diff options
author | Neels Hofmeyr <neels@hofmeyr.de> | 2019-03-23 23:38:43 +0100 |
---|---|---|
committer | Neels Hofmeyr <nhofmeyr@sysmocom.de> | 2019-04-11 05:36:36 +0000 |
commit | 223d66a41455033e77e8c2cbb8170eaf0217b954 (patch) | |
tree | 942da4d24ba98f1fc7d457f035a8adb05954fa7c /tests/fsm/fsm_dealloc_test.err | |
parent | ed8e26309640f1ef9d9b17453e62e17f535b5029 (diff) |
add fsm_dealloc_test.c
Despite efforts to properly handle "GONE" events and entering a ST_DESTROYING
only once, so far this test runs straight into a heap use-after-free. With
current fsm.c, it is hard to resolve the situation with the objects named
"other" also causing deallocations besides the FSM instance parent/child
relations.
For illustration, add an "expected" test output file fsm_dealloc_test.err,
making this pass will follow in a subsequent patch.
Change-Id: If801907c541bca9f524c9e5fd22ac280ca16979a
Diffstat (limited to 'tests/fsm/fsm_dealloc_test.err')
-rw-r--r-- | tests/fsm/fsm_dealloc_test.err | 122 |
1 files changed, 122 insertions, 0 deletions
diff --git a/tests/fsm/fsm_dealloc_test.err b/tests/fsm/fsm_dealloc_test.err new file mode 100644 index 00000000..1719677b --- /dev/null +++ b/tests/fsm/fsm_dealloc_test.err @@ -0,0 +1,122 @@ +DLGLOBAL DEBUG scene_alloc() +DLGLOBAL DEBUG test(_branch0){alive}: Allocated +DLGLOBAL DEBUG test(_branch0){alive}: Allocated +DLGLOBAL DEBUG test(_branch0){alive}: is child of test(_branch0) +DLGLOBAL DEBUG test(other){alive}: Allocated +DLGLOBAL DEBUG test(_branch0){alive}: _branch0.other[0] = other +DLGLOBAL DEBUG test(other){alive}: other.other[0] = _branch0 +DLGLOBAL DEBUG test(__twig0a){alive}: __twig0a.other[0] = other +DLGLOBAL DEBUG test(other){alive}: other.other[1] = __twig0a +DLGLOBAL DEBUG --- Test disabled: object 0 was not created. Cleaning up. +DLGLOBAL DEBUG test(_branch0){alive}: Terminating (cause = OSMO_FSM_TERM_ERROR) +DLGLOBAL DEBUG test(_branch0){alive}: pre_term() +DLGLOBAL DEBUG test(__twig0a){alive}: Terminating (cause = OSMO_FSM_TERM_PARENT) +DLGLOBAL DEBUG test(__twig0a){alive}: pre_term() +DLGLOBAL DEBUG test(__twig0a){alive}: Removing from parent test(_branch0) +DLGLOBAL DEBUG 1 (__twig0a.cleanup()) +DLGLOBAL DEBUG test(__twig0a){alive}: cleanup() +DLGLOBAL DEBUG test(__twig0a){alive}: scene forgets __twig0a +DLGLOBAL DEBUG test(__twig0a){alive}: removing reference __twig0a.other[0] -> other +DLGLOBAL DEBUG test(other){alive}: Received Event EV_OTHER_GONE +DLGLOBAL DEBUG 2 (__twig0a.cleanup(),other.alive()) +DLGLOBAL DEBUG test(other){alive}: alive(EV_OTHER_GONE) +DLGLOBAL DEBUG 3 (__twig0a.cleanup(),other.alive(),other.other_gone()) +DLGLOBAL DEBUG test(other){alive}: EV_OTHER_GONE: Dropped reference other.other[1] = __twig0a +DLGLOBAL DEBUG 2 (__twig0a.cleanup(),other.alive()) +DLGLOBAL DEBUG test(other){alive}: state_chg to destroying +DLGLOBAL DEBUG 3 (__twig0a.cleanup(),other.alive(),other.destroying_onenter()) +DLGLOBAL DEBUG test(other){destroying}: destroying_onenter() from alive +DLGLOBAL DEBUG test(other){destroying}: Terminating (cause = OSMO_FSM_TERM_REGULAR) +DLGLOBAL DEBUG test(other){destroying}: pre_term() +DLGLOBAL DEBUG 4 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup()) +DLGLOBAL DEBUG test(other){destroying}: cleanup() +DLGLOBAL DEBUG test(other){destroying}: scene forgets other +DLGLOBAL DEBUG test(other){destroying}: removing reference other.other[0] -> _branch0 +DLGLOBAL DEBUG test(_branch0){alive}: Received Event EV_OTHER_GONE +DLGLOBAL DEBUG 5 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive()) +DLGLOBAL DEBUG test(_branch0){alive}: alive(EV_OTHER_GONE) +DLGLOBAL DEBUG 6 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive(),_branch0.other_gone()) +DLGLOBAL DEBUG test(_branch0){alive}: EV_OTHER_GONE: Dropped reference _branch0.other[0] = other +DLGLOBAL DEBUG 5 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive()) +DLGLOBAL DEBUG test(_branch0){alive}: state_chg to destroying +DLGLOBAL DEBUG 6 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive(),_branch0.destroying_onenter()) +DLGLOBAL DEBUG test(_branch0){destroying}: destroying_onenter() from alive +DLGLOBAL DEBUG test(_branch0){destroying}: Terminating (cause = OSMO_FSM_TERM_REGULAR) +DLGLOBAL DEBUG test(_branch0){destroying}: pre_term() +DLGLOBAL DEBUG 7 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive(),_branch0.destroying_onenter(),_ +DLGLOBAL DEBUG test(_branch0){destroying}: cleanup() +DLGLOBAL DEBUG test(_branch0){destroying}: scene forgets _branch0 +DLGLOBAL DEBUG test(_branch0){destroying}: cleanup() done +DLGLOBAL DEBUG 6 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive(),_branch0.destroying_onenter()) +DLGLOBAL DEBUG test(_branch0){destroying}: Freeing instance +DLGLOBAL DEBUG test(_branch0){destroying}: Deallocated +DLGLOBAL DEBUG 5 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup(),_branch0.alive()) +DLGLOBAL DEBUG 4 (__twig0a.cleanup(),other.alive(),other.destroying_onenter(),other.cleanup()) +DLGLOBAL DEBUG test(other){destroying}: cleanup() done +DLGLOBAL DEBUG 3 (__twig0a.cleanup(),other.alive(),other.destroying_onenter()) +DLGLOBAL DEBUG test(other){destroying}: Freeing instance +DLGLOBAL DEBUG test(other){destroying}: Deallocated +================================================================= +==12545==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000003a8 at pc 0x7fa96fdc9149 bp 0x7fff6045b000 sp 0x7fff6045aff8 +WRITE of size 8 at 0x6120000003a8 thread T0 + #0 0x7fa96fdc9148 in __llist_del ../../../src/libosmocore/include/osmocom/core/linuxlist.h:114 + #1 0x7fa96fdc9280 in llist_del ../../../src/libosmocore/include/osmocom/core/linuxlist.h:126 + #2 0x7fa96fdcddaa in osmo_fsm_inst_free ../../../src/libosmocore/src/fsm.c:404 + #3 0x7fa96fdd599c in _osmo_fsm_inst_term ../../../src/libosmocore/src/fsm.c:738 + #4 0x55dde97cb9e3 in destroying_onenter ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:177 + #5 0x7fa96fdd26be in state_chg ../../../src/libosmocore/src/fsm.c:521 + #6 0x7fa96fdd2770 in _osmo_fsm_inst_state_chg ../../../src/libosmocore/src/fsm.c:577 + #7 0x55dde97cb2e6 in alive ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:151 + #8 0x7fa96fdd3d2f in _osmo_fsm_inst_dispatch ../../../src/libosmocore/src/fsm.c:685 + #9 0x55dde97cd0ee in cleanup ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:255 + #10 0x7fa96fdd5192 in _osmo_fsm_inst_term ../../../src/libosmocore/src/fsm.c:733 + #11 0x7fa96fdd60b1 in _osmo_fsm_inst_term_children ../../../src/libosmocore/src/fsm.c:784 + #12 0x7fa96fdd475e in _osmo_fsm_inst_term ../../../src/libosmocore/src/fsm.c:720 + #13 0x55dde97cf5d5 in scene_clean ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:392 + #14 0x55dde97cf92f in test_dealloc ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:417 + #15 0x55dde97cfffe in main ../../../src/libosmocore/tests/fsm/fsm_dealloc_test.c:465 + #16 0x7fa96eff409a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) + #17 0x55dde97c7329 in _start (/n/s/dev/make/libosmocore/tests/fsm/fsm_dealloc_test+0x11329) + +0x6120000003a8 is located 104 bytes inside of 288-byte region [0x612000000340,0x612000000460) +freed by thread T0 here: + #0 0x7fa970061b50 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8b50) + #1 0x7fa96fcbd5d2 (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0xb5d2) + +previously allocated by thread T0 here: + #0 0x7fa970061ed0 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8ed0) + #1 0x7fa96fcbb140 in _talloc_zero (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x9140) + +SUMMARY: AddressSanitizer: heap-use-after-free ../../../src/libosmocore/include/osmocom/core/linuxlist.h:114 in __llist_del +Shadow bytes around the buggy address: + 0x0c247fff8020: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa + 0x0c247fff8030: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c247fff8040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c247fff8050: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c247fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd +=>0x0c247fff8070: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd + 0x0c247fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c247fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12545==ABORTING |