Skip to content

[Bug] lru cache ut failed #8571

New issue
New issue
Closed
#8569
Closed
[Bug] lru cache ut failed#8571
#8569
@caiconghui

Description

@caiconghui
caiconghui
opened on Mar 21, 2022

Search before asking

  • I had searched in the issues and found no similar issues.

Version

master

What's Wrong?

=================================================================
==3693262==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000021e30 at pc 0x56437f626dd9 bp 0x7ffe401016d0 sp 0x7ffe401016c0
READ of size 8 at 0x60b000021e30 thread T0
#0 0x56437f626dd8 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:372
#1 0x56437f629697 in doris::ShardedLRUCache::erase(doris::CacheKey const&) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:499
#2 0x56437f60e8ae in doris::CacheTest::Erase(int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8648ae)
#3 0x56437f5e73fc in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:147
#4 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#5 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#6 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#7 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#8 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#9 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#10 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#11 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#12 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#13 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#14 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#15 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#16 0x56437f50dd39 in _start (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf763d39)

0x60b000021e30 is located 48 bytes inside of 99-byte region [0x60b000021e00,0x60b000021e63)
freed by thread T0 here:
#0 0x56437f59c77f in free (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf7f277f)
#1 0x56437f632665 in doris::LRUHandle::free() /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.h:256
#2 0x56437f626da7 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:367
#3 0x56437f629697 in doris::ShardedLRUCache::erase(doris::CacheKey const&) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:499
#4 0x56437f60e8ae in doris::CacheTest::Erase(int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8648ae)
#5 0x56437f5e73fc in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:147
#6 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#7 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#8 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#9 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#10 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#11 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#12 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#13 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#14 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#15 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#16 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#17 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)

previously allocated by thread T0 here:
#0 0x56437f59cad7 in malloc (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf7f2ad7)
#1 0x56437f6261f0 in doris::LRUCache::insert(doris::CacheKey const&, unsigned int, void*, unsigned long, void ()(doris::CacheKey const&, void), doris::CachePriority) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:298
#2 0x56437f6293a3 in doris::ShardedLRUCache::insert(doris::CacheKey const&, void*, unsigned long, void ()(doris::CacheKey const&, void), doris::CachePriority) /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:484
#3 0x56437f60e11c in doris::CacheTest::Insert(int, int, int) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf86411c)
#4 0x56437f5e73b8 in doris::CacheTest_Erase_Test::TestBody() /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:145
#5 0x564388417d6c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866dd6c)
#6 0x5643884119ba in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x186679ba)
#7 0x5643883e82a5 in testing::Test::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863e2a5)
#8 0x5643883e8cc9 in testing::TestInfo::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863ecc9)
#9 0x5643883e9589 in testing::TestSuite::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1863f589)
#10 0x5643883f8c49 in testing::internal::UnitTestImpl::RunAllTests() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864ec49)
#11 0x564388418b97 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1866eb97)
#12 0x564388412944 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x18668944)
#13 0x5643883f743e in testing::UnitTest::Run() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0x1864d43e)
#14 0x56437f60a8cd in RUN_ALL_TESTS() (/data/dev-user/caiconghui/cch13/incubator-doris/be/ut_build_ASAN/test/olap/lru_cache_test+0xf8608cd)
#15 0x56437f601e89 in main /data/dev-user/caiconghui/cch13/incubator-doris/be/test/olap/lru_cache_test.cpp:476
#16 0x7f209a8ff554 in __libc_start_main (/lib64/libc.so.6+0x22554)

SUMMARY: AddressSanitizer: heap-use-after-free /data/dev-user/caiconghui/cch13/incubator-doris/be/src/olap/lru_cache.cpp:372 in doris::LRUCache::erase(doris::CacheKey const&, unsigned int, doris::MemTracker*)
Shadow bytes around the buggy address:
0x0c167fffc370: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fd fd
0x0c167fffc380: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c167fffc390: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c167fffc3a0: 00 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x0c167fffc3b0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
=>0x0c167fffc3c0: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fa fa fa
0x0c167fffc3d0: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x0c167fffc3e0: 00 00 03 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc3f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c167fffc410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3693262==ABORTING

What You Expected?

run be ut succeed

How to Reproduce?

No response

Anything Else?

No response

Are you willing to submit PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions