Bug #6235: fast intel crc code reads trailing words - Ceph - Ceph

Actions

Copy link

Bug #6235

closed

fast intel crc code reads trailing words

Added by Sage Weil over 10 years ago. Updated over 10 years ago.

Status:

Resolved

Priority:

Urgent

Assignee:

Greg Farnum

Category:

Target version:

% Done:

Source:

Q/A

Tags:

Backport:

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

Crash signature (v1):

Crash signature (v2):

Description

  <kind>InvalidRead</kind>
  <what>Invalid read of size 8</what>
  <stack>
    <frame>
      <ip>0x91B969</ip>
      <obj>/usr/bin/ceph-osd</obj>
    </frame>
    <frame>
      <ip>0x6F4488F</ip>
    </frame>
    <frame>
      <ip>0x20462C1F</ip>
    </frame>
    <frame>
      <ip>0x7DC139</ip>
      <obj>/usr/bin/ceph-osd</obj>
      <fn>Message::encode(unsigned long, bool)</fn>
      <dir>/srv/autobuild-ceph/gitbuilder.git/build/out~/ceph-0.68-223-g3e90c2a/src/./include</dir>
      <file>crc32c.h</file>
      <line>22</line>
    </frame>
...

  <kind>InvalidRead</kind>
  <what>Invalid read of size 8</what>
  <stack>
    <frame>
      <ip>0x91B969</ip>
      <obj>/usr/bin/ceph-osd</obj>
    </frame>
  </stack>
  <auxwhat>Address 0x13a6ccd8 is 472 bytes inside a block of size 473 alloc'd</auxwhat>
  <stack>
    <frame>
      <ip>0x4C2AC27</ip>
      <obj>/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so</obj>
      <fn>operator new[](unsigned long)</fn>
    </frame>
    <frame>
      <ip>0x872366</ip>
      <obj>/usr/bin/ceph-osd</obj>
      <fn>ceph::buffer::create(unsigned int)</fn>
      <dir>/srv/autobuild-ceph/gitbuilder.git/build/out~/ceph-0.68-223-g3e90c2a/src/common</dir>
      <file>buffer.cc</file>
      <line>196</line>
    </frame>
...

unfortunately there isn't enough context here to whitelist it... maybe bad debug info from yasm? :(

wip-intel-crc-workaround avoids the problem by doing the trailing bytes using the alternative code.