[ARROW-12226] [C++] ASAN error in s3fs_test.cc

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0
• Component/s: C++
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/28042
• Assignee: Antoine Pitrou
• Reporter: Antoine Pitrou
• Created: 06/Apr/21 12:46
• Updated: 11/Jan/23 08:25
• Resolved: 06/Apr/21 19:11

Description

I get this locally:

[ RUN      ] TestS3FS.OpenOutputStreamBackgroundWrites
Attempting encryption of all config, IAM users and policies on MinIO backend
=================================================================
==145714==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190001df758 at pc 0x7f4fd4035e5b bp 0x7ffcf2e8cbc0 sp 0x7ffcf2e8cbb8
READ of size 1 at 0x6190001df758 thread T0
    #0 0x7f4fd4035e5a in UploadPart ../src/arrow/filesystem/s3fs.cc:970
    #1 0x7f4fd4034a40 in UploadPart ../src/arrow/filesystem/s3fs.cc:958
    #2 0x7f4fd403474a in CommitCurrentPart ../src/arrow/filesystem/s3fs.cc:954
    #3 0x7f4fd4030899 in Close ../src/arrow/filesystem/s3fs.cc:851
    #4 0x563844f07905 in arrow::fs::TestS3FS::TestOpenOutputStream() ../src/arrow/filesystem/s3fs_test.cc:468
    #5 0x563844ec69e7 in arrow::fs::TestS3FS_OpenOutputStreamBackgroundWrites_Test::TestBody() ../src/arrow/filesystem/s3fs_test.cc:853
    #6 0x7f4fca6eb98d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4c98d)
    #7 0x7f4fca6ebbe0 in testing::Test::Run() (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4cbe0)
    #8 0x7f4fca6ebf0e in testing::TestInfo::Run() (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4cf0e)
    #9 0x7f4fca6ec035 in testing::TestSuite::Run() (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4d035)
    #10 0x7f4fca6ec5eb in testing::internal::UnitTestImpl::RunAllTests() (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4d5eb)
    #11 0x7f4fca6ec858 in testing::UnitTest::Run() (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4d858)
    #12 0x7f4fca72807e in main (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest_main.so+0x107e)
    #13 0x7f4fc999f0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #14 0x563844e7c57d in _start (/home/antoine/arrow/dev/cpp/build-test/debug/arrow-s3fs-test+0x22757d)

0x6190001df758 is located 216 bytes inside of 936-byte region [0x6190001df680,0x6190001dfa28)
freed by thread T0 here:
    #0 0x7f4fdeaea78c in operator delete(void*) /home/conda/feedstock_root/build_artifacts/ctng-compilers_1601682258120/work/.build/x86_64-conda-linux-gnu/src/gcc/libsanitizer/asan/asan_new_delete.cc:165
    #1 0x7f4fd40c6ba7 in std::default_delete<arrow::fs::S3FileSystem::Impl>::operator()(arrow::fs::S3FileSystem::Impl*) const /usr/include/c++/9/bits/unique_ptr.h:81
    #2 0x7f4fd40aeeb8 in std::unique_ptr<arrow::fs::S3FileSystem::Impl, std::default_delete<arrow::fs::S3FileSystem::Impl> >::~unique_ptr() /usr/include/c++/9/bits/unique_ptr.h:292
    #3 0x7f4fd40418f0 in arrow::fs::S3FileSystem::~S3FileSystem() ../src/arrow/filesystem/s3fs.cc:1665
    #4 0x7f4fd4041961 in arrow::fs::S3FileSystem::~S3FileSystem() ../src/arrow/filesystem/s3fs.cc:1665
    #5 0x7f4fd4119874 in std::_Sp_counted_ptr<arrow::fs::S3FileSystem*, (__gnu_cxx::_Lock_policy)2>::_M_dispose() /usr/include/c++/9/bits/shared_ptr_base.h:377
    #6 0x563844f34ea9 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /usr/include/c++/9/bits/shared_ptr_base.h:155
    #7 0x563844f1a19b in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /usr/include/c++/9/bits/shared_ptr_base.h:730
    #8 0x563844ef8202 in std::__shared_ptr<arrow::fs::S3FileSystem, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /usr/include/c++/9/bits/shared_ptr_base.h:1169
    #9 0x563844f2c02b in std::__shared_ptr<arrow::fs::S3FileSystem, (__gnu_cxx::_Lock_policy)2>::reset() /usr/include/c++/9/bits/shared_ptr_base.h:1287
    #10 0x563844f0725e in arrow::fs::TestS3FS::TestOpenOutputStream() ../src/arrow/filesystem/s3fs_test.cc:466
    #11 0x563844ec69e7 in arrow::fs::TestS3FS_OpenOutputStreamBackgroundWrites_Test::TestBody() ../src/arrow/filesystem/s3fs_test.cc:853
    #12 0x7f4fca6eb98d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4c98d)

previously allocated by thread T0 here:
    #0 0x7f4fdeae9b5e in operator new(unsigned long) /home/conda/feedstock_root/build_artifacts/ctng-compilers_1601682258120/work/.build/x86_64-conda-linux-gnu/src/gcc/libsanitizer/asan/asan_new_delete.cc:104
    #1 0x7f4fd40414e6 in arrow::fs::S3FileSystem::S3FileSystem(arrow::fs::S3Options const&, arrow::io::IOContext const&) ../src/arrow/filesystem/s3fs.cc:1661
    #2 0x7f4fd4041cf0 in arrow::fs::S3FileSystem::Make(arrow::fs::S3Options const&, arrow::io::IOContext const&) ../src/arrow/filesystem/s3fs.cc:1671
    #3 0x563844efdaf3 in arrow::fs::TestS3FS::MakeFileSystem() ../src/arrow/filesystem/s3fs_test.cc:405
    #4 0x563844efa8a4 in arrow::fs::TestS3FS::SetUp() ../src/arrow/filesystem/s3fs_test.cc:376
    #5 0x7f4fca6eb98d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/antoine/miniconda3/envs/pyarrow/lib/libgtest.so+0x4c98d)

SUMMARY: AddressSanitizer: heap-use-after-free ../src/arrow/filesystem/s3fs.cc:970 in UploadPart
Shadow bytes around the buggy address:
  0x0c3280033e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033eb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3280033ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3280033ed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3280033ee0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
  0x0c3280033ef0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033f10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3280033f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

Issue Links

• links to: GitHub Pull Request #9908