Re: [PATCH 5/9] XArray: entry in last level is not expected to be a node

Wei Yang
2020-04-05T11:07:51Z

On Wed, Apr 01, 2020 at 03:20:00PM -0700, Matthew Wilcox wrote:
>On Wed, Apr 01, 2020 at 10:10:21PM +0000, Wei Yang wrote:
>> On Tue, Mar 31, 2020 at 04:59:12PM -0700, Matthew Wilcox wrote:
>> >On Tue, Mar 31, 2020 at 10:04:40PM +0000, Wei Yang wrote:
>> >> cc -I. -I../../include -g -Og -Wall -D_LGPL_SOURCE -fsanitize=address -fsanitize=undefined -c -o main.o main.c
>> >> In file included from ./linux/../../../../include/linux/radix-tree.h:15,
>> >> from ./linux/radix-tree.h:5,
>> >> from main.c:10:
>> >> ./linux/rcupdate.h:5:10: fatal error: urcu.h: No such file or directory
>> >> 5 | #include <urcu.h>
>> >> | ^~~~~~~~
>> >> compilation terminated.
>> >> make: *** [<builtin>: main.o] Error 1
>> >
>> >Oh, you need liburcu installed. On Debian, that's liburcu-dev ... probably
>> >liburcu-devel on Red Hat style distros.
>>
>> The bad news is I didn't find the package on Fedora.
>
>Really? https://www.google.com/search?q=fedora+liburcu has the -devel
>package as the second hit from https://pkgs.org/search/?q=liburcu

Occasionally, I see this error message without my change on 5.6.

random seed 1586068185
running tests
XArray: 21151201 of 21151201 tests passed
=================================================================
==6040==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0031bce81 at pc 0x00000040b4b3 bp 0x7f95e87f9bb0 sp 0x7f95e87f9ba0
READ of size 1 at 0x60c0031bce81 thread T11
#0 0x40b4b2 in xas_find_marked ../../../lib/xarray.c:1182
#1 0x45318e in tagged_iteration_fn /root/git/linux/tools/testing/radix-tree/iteration_check.c:77
#2 0x7f95ef2464e1 in start_thread (/lib64/libpthread.so.0+0x94e1)
#3 0x7f95ee8026d2 in clone (/lib64/libc.so.6+0x1016d2)

0x60c0031bce81 is located 1 bytes inside of 128-byte region [0x60c0031bce80,0x60c0031bcf00)
freed by thread T1 here:
#0 0x7f95ef36c91f in __interceptor_free (/lib64/libasan.so.5+0x10d91f)
#1 0x43e4ba in kmem_cache_free /root/git/linux/tools/testing/radix-tree/linux.c:64

previously allocated by thread T13 here:
#0 0x7f95ef36cd18 in __interceptor_malloc (/lib64/libasan.so.5+0x10dd18)
#1 0x43e1af in kmem_cache_alloc /root/git/linux/tools/testing/radix-tree/linux.c:44

Thread T11 created by T0 here:
#0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
#1 0x454862 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:178

Thread T1 created by T0 here:
#0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
#1 0x7f95ef235b89 (/lib64/liburcu.so.6+0x3b89)

Thread T13 created by T0 here:
#0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
#1 0x4548a4 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:186

SUMMARY: AddressSanitizer: heap-use-after-free ../../../lib/xarray.c:1182 in xas_find_marked
Shadow bytes around the buggy address:
0x0c188062f980: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c188062f990: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x0c188062f9a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c188062f9b0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c188062f9c0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x0c188062f9d0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c188062f9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c188062f9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c188062fa00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c188062fa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c188062fa20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==6040==ABORTING

This is not always like this. Didn't figure out the reason yet. Hope you many
have some point.

--
Wei Yang
Help you, Help me