Address heap-use-after-free issue seen with compaction

While updating the prevFile pointer of the next file in
the chain, update the pointer iff the next file points
to the current file.

16:45:42 ==68667==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000088c0 at pc 0x0000005452bb bp 0x7fffdf556050 sp 0x7fffdf556048
16:45:42 READ of size 8 at 0x61f0000088c0 thread T0
16:45:42     #0 0x5452ba in FileMgr::getNewFile() /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/filemgr.h:636:16
16:45:42     couchbase#1 0x5452ba in FileMgr::updateFilePointers() /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/filemgr.cc:1528
16:45:42     couchbase#2 0x5452ba in FileMgr::close(FileMgr*, bool, char const*, ErrLogCallback*) /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/filemgr.cc:1677
16:45:42     couchbase#3 0x569bc3 in _fdb_close /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/forestdb.cc:7434:10
16:45:42     couchbase#4 0x5b3961 in _fdb_kvs_close(FdbKvsHandle*) /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/kv_instance.cc:1470:10
16:45:42     couchbase#5 0x5b3961 in fdb_kvs_close /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/kv_instance.cc:1537
16:45:42     couchbase#6 0x4f9323 in FileHandlePool::~FileHandlePool() /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/tests/usecase/usecase_test.cc:129:26
16:45:42     couchbase#7 0x4f94ed in FileHandlePool::~FileHandlePool() /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/tests/usecase/usecase_test.cc:124:31
16:45:42     couchbase#8 0x4f56de in test_writes_on_kv_stores_with_compaction(unsigned short, int) /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/tests/usecase/usecase_test.cc:815:5
16:45:42     couchbase#9 0x4f5f9a in main /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/tests/usecase/usecase_test.cc:880:5
16:45:42     couchbase#10 0x2b069543776c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226
16:45:42     couchbase#11 0x447558 in _start (/home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/build/forestdb/tests/usecase/usecase_test+0x447558)
16:45:42
16:45:42 0x61f0000088c0 is located 2624 bytes inside of 3064-byte region [0x61f000007e80,0x61f000008a78)
16:45:42 freed by thread T47 here:
16:45:42     #0 0x4edf82 in operator delete(void*) (/home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/build/forestdb/tests/usecase/usecase_test+0x4edf82)
16:45:42     couchbase#1 0x541095 in FileMgr::freeFunc(FileMgr*) /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/filemgr.cc:1758:5
16:45:42     couchbase#2 0x525c7c in CompactorThread::run() /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/compactor.cc:398:17
16:45:42     couchbase#3 0x524de8 in launch_compactor_thread(void*) /home/couchbase/jenkins/workspace/forestdb-addresssanitizer-master/forestdb/src/compactor.cc:261:9
16:45:42     couchbase#4 0x2b06941a4e99 in start_thread /build/buildd/eglibc-2.15/nptl/pthread_create.c:308

Change-Id: Ifb5eb2255953b569891ebb7e59f36d902dad1152

Author: abhinavdangeti

src/filemgr.cc

@@ -1652,7 +1652,6 @@ fdb_status FileMgr::close(FileMgr *file,
             file->releaseSpinLock();
             FileMgrMap::get()->removeEntry(file->getFileName());
 
-            file->updateFilePointers();
             spin_unlock(&fileMgrOpenlock);
 
             if (foreground_deletion) {
@@ -1702,7 +1701,6 @@ fdb_status FileMgr::close(FileMgr *file,
                 // Clean up FileMgrFactory's unordered map, WAL index, and buffer cache.
                 FileMgrMap::get()->removeEntry(file->getFileName());
 
-                file->updateFilePointers();
                 spin_unlock(&fileMgrOpenlock);
 
                 FileMgr::freeFunc(file);
@@ -1737,6 +1735,8 @@ void FileMgr::freeFunc(FileMgr *file)
         return;
     }
 
+    file->updateFilePointers();
+
     filemgr_prefetch_status_t cond = FILEMGR_PREFETCH_RUNNING;
     if (file->prefetchStatus.compare_exchange_strong(cond, FILEMGR_PREFETCH_ABORT)) {
         // prefetch thread is now running
@@ -1804,8 +1804,15 @@ void FileMgr::removeFile(FileMgr *file,
     FileMgrMap::get()->removeEntry(file->fileName);
     spin_unlock(&fileMgrOpenlock);
 
+    bool free_immediately = false;
+    file->acquireSpinLock();
     if (!lazyFileDeletionEnabled ||
         (file->newFile && file->newFile->inPlaceCompaction)) {
+        free_immediately = true;
+    }
+    file->releaseSpinLock();
+
+    if (free_immediately) {
         FileMgr::freeFunc(file);
     } else {
         registerFileRemoval(file, log_callback);