[BugFix] Fix asan stack-use-after-return when update starlet config (backport #51346) #51374
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
…51346) Signed-off-by: wyb <[email protected]> (cherry picked from commit a37e2a8) # Conflicts: # be/src/http/action/update_config_action.cpp
|
Cherry-pick of a37e2a8 has failed: To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally |
|
@mergify[bot]: Backport conflict, please reslove the conflict and resubmit the pr |
wyb
approved these changes
Sep 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why I'm doing:
What I'm doing:
capture
valueby value in the lambda function to ensure its validity in the callbackFixes #issue
What type of PR is this:
Does this PR entail a change in behavior?
If yes, please specify the type of change:
Checklist:
Bugfix cherry-pick branch check:
This is an automatic backport of pull request #51346 done by [Mergify](https://mergify.com). ## Why I'm doing: ``` ==665556==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fcb5cfd99c0 at pc 0x00000f7d905e bp 0x7fcb5e887f50 sp 0x7fcb5e887f48 READ of size 8 at 0x7fcb5cfd99c0 thread T259 #0 0xf7d905d in std::__cxx11::basic_string, std::allocator>::_M_data() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:195:28 #1 0xf7c87e4 in std::__cxx11::basic_string, std::allocator>::c_str() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:2321:16 #2 0x1f6c88a4 in staros::starlet::common::GFlagsUtils::UpdateFlagValue(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) /home/disk3/sr-deps/thirdparty/installed/starlet/starlet_install/include/common/gflags_utils.h:121:65 #3 0x21f29d3d in starrocks::UpdateConfigAction::update_config(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()::operator()() const be/build_ASAN/src/http/be/src/http/action/update_config_action.cpp:262:17 #4 0x21f29b84 in void std::__invoke_impl, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()&>(std::__invoke_other, starrocks::UpdateConfigAction::update_config(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #5 0x21f29b34 in std::enable_if, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()&>, void>::type std::__invoke_r, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()&>(starrocks::UpdateConfigAction::update_config(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 #6 0x21f299fc in std::_Function_handler, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&)::$_0::operator()() const::'lambda32'()>::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9 #7 0xf8088d2 in std::function::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9 #8 0x21ef2fec in starrocks::UpdateConfigAction::update_config(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) be/build_ASAN/src/http/be/src/http/action/update_config_action.cpp:339:13 #9 0x1f606445 in starrocks::write_be_configs_table(starrocks::StarRocksNodesInfo const&, long, std::vector, std::allocator>>&) be/build_ASAN/src/runtime/be/src/runtime/schema_table_sink.cpp:125:32 #10 0x1f605426 in starrocks::SchemaTableSink::send_chunk(starrocks::RuntimeState*, starrocks::Chunk*) be/build_ASAN/src/runtime/be/src/runtime/schema_table_sink.cpp:147:16 #11 0x1eea2d4a in starrocks::PlanFragmentExecutor::_open_internal_vectorized() be/build_ASAN/src/runtime/be/src/runtime/plan_fragment_executor.cpp:252:9 #12 0x1eea13fa in starrocks::PlanFragmentExecutor::open() be/build_ASAN/src/runtime/be/src/runtime/plan_fragment_executor.cpp:205:21 #13 0x1ee65924 in starrocks::FragmentExecState::execute() be/build_ASAN/src/runtime/be/src/runtime/fragment_mgr.cpp:202:9 #14 0x1ee682ad in starrocks::FragmentMgr::exec_actual(std::shared_ptr const&, std::function const&) be/build_ASAN/src/runtime/be/src/runtime/fragment_mgr.cpp:403:5 #15 0x1ee7b604 in starrocks::FragmentMgr::exec_plan_fragment(starrocks::TExecPlanFragmentParams const&, std::function const&, std::function const&)::$_3::operator()() const be/build_ASAN/src/runtime/be/src/runtime/fragment_mgr.cpp:466:66 #16 0x1ee7b5b4 in void std::__invoke_impl const&, std::function const&)::$_3&>(std::__invoke_other, starrocks::FragmentMgr::exec_plan_fragment(starrocks::TExecPlanFragmentParams const&, std::function const&, std::function const&)::$_3&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #17 0x1ee7b554 in std::enable_if const&, std::function const&)::$_3&>, void>::type std::__invoke_r const&, std::function const&)::$_3&>(starrocks::FragmentMgr::exec_plan_fragment(starrocks::TExecPlanFragmentParams const&, std::function const&, std::function const&)::$_3&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 #18 0x1ee7b2cc in std::_Function_handler const&, std::function const&)::$_3>::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9 #19 0xf8088d2 in std::function::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9 #20 0x1fd822b8 in starrocks::FunctionRunnable::run() be/build_ASAN/src/util/be/src/util/threadpool.cpp:59:27 #21 0x1fd6f132 in starrocks::ThreadPool::dispatch_thread() be/build_ASAN/src/util/be/src/util/threadpool.cpp:635:24 #22 0x1fd945d3 in void std::__invoke_impl(std::__invoke_memfun_deref, void (starrocks::ThreadPool::*&)(), starrocks::ThreadPool*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:74:14 #23 0x1fd944ac in std::__invoke_result::type std::__invoke(void (starrocks::ThreadPool::*&)(), starrocks::ThreadPool*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14 #24 0x1fd94434 in void std::_Bind::__call(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/functional:420:11 #25 0x1fd942dd in void std::_Bind::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/functional:503:17 #26 0x1fd941f4 in void std::__invoke_impl&>(std::__invoke_other, std::_Bind&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #27 0x1fd94194 in std::enable_if&>, void>::type std::__invoke_r&>(std::_Bind&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 #28 0x1fd93efc in std::_Function_handler>::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9 #29 0xf8088d2 in std::function::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9 #30 0x1fd4c4bf in starrocks::Thread::supervise_thread(void*) be/build_ASAN/src/util/be/src/util/thread.cpp:366:5 #31 0x7fcc5e1d5ac2 in start_thread nptl/pthread_create.c:442:8 #32 0x7fcc5e26784f misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
Address 0x7fcb5cfd99c0 is located in stack of thread T259 at offset 448 in frame
#0 0x1f6055ef in starrocks::write_be_configs_table(starrocks::StarRocksNodesInfo const&, long, std::vector<std::shared_ptrstarrocks::Column, std::allocator<std::shared_ptrstarrocks::Column>>&) be/build_ASAN/src/runtime/be/src/runtime/schema_table_sink.cpp:105
This frame has 22 object(s):
[32, 48) 'agg.tmp'
[64, 160) 'ref.tmp' (line 111)
[192, 256) 'ref.tmp15' (line 116)
[288, 320) 'name' (line 117)
[352, 416) 'ref.tmp25' (line 117)
[448, 480) 'value' (line 118) <== Memory access at offset 448 is inside this variable
[512, 576) 'ref.tmp38' (line 118)
[608, 640) 'mode' (line 119)
[672, 680) 's' (line 120)
[704, 800) 'ref.tmp53' (line 122)
[832, 864) 'ref.tmp59' (line 122)
[896, 912) 'agg.tmp60'
[928, 976) 'ref.tmp63' (line 122)
[1008, 1056) 'ref.tmp66' (line 122)
[1088, 1096) 'ref.tmp83' (line 125)
[1120, 1128) 'ref.tmp92' (line 128)
[1152, 1184) 'ref.tmp97' (line 129)
[1216, 1232) 'agg.tmp98'
[1248, 1296) 'ref.tmp101' (line 129)
[1328, 1424) 'ref.tmp112' (line 132)
[1456, 1552) 'ref.tmp137' (line 134)
[1584, 1616) 'ref.tmp157' (line 134)