[DISPATCH-2057] TSAN data race from qdr_core_unbind_address_link_CT in system_tests_edge_router

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.16.0, 1.17.0
• Fix Version/s: 1.20.0
• Labels: race-condition tsan
• Assignee: Ken Giusti
• Reporter: Jiri Daněk
• Created: 15/Apr/21 22:31
• Updated: 15/Mar/22 21:54

Description

https://travis-ci.com/github/apache/qpid-dispatch/jobs/498899790#L6312

54: ==================
54: WARNING: ThreadSanitizer: data race (pid=16195)
54:   Write of size 8 at 0x7b54000ae908 by thread T1:
54:     #0 qdr_core_unbind_address_link_CT /home/travis/build/apache/qpid-dispatch/src/router_core/router_core.c:685 (libqpid-dispatch.so+0xc4a83)
54:     #1 del_inlink /home/travis/build/apache/qpid-dispatch/src/router_core/modules/edge_router/addr_proxy.c:174 (libqpid-dispatch.so+0xd2af0)
54:     #2 on_addr_event /home/travis/build/apache/qpid-dispatch/src/router_core/modules/edge_router/addr_proxy.c:426 (libqpid-dispatch.so+0xd3102)
54:     #3 qdrc_event_addr_raise /home/travis/build/apache/qpid-dispatch/src/router_core/core_events.c:125 (libqpid-dispatch.so+0xace11)
54:     #4 qdr_core_unbind_address_link_CT /home/travis/build/apache/qpid-dispatch/src/router_core/router_core.c:697 (libqpid-dispatch.so+0xc4bf7)
54:     #5 qdr_link_inbound_detach_CT /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:2070 (libqpid-dispatch.so+0xab5b4)
54:     #6 router_core_thread /home/travis/build/apache/qpid-dispatch/src/router_core/router_core_thread.c:240 (libqpid-dispatch.so+0xc81e5)
54:     #7 _thread_init /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:174 (libqpid-dispatch.so+0x94ea6)
54:     #8 <null> <null> (libtsan.so.0+0x2d1af)
54: 
54:   Previous read of size 8 at 0x7b54000ae908 by thread T4:
54:     #0 qdr_link_is_anonymous /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:526 (libqpid-dispatch.so+0xa68e2)
54:     #1 AMQP_rx_handler /home/travis/build/apache/qpid-dispatch/src/router_node.c:640 (libqpid-dispatch.so+0xe372b)
54:     #2 do_receive /home/travis/build/apache/qpid-dispatch/src/container.c:227 (libqpid-dispatch.so+0x74584)
54:     #3 qd_container_handle_event /home/travis/build/apache/qpid-dispatch/src/container.c:737 (libqpid-dispatch.so+0x74584)
54:     #4 handle /home/travis/build/apache/qpid-dispatch/src/server.c:1097 (libqpid-dispatch.so+0xea531)
54:     #5 thread_run /home/travis/build/apache/qpid-dispatch/src/server.c:1122 (libqpid-dispatch.so+0xec41c)
54:     #6 _thread_init /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:174 (libqpid-dispatch.so+0x94ea6)
54:     #7 <null> <null> (libtsan.so.0+0x2d1af)
54: 
54:   Location is heap block of size 576 at 0x7b54000ae880 allocated by thread T4:
54:     #0 posix_memalign <null> (libtsan.so.0+0x3048d)
54:     #1 qd_alloc /home/travis/build/apache/qpid-dispatch/src/alloc_pool.c:396 (libqpid-dispatch.so+0x5f5f4)
54:     #2 new_qdr_link_t /home/travis/build/apache/qpid-dispatch/src/router_core/router_core.c:33 (libqpid-dispatch.so+0xc17e5)
54:     #3 qdr_link_first_attach /home/travis/build/apache/qpid-dispatch/src/router_core/connections.c:581 (libqpid-dispatch.so+0xa6acb)
54:     #4 AMQP_incoming_link_handler /home/travis/build/apache/qpid-dispatch/src/router_node.c:964 (libqpid-dispatch.so+0xe19d2)
54:     #5 qd_container_handle_event /home/travis/build/apache/qpid-dispatch/src/container.c:729 (libqpid-dispatch.so+0x74078)
54:     #6 handle /home/travis/build/apache/qpid-dispatch/src/server.c:1097 (libqpid-dispatch.so+0xea531)
54:     #7 thread_run /home/travis/build/apache/qpid-dispatch/src/server.c:1122 (libqpid-dispatch.so+0xec398)
54:     #8 _thread_init /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:174 (libqpid-dispatch.so+0x94ea6)
54:     #9 <null> <null> (libtsan.so.0+0x2d1af)
54: 
54:   Thread T1 (tid=16197, running) created by main thread at:
54:     #0 pthread_create <null> (libtsan.so.0+0x5ea99)
54:     #1 sys_thread /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:183 (libqpid-dispatch.so+0x95462)
54:     #2 qdr_core /home/travis/build/apache/qpid-dispatch/src/router_core/router_core.c:122 (libqpid-dispatch.so+0xc295e)
54:     #3 qd_router_setup_late /home/travis/build/apache/qpid-dispatch/src/router_node.c:2111 (libqpid-dispatch.so+0xe5e9c)
54:     #4 <null> <null> (libffi.so.7+0x6ff4)
54:     #5 main_process /home/travis/build/apache/qpid-dispatch/router/src/main.c:97 (qdrouterd+0x2bb2)
54:     #6 main /home/travis/build/apache/qpid-dispatch/router/src/main.c:369 (qdrouterd+0x2882)
54: 
54:   Thread T4 (tid=16200, running) created by main thread at:
54:     #0 pthread_create <null> (libtsan.so.0+0x5ea99)
54:     #1 sys_thread /home/travis/build/apache/qpid-dispatch/src/posix/threading.c:183 (libqpid-dispatch.so+0x95462)
54:     #2 qd_server_run /home/travis/build/apache/qpid-dispatch/src/server.c:1485 (libqpid-dispatch.so+0xecefa)
54:     #3 main_process /home/travis/build/apache/qpid-dispatch/router/src/main.c:115 (qdrouterd+0x2c27)
54:     #4 main /home/travis/build/apache/qpid-dispatch/router/src/main.c:369 (qdrouterd+0x2882)
54: 
54: SUMMARY: ThreadSanitizer: data race /home/travis/build/apache/qpid-dispatch/src/router_core/router_core.c:685 in qdr_core_unbind_address_link_CT
54: ==================
54: ThreadSanitizer: reported 1 warnings
54: <<<<
54: 
54: ----------------------------------------------------------------------
54: Ran 89 tests in 381.923s
54: 
54: FAILED (errors=1)
54/74 Test #54: system_tests_edge_router ..........................***Failed  382.09 sec

Issue Links

• is cloned by: DISPATCH-2188 ASAN use after free from qdr_core_unbind_address_link_CT in system_tests_protocol_settings