==34130==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000143190 at pc 0x0001001a3c1d bp 0x000108a450b0 sp 0x000108a450a8
WRITE of size 8 at 0x619000143190 thread T2
#0 0x1001a3c1c in Http1Transaction::reset() Http1Transaction.cc:36
#1 0x1001a0b61 in Http1ClientSession::release(ProxyTransaction*) Http1ClientSession.cc:424
#2 0x1001a1c6c in Http1ClientSession::start() Http1ClientSession.cc:508
#3 0x1009688ec in ProxySession::handle_api_return(int) ProxySession.cc:165
#4 0x100968f4a in ProxySession::do_api_callout(TSHttpHookID) ProxySession.cc:146
#5 0x10019c9f5 in Http1ClientSession::new_connection(NetVConnection*, MIOBuffer*, IOBufferReader*) Http1ClientSession.cc:201
#6 0x100171a01 in HttpSessionAccept::accept(NetVConnection*, MIOBuffer*, IOBufferReader*) HttpSessionAccept.cc:59
#7 0x10017218b in HttpSessionAccept::mainEvent(int, void*) HttpSessionAccept.cc:75
#8 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#9 0x100a194db in send_plugin_event(Continuation*, int, void*) SSLNextProtocolAccept.cc:33
#10 0x100a19189 in SSLNextProtocolTrampoline::ioCompletionEvent(int, void*) SSLNextProtocolAccept.cc:110
#11 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#12 0x100aed5a2 in read_signal_and_update(int, UnixNetVConnection*) UnixNetVConnection.cc:83
#13 0x100aed3ba in read_signal_done(int, NetHandler*, UnixNetVConnection*) UnixNetVConnection.cc:150
#14 0x100aed332 in UnixNetVConnection::readSignalDone(int, NetHandler*) UnixNetVConnection.cc:1037
#15 0x1009f83ba in SSLNetVConnection::net_read_io(NetHandler*, EThread*) SSLNetVConnection.cc:655
#16 0x100abda13 in NetHandler::process_ready_list() UnixNet.cc:415
#17 0x100abf12e in NetHandler::waitForActivity(long long) UnixNet.cc:546
#18 0x100b7ea64 in EThread::execute_regular() UnixEThread.cc:303
#19 0x100b7fb87 in EThread::execute() UnixEThread.cc:364
#20 0x100b7a9b6 in spawn_thread_internal(void*) Thread.cc:92
#21 0x7fff206108fb in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x68fb)
#22 0x7fff2060c442 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x2442)
0x619000143190 is located 1040 bytes inside of 1072-byte region [0x619000142d80,0x6190001431b0)
freed by thread T2 here:
#0 0x102fa1969 in wrap_free+0xa9 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x45969)
#1 0x10265667d in ats_memalign_free ink_memory.cc:138
#2 0x10268ac83 in jearena::JemallocNodumpAllocator::deallocate(_InkFreeList*, void*) JeAllocator.cc:139
#3 0x10265c8dc in malloc_free(_InkFreeList*, void*) ink_queue.cc:331
#4 0x102658855 in ink_freelist_free ink_queue.cc:281
#5 0x10000502c in Allocator::free_void(void*) Allocator.h:74
#6 0x10019b6ab in Http1ClientSession::free() Http1ClientSession.cc:123
#7 0x100968964 in ProxySession::handle_api_return(int) ProxySession.cc:169
#8 0x100968f4a in ProxySession::do_api_callout(TSHttpHookID) ProxySession.cc:146
#9 0x10019ac2f in Http1ClientSession::destroy() Http1ClientSession.cc:76
#10 0x10019e2b8 in Http1ClientSession::do_io_close(int) Http1ClientSession.cc:266
#11 0x10019f8ec in Http1ClientSession::state_keep_alive(int, void*) Http1ClientSession.cc:377
#12 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#13 0x100aed5a2 in read_signal_and_update(int, UnixNetVConnection*) UnixNetVConnection.cc:83
#14 0x100aefdea in UnixNetVConnection::mainEvent(int, Event*) UnixNetVConnection.cc:1171
#15 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#16 0x100a12a42 in UnixNetVConnection::callback(int, void*) P_UnixNetVConnection.h:232
#17 0x100ac1902 in NetHandler::_close_ne(NetEvent*, long long, int&, int&, int&, int&) UnixNet.cc:692
#18 0x100ac25f1 in NetHandler::manage_keep_alive_queue() UnixNet.cc:648
#19 0x100ac2fa7 in NetHandler::add_to_keep_alive_queue(NetEvent*) UnixNet.cc:720
#20 0x100af444f in UnixNetVConnection::add_to_keep_alive_queue() UnixNetVConnection.cc:1454
#21 0x1001a0b55 in Http1ClientSession::release(ProxyTransaction*) Http1ClientSession.cc:422
#22 0x1001a1c6c in Http1ClientSession::start() Http1ClientSession.cc:508
#23 0x1009688ec in ProxySession::handle_api_return(int) ProxySession.cc:165
#24 0x100968f4a in ProxySession::do_api_callout(TSHttpHookID) ProxySession.cc:146
#25 0x10019c9f5 in Http1ClientSession::new_connection(NetVConnection*, MIOBuffer*, IOBufferReader*) Http1ClientSession.cc:201
#26 0x100171a01 in HttpSessionAccept::accept(NetVConnection*, MIOBuffer*, IOBufferReader*) HttpSessionAccept.cc:59
#27 0x10017218b in HttpSessionAccept::mainEvent(int, void*) HttpSessionAccept.cc:75
#28 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#29 0x100a194db in send_plugin_event(Continuation*, int, void*) SSLNextProtocolAccept.cc:33
previously allocated by thread T2 here:
#0 0x102fa1f33 in wrap_posix_memalign+0xb3 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x45f33)
#1 0x10265642e in ats_memalign ink_memory.cc:102
#2 0x10268ab6d in jearena::JemallocNodumpAllocator::allocate(_InkFreeList*) JeAllocator.cc:118
#3 0x10265c7ec in malloc_new(_InkFreeList*) ink_queue.cc:268
#4 0x102658687 in ink_freelist_new ink_queue.cc:187
#5 0x1001724e4 in Http1ClientSession* ClassAllocator<Http1ClientSession, true>::alloc<>() Allocator.h:142
#6 0x100172001 in ClassAllocator<Http1ClientSession, true>::Value_type* thread_alloc<ClassAllocator<Http1ClientSession, true> >(ClassAllocator<Http1ClientSession, true>&, ProxyAllocator&) I_ProxyAllocator.h:62
#7 0x1001718a7 in HttpSessionAccept::accept(NetVConnection*, MIOBuffer*, IOBufferReader*) HttpSessionAccept.cc:52
#8 0x10017218b in HttpSessionAccept::mainEvent(int, void*) HttpSessionAccept.cc:75
#9 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#10 0x100a194db in send_plugin_event(Continuation*, int, void*) SSLNextProtocolAccept.cc:33
#11 0x100a19189 in SSLNextProtocolTrampoline::ioCompletionEvent(int, void*) SSLNextProtocolAccept.cc:110
#12 0x100009704 in Continuation::handleEvent(int, void*) I_Continuation.h:219
#13 0x100aed5a2 in read_signal_and_update(int, UnixNetVConnection*) UnixNetVConnection.cc:83
#14 0x100aed3ba in read_signal_done(int, NetHandler*, UnixNetVConnection*) UnixNetVConnection.cc:150
#15 0x100aed332 in UnixNetVConnection::readSignalDone(int, NetHandler*) UnixNetVConnection.cc:1037
#16 0x1009f83ba in SSLNetVConnection::net_read_io(NetHandler*, EThread*) SSLNetVConnection.cc:655
#17 0x100abda13 in NetHandler::process_ready_list() UnixNet.cc:415
#18 0x100abf12e in NetHandler::waitForActivity(long long) UnixNet.cc:546
#19 0x100b7ea64 in EThread::execute_regular() UnixEThread.cc:303
#20 0x100b7fb87 in EThread::execute() UnixEThread.cc:364
#21 0x100b7a9b6 in spawn_thread_internal(void*) Thread.cc:92
#22 0x7fff206108fb in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x68fb)
#23 0x7fff2060c442 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x2442)
Thread T2 created by T0 here:
#0 0x102f9b97c in wrap_pthread_create+0x5c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x3f97c)
#1 0x100b7a72d in ink_thread_create(_opaque_pthread_t**, void* (*)(void*), void*, int, unsigned long, void*) ink_thread.h:159
#2 0x100b7a4f3 in Thread::start(char const*, void*, unsigned long, std::__1::function<void ()> const&) Thread.cc:109
#3 0x100b84264 in EventProcessor::spawn_event_threads(int, int, unsigned long) UnixEventProcessor.cc:392
#4 0x100b853b5 in EventProcessor::start(int, unsigned long) UnixEventProcessor.cc:455
#5 0x1000f5ee9 in main traffic_server.cc:2033
#6 0x7fff2062bf5c in start+0x0 (libdyld.dylib:x86_64+0x15f5c)
SUMMARY: AddressSanitizer: heap-use-after-free Http1Transaction.cc:36 in Http1Transaction::reset()
Shadow bytes around the buggy address:
0x1c32000285e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c32000285f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200028600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200028610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x1c3200028620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c3200028630: fd fd[fd]fd fd fd fa fa fa fa fa fa fa fa fa fa
0x1c3200028640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c3200028650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c3200028660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c3200028670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c3200028680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
CONFIG proxy.config.exec_thread.autoconfig INT 0
CONFIG proxy.config.exec_thread.limit INT 2
CONFIG proxy.config.net.max_connections_in INT 2
h2load --h1 -n 160 -m 1 -c 32 -t 16 https://127.0.0.1:4443/
When I was testing the
proxy.config.net.max_connections_inconfig, I got heap-use-after-free on the ASan build of current mater (050b2df).ASan report
ATS
records.config
client