Issue #15165 has been updated by ko1 (Koichi Sasada).
Thank you.
I want to know how to use clang's ASAN. You specified CFLAGS and LDFLAGS. both needed?
----------------------------------------
Bug #15165: heap-use-after-free (READ of size 8) in obj_free (gc.c:2266)
https://bugs.ruby-lang.org/issues/15165#change-74205
* Author: bannable (Joe Truba)
* Status: Closed
* Priority: Normal
* Assignee:
* Target version:
* ruby -v:
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
This is triggered while compiling 22de2030c5 on my Debian machine. Compiled with:
~~~
CC=clang CXX=clang++ LDFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address -fsanitize-coverage=trace-pc-guard" ASAN_OPTIONS=detect_leaks=0 CFLAGS="-O0 -fno-omit-frame-pointer -g3 -fsanitize=address -fsanitize-coverage=trace-pc-guard" LD=clang make all
~~~
Patch:
https://github.com/ruby/ruby/pull/1964
Crash:
~~~
generating encdb.h [523/4506]
=================================================================
==61672==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600000e670 at pc 0x55cfaf4cb68c bp 0x7ffc415ac8c0 sp 0x7ffc415ac8b8
READ of size 8 at 0x60600000e670 thread T0
#0 0x55cfaf4cb68b in obj_free /home/jtruba/rubies/ruby-trunk/gc.c:2266:17
#1 0x55cfaf4c93da in gc_page_sweep /home/jtruba/rubies/ruby-trunk/gc.c:3562:10
#2 0x55cfaf4c80de in gc_sweep_step /home/jtruba/rubies/ruby-trunk/gc.c:3730:19
#3 0x55cfaf4c697e in gc_sweep_continue /home/jtruba/rubies/ruby-trunk/gc.c:3796:5
#4 0x55cfaf4c6695 in heap_prepare /home/jtruba/rubies/ruby-trunk/gc.c:1741:2
#5 0x55cfaf4c6448 in heap_get_freeobj_from_next_freepage /home/jtruba/rubies/ruby-trunk/gc.c:1761:2
#6 0x55cfaf4c60ef in heap_get_freeobj /home/jtruba/rubies/ruby-trunk/gc.c:1795:10
#7 0x55cfaf4c5ea6 in newobj_slowpath /home/jtruba/rubies/ruby-trunk/gc.c:1925:11
#8 0x55cfaf4c5a22 in newobj_slowpath_wb_protected /home/jtruba/rubies/ruby-trunk/gc.c:1937:12
#9 0x55cfaf4a271d in newobj_of /home/jtruba/rubies/ruby-trunk/gc.c:1974:4
#10 0x55cfaf4a27ce in rb_wb_protected_newobj_of /home/jtruba/rubies/ruby-trunk/gc.c:1990:12
#11 0x55cfaf925f32 in str_alloc /home/jtruba/rubies/ruby-trunk/string.c:715:5
#12 0x55cfaf91f592 in str_new0 /home/jtruba/rubies/ruby-trunk/string.c:737:11
#13 0x55cfaf91f4ab in rb_enc_str_new /home/jtruba/rubies/ruby-trunk/string.c:789:11
#14 0x55cfaf9a7142 in rb_intern3 /home/jtruba/rubies/ruby-trunk/symbol.c:600:11
#15 0x55cfaf72535a in tokenize_ident /home/jtruba/rubies/ruby-trunk/parse.y:7321:16
#16 0x55cfaf71a139 in parse_ident /home/jtruba/rubies/ruby-trunk/parse.y:7576:13
#17 0x55cfaf709576 in parser_yylex /home/jtruba/rubies/ruby-trunk/parse.y:8255:12
#18 0x55cfaf6dae43 in yylex /home/jtruba/rubies/ruby-trunk/parse.y:8265:9
#19 0x55cfaf6aea5b in ruby_yyparse /home/jtruba/rubies/ruby-trunk/parse.c:5254:16
#20 0x55cfaf6f640e in yycompile0 /home/jtruba/rubies/ruby-trunk/parse.y:4882:9
#21 0x55cfafb483c4 in rb_suppress_tracing /home/jtruba/rubies/ruby-trunk/vm_trace.c:401:11
#22 0x55cfaf6f1302 in yycompile /home/jtruba/rubies/ruby-trunk/parse.y:4926:5
#23 0x55cfaf6f0f91 in rb_parser_compile_file_path /home/jtruba/rubies/ruby-trunk/parse.y:5065:12
#24 0x55cfaf8b9dd2 in load_file_internal /home/jtruba/rubies/ruby-trunk/ruby.c:1984:11
#25 0x55cfaf465d84 in rb_ensure /home/jtruba/rubies/ruby-trunk/eval.c:1052:11
#26 0x55cfaf8b2660 in load_file /home/jtruba/rubies/ruby-trunk/ruby.c:2103:24
#27 0x55cfaf8b17e4 in rb_parser_load_file /home/jtruba/rubies/ruby-trunk/ruby.c:2125:12
#28 0x55cfaf5a3e9f in rb_load_internal0 /home/jtruba/rubies/ruby-trunk/load.c:606:24
#29 0x55cfaf5a5298 in rb_require_internal /home/jtruba/rubies/ruby-trunk/load.c:992:15
#30 0x55cfaf5a4417 in rb_require_safe /home/jtruba/rubies/ruby-trunk/load.c:1038:18
#31 0x55cfaf5a43d6 in rb_f_require /home/jtruba/rubies/ruby-trunk/load.c:820:12
#32 0x55cfafb2320c in call_cfunc_1 /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:1748:12
#33 0x55cfafaffd41 in vm_call_cfunc_with_frame /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:1931:11
#34 0x55cfafae8cc5 in vm_call_cfunc /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:1947:12
#35 0x55cfafae6039 in vm_call_method_each_type /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:2269:9
#36 0x55cfafae59ba in vm_call_method /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:2406:13
#37 0x55cfafa8f86b in vm_call_general /home/jtruba/rubies/ruby-trunk/./vm_insnhelper.c:2438:12
#38 0x55cfafa9cf26 in vm_exec_core /home/jtruba/rubies/ruby-trunk/insns.def:767:5
#39 0x55cfafad69eb in rb_vm_exec /home/jtruba/rubies/ruby-trunk/vm.c:1812:22
#40 0x55cfafada946 in rb_iseq_eval_main /home/jtruba/rubies/ruby-trunk/vm.c:2071:11
#41 0x55cfaf461079 in ruby_exec_internal /home/jtruba/rubies/ruby-trunk/eval.c:261:2
#42 0x55cfaf4608d7 in ruby_exec_node /home/jtruba/rubies/ruby-trunk/eval.c:325:12
#43 0x55cfaf460706 in ruby_run_node /home/jtruba/rubies/ruby-trunk/eval.c:317:25
#44 0x55cfaf27b7f4 in main /home/jtruba/rubies/ruby-trunk/./main.c:42:9
#45 0x7fd4b91bbb44 in __libc_start_main /build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
#46 0x55cfaf1a552b in _start (/home/jtruba/rubies/ruby-trunk/miniruby+0x14352b)
0x60600000e670 is located 16 bytes inside of 56-byte region [0x60600000e660,0x60600000e698)
freed by thread T0 here:
#0 0x55cfaf24c612 in __interceptor_free /home/jtruba/to_install/llvm/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:78:3
#1 0x55cfaf4ba088 in objspace_xfree /home/jtruba/rubies/ruby-trunk/gc.c:8160:5
#2 0x55cfaf4ba024 in ruby_sized_xfree /home/jtruba/rubies/ruby-trunk/gc.c:8256:2
#3 0x55cfaf4a1fdf in ruby_xfree /home/jtruba/rubies/ruby-trunk/gc.c:8263:5
#4 0x55cfaf8f6af0 in st_free_table /home/jtruba/rubies/ruby-trunk/st.c:690:5
#5 0x55cfaf4cb5d2 in obj_free /home/jtruba/rubies/ruby-trunk/gc.c:2264:6
#6 0x55cfaf4c93da in gc_page_sweep /home/jtruba/rubies/ruby-trunk/gc.c:3562:10
#7 0x55cfaf4c80de in gc_sweep_step /home/jtruba/rubies/ruby-trunk/gc.c:3730:19
#8 0x55cfaf4c697e in gc_sweep_continue /home/jtruba/rubies/ruby-trunk/gc.c:3796:5
#9 0x55cfaf4c6695 in heap_prepare /home/jtruba/rubies/ruby-trunk/gc.c:1741:2
#10 0x55cfaf4c6448 in heap_get_freeobj_from_next_freepage /home/jtruba/rubies/ruby-trunk/gc.c:1761:2
#11 0x55cfaf4c60ef in heap_get_freeobj /home/jtruba/rubies/ruby-trunk/gc.c:1795:10
#12 0x55cfaf4c5ea6 in newobj_slowpath /home/jtruba/rubies/ruby-trunk/gc.c:1925:11
#13 0x55cfaf4c5a22 in newobj_slowpath_wb_protected /home/jtruba/rubies/ruby-trunk/gc.c:1937:12
#14 0x55cfaf4a271d in newobj_of /home/jtruba/rubies/ruby-trunk/gc.c:1974:4
#15 0x55cfaf4a27ce in rb_wb_protected_newobj_of /home/jtruba/rubies/ruby-trunk/gc.c:1990:12
#16 0x55cfaf925f32 in str_alloc /home/jtruba/rubies/ruby-trunk/string.c:715:5
#17 0x55cfaf91f592 in str_new0 /home/jtruba/rubies/ruby-trunk/string.c:737:11
#18 0x55cfaf91f4ab in rb_enc_str_new /home/jtruba/rubies/ruby-trunk/string.c:789:11
#19 0x55cfaf9a7142 in rb_intern3 /home/jtruba/rubies/ruby-trunk/symbol.c:600:11
#20 0x55cfaf72535a in tokenize_ident /home/jtruba/rubies/ruby-trunk/parse.y:7321:16
#21 0x55cfaf71a139 in parse_ident /home/jtruba/rubies/ruby-trunk/parse.y:7576:13
#22 0x55cfaf709576 in parser_yylex /home/jtruba/rubies/ruby-trunk/parse.y:8255:12
#23 0x55cfaf6dae43 in yylex /home/jtruba/rubies/ruby-trunk/parse.y:8265:9
#24 0x55cfaf6aea5b in ruby_yyparse /home/jtruba/rubies/ruby-trunk/parse.c:5254:16
#25 0x55cfaf6f640e in yycompile0 /home/jtruba/rubies/ruby-trunk/parse.y:4882:9
#26 0x55cfafb483c4 in rb_suppress_tracing /home/jtruba/rubies/ruby-trunk/vm_trace.c:401:11
#27 0x55cfaf6f1302 in yycompile /home/jtruba/rubies/ruby-trunk/parse.y:4926:5
#28 0x55cfaf6f0f91 in rb_parser_compile_file_path /home/jtruba/rubies/ruby-trunk/parse.y:5065:12
#29 0x55cfaf8b9dd2 in load_file_internal /home/jtruba/rubies/ruby-trunk/ruby.c:1984:11
previously allocated by thread T0 here:
#0 0x55cfaf24c953 in malloc /home/jtruba/to_install/llvm/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:98:3
#1 0x55cfaf4b9601 in objspace_xmalloc0 /home/jtruba/rubies/ruby-trunk/gc.c:7985:5
#2 0x55cfaf4b948e in ruby_xmalloc0 /home/jtruba/rubies/ruby-trunk/gc.c:8169:12
#3 0x55cfaf4b92fd in ruby_xmalloc_body /home/jtruba/rubies/ruby-trunk/gc.c:8178:12
#4 0x55cfaf4b04eb in ruby_xmalloc /home/jtruba/rubies/ruby-trunk/gc.c:9948:12
#5 0x55cfaf8f60b9 in st_init_table_with_size /home/jtruba/rubies/ruby-trunk/st.c:593:24
#6 0x55cfaf8f682f in st_init_table /home/jtruba/rubies/ruby-trunk/st.c:623:12
#7 0x55cfaf4ea158 in rb_ident_hash_new /home/jtruba/rubies/ruby-trunk/hash.c:3041:25
#8 0x55cfaf99aa6a in struct_make_members_list /home/jtruba/rubies/ruby-trunk/struct.c:354:23
#9 0x55cfaf99b13c in rb_struct_define_without_accessor /home/jtruba/rubies/ruby-trunk/struct.c:420:15
#10 0x55cfaf78636c in Init_Range /home/jtruba/rubies/ruby-trunk/range.c:1538:17
#11 0x55cfaf4fec5c in rb_call_inits /home/jtruba/rubies/ruby-trunk/inits.c:43:5
#12 0x55cfaf45d310 in ruby_setup /home/jtruba/rubies/ruby-trunk/eval.c:74:2
#13 0x55cfaf45d5d8 in ruby_init /home/jtruba/rubies/ruby-trunk/eval.c:91:17
#14 0x55cfaf27b77a in main /home/jtruba/rubies/ruby-trunk/./main.c:41:2
#15 0x7fd4b91bbb44 in __libc_start_main /build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287
SUMMARY: AddressSanitizer: heap-use-after-free /home/jtruba/rubies/ruby-trunk/gc.c:2266:17 in obj_free
Shadow bytes around the buggy address:
0x0c0c7fff9c70: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c7fff9c80: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x0c0c7fff9c90: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x0c0c7fff9ca0: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c7fff9cb0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
=>0x0c0c7fff9cc0: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd[fd]fd
0x0c0c7fff9cd0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c7fff9ce0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x0c0c7fff9cf0: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00
0x0c0c7fff9d00: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c7fff9d10: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==61672==ABORTING
~~~
--
https://bugs.ruby-lang.org/
Unsubscribe: <mailto:ruby-core-request / ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>