, std::__1::__async_func<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()> >*&&)+0xd2 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x7f6a2)
    #2 0x10420c828 in std::__1::future<std::__1::__invoke_of<std::__1::decay<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()>::type>::type> std::__1::async<celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()>(std::__1::launch, celix::DefaultExecutor::execute(int, std::__1::function<void ()>)::'lambda'()&&)+0x568 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x7d828)
    #3 0x10420ba4f in celix::DefaultExecutor::execute(int, std::__1::function<void ()>)+0x20f (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x7ca4f)
    #4 0x1041d3a97 in celix::BufferedPushStream<double>::startWorker()+0x247 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x44a97)
    #5 0x1041d0978 in celix::BufferedPushStream<double>::handleEvent(celix::PushEvent<double> const&)+0x358 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x41978)
    #6 0x1041d7c83 in celix::StreamPushEventConsumer<double>::accept(celix::PushEvent<double> const&)+0xd3 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x48c83)
    #7 0x1041de36b in std::__1::__function::__func<celix::AbstractPushEventSource<double>::publish(double const&)::'lambda'(), std::__1::allocator<celix::AbstractPushEventSource<double>::publish(double const&)::'lambda'()>, void ()>::operator()()+0x18b (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x4f36b)
    #8 0x1041ddc9d in celix::AbstractPushEventSource<double>::publish(double const&)+0x26d (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x4ec9d)
    #9 0x1041dbd71 in ImportedCalculator::receiveCalculator$result$Event()+0x3e1 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x4cd71)
    #10 0x1041d982f in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, ImportedCalculator::start()::'lambda'()> >(void*)+0x16f (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x4a82f)
    #11 0x7ff816f9d4e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
    #12 0x7ff816f98f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)

Thread T12 created by T8 here:
    #0 0x1020ae99c in wrap_pthread_create+0x5c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4499c)
    #1 0x1041d9613 in std::__1::thread::thread<ImportedCalculator::start()::'lambda'(), void>(ImportedCalculator::start()::'lambda'()&&)+0x93 (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x4a613)
    #2 0x1041a931d in ImportedCalculator::start()+0x62d (libTestExportImportRemoteServiceFactory.0.dylib:x86_64+0x1a31d)
    #3 0x101cab7b3 in celix_dmComponent_handleChangeOnEventThread+0x6e3 (libcelix_framework.3.0.0.dylib:x86_64+0x467b3)
    #4 0x101ca8620 in celix_private_dmComponent_handleEvent+0x9b0 (libcelix_framework.3.0.0.dylib:x86_64+0x43620)
    #5 0x101cacec5 in serviceDependency_addServiceTrackerCallback+0x1a5 (libcelix_framework.3.0.0.dylib:x86_64+0x47ec5)
    #6 0x101c9d528 in serviceTracker_serviceChanged+0xe08 (libcelix_framework.3.0.0.dylib:x86_64+0x38528)
    #7 0x101c9a9c2 in celix_serviceRegistry_addServiceListener+0x6c2 (libcelix_framework.3.0.0.dylib:x86_64+0x359c2)
    #8 0x101c7398f in bundleContext_addServiceListener+0x4f (libcelix_framework.3.0.0.dylib:x86_64+0xe98f)
    #9 0x101c9da67 in serviceTracker_open+0xd7 (libcelix_framework.3.0.0.dylib:x86_64+0x38a67)
    #10 0x101c8e221 in fw_handleEvents+0xbc1 (libcelix_framework.3.0.0.dylib:x86_64+0x29221)
    #11 0x101c7eeb7 in fw_eventDispatcher+0x247 (libcelix_framework.3.0.0.dylib:x86_64+0x19eb7)
    #12 0x7ff816f9d4e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0)
    #13 0x7ff816f98f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a)

Thread T8 created by T0 here:
    #0 0x1020ae99c in wrap_pthread_create+0x5c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4499c)
    #1 0x101d05201 in celixThread_create+0x11 (libcelix_utils.3.dylib:x86_64+0x10201)
    #2 0x101c7e655 in fw_init+0x195 (libcelix_framework.3.0.0.dylib:x86_64+0x19655)
    #3 0x101c7f8ae in framework_start+0x12e (libcelix_framework.3.0.0.dylib:x86_64+0x1a8ae)
    #4 0x101ca2d76 in celix_frameworkFactory_createFramework+0x126 (libcelix_framework.3.0.0.dylib:x86_64+0x3dd76)
    #5 0x1019744d9 in celix::createFramework(celix::Properties const&)+0x49 (test_cxx_remote_services_integration:x86_64+0x10000c4d9)
    #6 0x101972a27 in RemoteServicesIntegrationTestSuite::RemoteServicesIntegrationTestSuite()+0x3a7 (test_cxx_remote_services_integration:x86_64+0x10000aa27)
    #7 0x101979afb in testing::internal::TestFactoryImpl<RemoteServicesIntegrationTestSuite_InvokeRemoteCalcService_Test>::CreateTest()+0x1b (test_cxx_remote_services_integration:x86_64+0x100011afb)
    #8 0x1019d0d7c in testing::Test* testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::TestFactoryBase, testing::Test*>(testing::internal::TestFactoryBase*, testing::Test* (testing::internal::TestFactoryBase::*)(), char const*)+0x15c (test_cxx_remote_services_integration:x86_64+0x100068d7c)
    #9 0x1019d0080 in testing::TestInfo::Run()+0x1f0 (test_cxx_remote_services_integration:x86_64+0x100068080)
    #10 0x1019d3906 in testing::TestSuite::Run()+0x346 (test_cxx_remote_services_integration:x86_64+0x10006b906)
    #11 0x101a15b70 in testing::internal::UnitTestImpl::RunAllTests()+0x1420 (test_cxx_remote_services_integration:x86_64+0x1000adb70)
    #12 0x101a13fec in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*)+0x15c (test_cxx_remote_services_integration:x86_64+0x1000abfec)
    #13 0x101a13d49 in testing::UnitTest::Run()+0x1a9 (test_cxx_remote_services_integration:x86_64+0x1000abd49)
    #14 0x101a62e1f in main+0xef (test_cxx_remote_services_integration:x86_64+0x1000fae1f)
    #15 0x10620052d in start+0x1cd (dyld:x86_64+0x552d)

SUMMARY: AddressSanitizer: heap-use-after-free (test_cxx_remote_services_integration:x86_64+0x10001a485) in celix::PushStream<double>::forEach(std::__1::function<void (double const&)>)::'lambda'(celix::PushEvent<double> const&)::operator()(celix::PushEvent<double> const&) const+0x7e5
Shadow bytes around the buggy address:
  0x1c0e0000abe0: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x1c0e0000abf0: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa
  0x1c0e0000ac00: fa fa fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x1c0e0000ac10: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd
  0x1c0e0000ac20: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
=>0x1c0e0000ac30: fd fd[fd]fd fd fd fa fa fa fa fd fd fd fd fd fd
  0x1c0e0000ac40: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x1c0e0000ac50: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa
  0x1c0e0000ac60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
  0x1c0e0000ac70: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x1c0e0000ac80: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
[2024-01-01T00:08:49] [   info] [celix_framework] Got remote promise exception for iteration 55: Unknown exception throw for the failure of A celix::Promise
==14326==ABORTING
Jan 01 '24 04:01 PengZheng
I will have a look at this and also check the coverity issues reported in the cxx remote service integration part.
Jan 02 '24 18:01 pnoltes