Project

General

Profile

Actions
Copy link

Bug #35812

closed

multisite: use-after-free in RGWAsyncGetBucketInstanceInfo

Added by Casey Bodley over 5 years ago. Updated over 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Casey Bodley
Target version:
-
% Done:

0%

Source:
Tags:
multisite
Backport:
mimic luminous
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

from http://qa-proxy.ceph.com/teuthology/cbodley-2018-09-05_18:33:58-rgw:multisite-wip-multisite-testing-distro-basic-smithi/2982854/teuthology.log

<error>
  <unique>0x0</unique>
  <tid>42</tid>
  <threadname>rados_async</threadname>
  <kind>InvalidRead</kind>
  <what>Invalid read of size 8</what>
  <stack>
    <frame>
      <ip>0x64A739</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>rgw_get_system_obj(RGWRados*, RGWObjectCtx&amp;, rgw_pool const&amp;, std::string const&amp;, ceph::buffer::list&amp;, RGWObjVersionTracker*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x5AEE44</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_bucket_instance_from_oid(RGWObjectCtx&amp;, std::string const&amp;, RGWBucketInfo&amp;, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x529DF6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncGetBucketInstanceInfo::_send_request()</fn>
    </frame>
    <frame>
      <ip>0x527C21</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::handle_request(RGWAsyncRadosRequest*)</fn>
    </frame>
    <frame>
      <ip>0x52DEFC</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::RGWWQ::_process(RGWAsyncRadosRequest*, ThreadPool::TPHandle&amp;)</fn>
    </frame>
    <frame>
      <ip>0x5F329E7</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::worker(ThreadPool::WorkThread*)</fn>
    </frame>
    <frame>
      <ip>0x5F3406F</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::WorkThread::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Address 0x141e96a30 is 1,632 bytes inside a block of size 2,024 free'd</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2B1CD</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator delete(void*)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>576</line>
    </frame>
    <frame>
      <ip>0x51E4FD</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::cancel()</fn>
    </frame>
    <frame>
      <ip>0x52363A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Block was alloc'd at</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2A243</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator new(unsigned long)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>334</line>
    </frame>
    <frame>
      <ip>0x4F95B9</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncSingleEntryCR::operate()</fn>
    </frame>
    <frame>
      <ip>0x51DF7E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::operate(RGWCoroutinesEnv*)</fn>
    </frame>
    <frame>
      <ip>0x523042</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
</error>

<error>
  <unique>0x1</unique>
  <tid>42</tid>
  <threadname>rados_async</threadname>
  <kind>InvalidWrite</kind>
  <what>Invalid write of size 8</what>
  <stack>
    <frame>
      <ip>0x5FDE27</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCache&lt;RGWRados&gt;::raw_obj_stat(rgw_raw_obj&amp;, unsigned long*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, unsigned long*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, ceph::buffer::list*, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5AB55C</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_system_obj_state_impl(RGWObjectCtx*, rgw_raw_obj&amp;, RGWRawObjState**, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5ABBB3</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_system_obj_state(RGWObjectCtx*, rgw_raw_obj&amp;, RGWRawObjState**, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5ABC16</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::stat_system_obj(RGWObjectCtx&amp;, RGWRados::SystemObject::Read::GetObjState&amp;, rgw_raw_obj&amp;, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, unsigned long*, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x57EF8E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::SystemObject::Read::stat(RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x64A8D5</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>rgw_get_system_obj(RGWRados*, RGWObjectCtx&amp;, rgw_pool const&amp;, std::string const&amp;, ceph::buffer::list&amp;, RGWObjVersionTracker*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x5AEE44</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_bucket_instance_from_oid(RGWObjectCtx&amp;, std::string const&amp;, RGWBucketInfo&amp;, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x529DF6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncGetBucketInstanceInfo::_send_request()</fn>
    </frame>
    <frame>
      <ip>0x527C21</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::handle_request(RGWAsyncRadosRequest*)</fn>
    </frame>
    <frame>
      <ip>0x52DEFC</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::RGWWQ::_process(RGWAsyncRadosRequest*, ThreadPool::TPHandle&amp;)</fn>
    </frame>
    <frame>
      <ip>0x5F329E7</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::worker(ThreadPool::WorkThread*)</fn>
    </frame>
    <frame>
      <ip>0x5F3406F</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::WorkThread::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Address 0x141e96a28 is 1,624 bytes inside a block of size 2,024 free'd</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2B1CD</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator delete(void*)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>576</line>
    </frame>
    <frame>
      <ip>0x51E4FD</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::cancel()</fn>
    </frame>
    <frame>
      <ip>0x52363A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Block was alloc'd at</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2A243</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator new(unsigned long)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>334</line>
    </frame>
    <frame>
      <ip>0x4F95B9</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncSingleEntryCR::operate()</fn>
    </frame>
    <frame>
      <ip>0x51DF7E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::operate(RGWCoroutinesEnv*)</fn>
    </frame>
    <frame>
      <ip>0x523042</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
</error>

<error>
  <unique>0x2</unique>
  <tid>42</tid>
  <threadname>rados_async</threadname>
  <kind>InvalidRead</kind>
  <what>Invalid read of size 8</what>
  <stack>
    <frame>
      <ip>0x2F613B</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>std::string::assign(std::string const&amp;)</fn>
    </frame>
    <frame>
      <ip>0x5FDE2E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCache&lt;RGWRados&gt;::raw_obj_stat(rgw_raw_obj&amp;, unsigned long*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, unsigned long*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, ceph::buffer::list*, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5AB55C</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_system_obj_state_impl(RGWObjectCtx*, rgw_raw_obj&amp;, RGWRawObjState**, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5ABBB3</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_system_obj_state(RGWObjectCtx*, rgw_raw_obj&amp;, RGWRawObjState**, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x5ABC16</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::stat_system_obj(RGWObjectCtx&amp;, RGWRados::SystemObject::Read::GetObjState&amp;, rgw_raw_obj&amp;, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, unsigned long*, RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x57EF8E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::SystemObject::Read::stat(RGWObjVersionTracker*)</fn>
    </frame>
    <frame>
      <ip>0x64A8D5</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>rgw_get_system_obj(RGWRados*, RGWObjectCtx&amp;, rgw_pool const&amp;, std::string const&amp;, ceph::buffer::list&amp;, RGWObjVersionTracker*, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x5AEE44</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRados::get_bucket_instance_from_oid(RGWObjectCtx&amp;, std::string const&amp;, RGWBucketInfo&amp;, std::chrono::time_point&lt;ceph::time_detail::real_clock, std::chrono::duration&lt;unsigned long, std::ratio&lt;1l, 1000000000l&gt; &gt; &gt;*, std::map&lt;std::string, ceph::buffer::list, std::less&lt;std::string&gt;, std::allocator&lt;std::pair&lt;std::string const, ceph::buffer::list&gt; &gt; &gt;*, rgw_cache_entry_info*, boost::optional&lt;obj_version&gt;)</fn>
    </frame>
    <frame>
      <ip>0x529DF6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncGetBucketInstanceInfo::_send_request()</fn>
    </frame>
    <frame>
      <ip>0x527C21</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::handle_request(RGWAsyncRadosRequest*)</fn>
    </frame>
    <frame>
      <ip>0x52DEFC</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWAsyncRadosProcessor::RGWWQ::_process(RGWAsyncRadosRequest*, ThreadPool::TPHandle&amp;)</fn>
    </frame>
    <frame>
      <ip>0x5F329E7</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::worker(ThreadPool::WorkThread*)</fn>
    </frame>
    <frame>
      <ip>0x5F3406F</ip>
      <obj>/usr/lib64/ceph/libceph-common.so.0</obj>
      <fn>ThreadPool::WorkThread::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Address 0x141e96a30 is 1,632 bytes inside a block of size 2,024 free'd</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2B1CD</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator delete(void*)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>576</line>
    </frame>
    <frame>
      <ip>0x51E4FD</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::cancel()</fn>
    </frame>
    <frame>
      <ip>0x52363A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
  <auxwhat>Block was alloc'd at</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2A243</ip>
      <obj>/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator new(unsigned long)</fn>
      <dir>/builddir/build/BUILD/valgrind-3.13.0/coregrind/m_replacemalloc</dir>
      <file>vg_replace_malloc.c</file>
      <line>334</line>
    </frame>
    <frame>
      <ip>0x4F95B9</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncSingleEntryCR::operate()</fn>
    </frame>
    <frame>
      <ip>0x51DF7E</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesStack::operate(RGWCoroutinesEnv*)</fn>
    </frame>
    <frame>
      <ip>0x523042</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(std::list&lt;RGWCoroutinesStack*, std::allocator&lt;RGWCoroutinesStack*&gt; &gt;&amp;)</fn>
    </frame>
    <frame>
      <ip>0x523FC7</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWCoroutinesManager::run(RGWCoroutine*)</fn>
    </frame>
    <frame>
      <ip>0x4D65D6</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRemoteDataLog::run_sync(int)</fn>
    </frame>
    <frame>
      <ip>0x5DCC85</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWDataSyncProcessorThread::process()</fn>
    </frame>
    <frame>
      <ip>0x57D40A</ip>
      <obj>/usr/bin/radosgw</obj>
      <fn>RGWRadosThread::Worker::entry()</fn>
    </frame>
    <frame>
      <ip>0xE8E1E24</ip>
      <obj>/usr/lib64/libpthread-2.17.so</obj>
      <fn>start_thread</fn>
    </frame>
    <frame>
      <ip>0x119B9BAC</ip>
      <obj>/usr/lib64/libc-2.17.so</obj>
      <fn>clone</fn>
    </frame>
  </stack>
</error>

Related issues 2 (0 open — 2 closed)

Copied to rgw - Backport #36211: mimic: multisite: use-after-free in RGWAsyncGetBucketInstanceInfoResolvedPrashant DActions
Copied to rgw - Backport #36212: luminous: multisite: use-after-free in RGWAsyncGetBucketInstanceInfoResolvedPrashant DActions
Actions
Copy link
 #1

Updated by Casey Bodley over 5 years ago

  • Status changed from New to Fix Under Review
Actions
Copy link
 #2

Updated by Casey Bodley over 5 years ago

  • Status changed from Fix Under Review to Pending Backport
Actions
Copy link
 #3

Updated by Nathan Cutler over 5 years ago

  • Copied to Backport #36211: mimic: multisite: use-after-free in RGWAsyncGetBucketInstanceInfo added
Actions
Copy link
 #4

Updated by Nathan Cutler over 5 years ago

  • Copied to Backport #36212: luminous: multisite: use-after-free in RGWAsyncGetBucketInstanceInfo added
Actions
Copy link
 #5

Updated by Nathan Cutler over 5 years ago

  • Status changed from Pending Backport to Resolved
Actions
Copy link

Also available in: Atom PDF