Skip to content

Fixes in ExtInflw#2443

Merged
andrew-platt merged 4 commits intoOpenFAST:devfrom
marchdf:fix-heap-buffer-overflow
Oct 28, 2024
Merged

Fixes in ExtInflw#2443
andrew-platt merged 4 commits intoOpenFAST:devfrom
marchdf:fix-heap-buffer-overflow

Conversation

@marchdf
Copy link
Contributor

@marchdf marchdf commented Sep 27, 2024

Feature or improvement description

This PR does a couple of fixes for the ExtInflw path:

  1. Fixes a heap-buffer-overflow error. nc_def_var size should take the value of the size of the dim array. The size of ptRefDataDims is 1 so the nc_def_var should take a 1. Feels like all of these nc_def_var should really be using *Dims.size() But that would lead to a larger diff.
  2. Fixes mis-indexing (flipped) into the extinfw array
  3. Removes the usage of an empty struct (brFSIData) in the ExtInflw path

Diagnosis

(lldb) bt
* thread #1, name = 'naluX', stop reason = Heap buffer overflow
  * frame #0: 0x00005555563e2dc0 naluX`::AsanDie() at asan_rtl.cpp:44
    frame #1: 0x00005555563fc79c naluX`__sanitizer::Die() at sanitizer_termination.cpp:55:7
    frame #2: 0x00005555563dda6f naluX`::~ScopedInErrorReport() at asan_report.cpp:192:7
    frame #3: 0x00005555563e0abd naluX`::ReportGenericError() at asan_report.cpp:497:1
    frame #4: 0x00005555563d7df2 naluX`::___interceptor_memcpy() at sanitizer_common_interceptors_memintrinsics.inc:115:5
    frame #5: 0x00007ffff7c61903 libnetcdf.so.19`new_NC_var + 259
    frame #6: 0x00007ffff7c61746 libnetcdf.so.19`NC3_def_var + 214
    frame #7: 0x00007ffff7c12657 libnetcdf.so.19`nc_def_var + 71
    frame #8: 0x00007ffff4bdf089 libopenfastcpplib.so`fast::OpenFAST::prepareOutputFile(this=0x000052000000d650, iTurbLoc=0) at OpenFAST.cpp:455:16
    frame #9: 0x00007ffff4beca22 libopenfastcpplib.so`fast::OpenFAST::solution0(this=0x000052000000d650, writeFiles=true) at OpenFAST.cpp:954:17
    frame #10: 0x0000555557cde9e6 naluX`sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0::operator()(this=0x00007fffe796dea0) const at ActuatorBulkFAST.C:271:44
    frame #11: 0x0000555557cde995 naluX`void std::__invoke_impl<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>((null)=__invoke_other @ 0x00007fffffff237f, __f=0x00007fffe796dea0) at invoke.h:61:14
    frame #12: 0x0000555557cde945 naluX`std::enable_if<is_invocable_r_v<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>, void>::type std::__invoke_r<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>(__fn=0x00007fffe796dea0) at invoke.h:111:2
    frame #13: 0x0000555557cde80d naluX`std::_Function_handler<void (), sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0>::_M_invoke(__functor=0x00007fffe796dea0) at std_function.h:290:9
    frame #14: 0x0000555557ce95a3 naluX`std::function<void ()>::operator()(this=0x00007fffe796dea0) const at std_function.h:591:9
    frame #15: 0x0000555557ce0c9b naluX`sierra::nalu::squash_fast_output(func=function<void ()> @ 0x00007fffe796dea0) at ActuatorBulkFAST.h:82:3
    frame #16: 0x0000555557cdbe20 naluX`sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast(this=0x000052000000d080) at ActuatorBulkFAST.C:271:7
    frame #17: 0x0000555557d1788e naluX`sierra::nalu::ActuatorLineFastNGP::operator()(this=0x00005070000833b0) at ActuatorExecutorsFASTNgp.C:45:12
    frame #18: 0x0000555557bf9f6a naluX`sierra::nalu::ActuatorModel::execute(this=0x00005070000608f0, timer=0x000051c000003c90) at ActuatorModel.C:169:13
    frame #19: 0x0000555557bf6347 naluX`sierra::nalu::AeroContainer::execute(this=0x00005070000608f0, actTimer=0x000051c000003c90) at AeroContainer.C:118:20
    frame #20: 0x0000555556c02794 naluX`sierra::nalu::Realm::advance_time_step(this=0x000051c000003880) at Realm.C:1955:18
    frame #21: 0x000055555644d280 naluX`sierra::nalu::TimeIntegrator::integrate_realm(this=0x000050f000017bf0) at TimeIntegrator.C:389:16
    frame #22: 0x000055555644596f naluX`sierra::nalu::Simulation::run(this=0x00007fffe7f00fa0) at Simulation.C:216:20
    frame #23: 0x000055555641ae23 naluX`main(argc=5, argv=0x00007fffffff3688) at nalu.C:198:9
    frame #24: 0x00007fffeca2e7e5 libc.so.6`__libc_start_main + 229
    frame #25: 0x000055555633c92e naluX`_start + 46
(lldb) frame s 8
frame #8: 0x00007ffff4bdf089 libopenfastcpplib.so`fast::OpenFAST::prepareOutputFile(this=0x000052000000d650, iTurbLoc=0) at OpenFAST.cpp:455:16
   452          ncOutVarIDs_["bld_ld"] = tmpVarID;
   453          ierr = nc_def_var(ncid, "bld_ld_loc", NC_DOUBLE, 4, bldDataDims.data(), &tmpVarID);
   454          ncOutVarIDs_["bld_ld_loc"] = tmpVarID;
-> 455          ierr = nc_def_var(ncid, "hub_ref_pos", NC_DOUBLE, 2, ptRefDataDims.data(), &tmpVarID);
   456          ncOutVarIDs_["hub_ref_pos"] = tmpVarID;
   457          ierr = nc_def_var(ncid, "hub_disp", NC_DOUBLE, 2, ptDataDims.data(), &tmpVarID);
   458          ncOutVarIDs_["hub_disp"] = tmpVarID;

The second was:

At line 305 of file /mnt/vdb/home/mhenryde/exawind/exawind-manager/environments/nalu-wind-cpu-test/openfast/modules/externalinflow/src/ExternalInflow.f90
Fortran runtime error: Index '35' of dimension 1 of array 'extinfw' outside of expected range (3:1)

The third was:

(lldb) frame s 7
frame #7: 0x00007ffff4be2c5c libopenfastcpplib.so`fast::OpenFAST::prepareOutputFile(this=0x000052000000d650, iTurbLoc=0) at OpenFAST.cpp:615:16
   612              }
   613          }
   614
-> 615          ierr = nc_put_var_double(ncid, ncOutVarIDs_["nac_ref_pos"],
   616                                   &brFSIData[iTurbLoc][3].nac_ref_pos[0]);
(lldb) print brFSIData[iTurbLoc][3]
(__gnu_cxx::__alloc_traits<std::allocator<fast::turbBRfsiDataType> >::value_type) {
  twr_ref_pos = size=0 {}
  twr_def = size=0 {}
  twr_vel = size=0 {}
  bld_rloc = size=0 {}
  bld_chord = size=0 {}
  bld_ref_pos = size=0 {}
  bld_def = size=0 {}
  bld_vel = size=0 {}
  hub_ref_pos = size=0 {}
  hub_def = size=0 {}
  hub_vel = size=0 {}
  nac_ref_pos = size=0 {}
  nac_def = size=0 {}
  nac_vel = size=0 {}
  bld_root_ref_pos = size=0 {}
  bld_root_def = size=0 {}
  bld_pitch = size=0 {}
  twr_ld = size=0 {}
  bld_ld = size=0 {}
  twr_def_resid = 0
  twr_vel_resid = 0
  bld_def_resid = 0
  bld_vel_resid = 0
  twr_ld_resid = 0
  bld_ld_resid = 0

Related issue, if one exists

Impacted areas of the software

openfast-cpp

@marchdf
Copy link
Contributor Author

marchdf commented Sep 27, 2024

It should be noted that the turbineData[iTurbLoc].sType == EXTLOADS pathway had the right sizes for those vars. So it was only failing for turbineData[iTurbLoc].sType == EXTINFLOW path.

@andrew-platt
Copy link
Collaborator

At first glance, there appears to be some inconsistencies in this section of code. I would excpect hub_disp (line 457), hub_vel (line 459), and hubrotvel (line 461) will also need this change. Similarly for the nacelle section below.

@marchdf
Copy link
Contributor Author

marchdf commented Sep 30, 2024

I am not sure why the test is failing...

@andrew-platt
Copy link
Collaborator

There is a segmentation fault with the 5MW_Land_DLL_WTurb_cpp case.

Screenshot 2024-10-01 at 10 01 06 AM

@andrew-platt andrew-platt added this to the v4.0.0 milestone Oct 3, 2024
@marchdf marchdf force-pushed the fix-heap-buffer-overflow branch from 7de30e3 to 40f5000 Compare October 23, 2024 21:26
@marchdf marchdf force-pushed the fix-heap-buffer-overflow branch from 40f5000 to 07e4690 Compare October 24, 2024 21:34
@marchdf marchdf changed the title Fix heap buffer overflow in nc_def_var of openfast-cpp Fixes in ExtInflw Oct 24, 2024
@marchdf
Copy link
Contributor Author

marchdf commented Oct 25, 2024

My simulation ran to completion so I guess this fixes all the remaining issues with this pathway (at least for this configuration). Thanks for you help. This can be merged whenever you want from my standpoint.

@andrew-platt andrew-platt merged commit cf2e20a into OpenFAST:dev Oct 28, 2024
@marchdf marchdf deleted the fix-heap-buffer-overflow branch October 28, 2024 16:48
@andrew-platt andrew-platt mentioned this pull request Dec 24, 2024
38 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments