Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS #1163

Open
Tracked by #1161
stanislaw opened this issue Sep 22, 2021 · 2 comments
Open
Tracked by #1161

coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS #1163

stanislaw opened this issue Sep 22, 2021 · 2 comments
Labels
bug unit-test Tickets related to the OSAL unit testing (functional and/or coverage)

Comments

@stanislaw
Copy link
Contributor

stanislaw commented Sep 22, 2021 •
edited
Loading

Describe the bug

When the Address Sanitizer is enabled in macOS / clang, I get the following error in the OS_VxWorks_TimeBaseAPI_Impl_Init test. The reproducibility is 100%.

There are two more issues found using Address Sanitizer. I have linked them to this ticket in the form of a comment.

17/75 Test #17: coverage-vxworks-timebase .........Subprocess aborted***Exception:   0.32 sec

[BEGIN] UNIT TEST

[BEGIN] 01 SETUP
[  END] No test cases

[BEGIN] 01 OS_VxWorks_TimeBaseAPI_Impl_Init
=================================================================
==32782==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0001018062b8 at pc 0x000101860845 bp 0x7ffeee4446e0 sp 0x7ffeee443ea8
WRITE of size 480 at 0x0001018062b8 thread T0
    #0 0x101860844 in __asan_memset+0xf4 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x46844)
    #1 0x1017c238b in Osapi_Test_Setup+0x6b (coverage-vxworks-timebase-testrunner:x86_64+0x10000738b)
    #2 0x1017de8c7 in UtTest_Run+0x237 (coverage-vxworks-timebase-testrunner:x86_64+0x1000238c7)
    #3 0x1017d79a8 in OS_Application_Run+0x8 (coverage-vxworks-timebase-testrunner:x86_64+0x10001c9a8)
    #4 0x1017df318 in main+0x178 (coverage-vxworks-timebase-testrunner:x86_64+0x100024318)
    #5 0x7fff20404f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c)

0x0001018062b8 is located 40 bytes to the left of global variable 'OS_stub_timecb_table' defined in '/Users/stanislaw/workspace/projects/code/osal/src/unit-test-coverage/ut-stubs/src/osapi-shared-idmap-table-stubs.c:42:20' (0x1018062e0) of size 240
0x0001018062b8 is located 0 bytes to the right of global variable 'OS_stub_timebase_table' defined in '/Users/stanislaw/workspace/projects/code/osal/src/unit-test-coverage/ut-stubs/src/osapi-shared-idmap-table-stubs.c:41:20' (0x101806240) of size 120
SUMMARY: AddressSanitizer: global-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x46844) in __asan_memset+0xf4
Shadow bytes around the buggy address:
  0x100020300c00: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9
  0x100020300c10: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020300c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020300c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
  0x100020300c40: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
=>0x100020300c50: 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 00 00 00 00
  0x100020300c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020300c70: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x100020300c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020300c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020300ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==32782==ABORTING

To Reproduce

Enable Address Sanitizer in the root CMakeLists.txt.

add_compile_options("-fsanitize=address")
add_link_options("-fsanitize=address")

#add_compile_options("-fsanitize=thread")
#add_link_options("-fsanitize=thread")

#add_compile_options("-fsanitize=undefined")
#add_link_options("-fsanitize=undefined")

Run the tests, including the

Expected behavior

I suspect a memory management error that needs to be investigated. When the issue is fixed, the Address Sanitizer should report no issues.

Code

–

System observed on:

Additional context

–

Reporter Info

Stanislav Pankevich (Personal contribution)
@stanislaw stanislaw mentioned this issue Sep 22, 2021
Closed
5 tasks
@stanislaw stanislaw changed the title coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS (and 2 other potentials bugs) Sep 22, 2021
@stanislaw
Copy link
Contributor Author

Adding two more Address Sanitizer issues without opening more tickets for now:

69/75 Test #69: timer-test ........................Subprocess aborted***Exception:   0.36 sec

[BEGIN] UNIT TEST

[BEGIN] 01 SETUP
[  END] No test cases

[BEGIN] 01 TimerTest
[ PASS] 01.001 timer-test.c:97 - Timer Test Task Created RC=0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==9920==ERROR: AddressSanitizer: stack-overflow on address 0x70000e6810d8 (pc 0x0001061b2adc bp 0x70000e68ec70 sp 0x70000e6810e0 T2)
    #0 0x1061b2adc in __lsan::DisableInThisThread()+0x1c (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x73adc)
    #1 0x1061815db in wrap_pthread_create+0xab (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x425db)
    #2 0x1060e974f in OS_Posix_InternalTaskCreate_Impl+0x46f (timer-test:x86_64+0x10002d74f)
    #3 0x1060eb861 in OS_TimeBaseCreate_Impl+0x281 (timer-test:x86_64+0x10002f861)
    #4 0x1060dd9f4 in OS_TimeBaseCreate+0x4a4 (timer-test:x86_64+0x1000219f4)
    #5 0x1060e0a8c in OS_TimerCreate+0x2ac (timer-test:x86_64+0x100024a8c)
    #6 0x1060bf4f6 in TimerTestTask+0x266 (timer-test:x86_64+0x1000034f6)
    #7 0x1060db81a in OS_TaskEntryPoint+0x14a (timer-test:x86_64+0x10001f81a)
    #8 0x1060ea096 in OS_PthreadTaskEntry+0x176 (timer-test:x86_64+0x10002e096)
    #9 0x7fff203e98fb in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x68fb)
    #10 0x7fff203e5442 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x2442)

SUMMARY: AddressSanitizer: stack-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x73adc) in __lsan::DisableInThisThread()+0x1c
Thread T2 created by T0 here:
    #0 0x10618158a in wrap_pthread_create+0x5a (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4258a)
    #1 0x1060e974f in OS_Posix_InternalTaskCreate_Impl+0x46f (timer-test:x86_64+0x10002d74f)
    #2 0x1060e9d8c in OS_TaskCreate_Impl+0x2ec (timer-test:x86_64+0x10002dd8c)
    #3 0x1060dc26f in OS_TaskCreate+0x4df (timer-test:x86_64+0x10002026f)
    #4 0x1060bf1c3 in TimerTestSetup+0x123 (timer-test:x86_64+0x1000031c3)
    #5 0x1060c53e7 in UtTest_Run+0x237 (timer-test:x86_64+0x1000093e7)
    #6 0x1060c3828 in OS_Application_Run+0x8 (timer-test:x86_64+0x100007828)
    #7 0x1060fe9d8 in main+0x178 (timer-test:x86_64+0x1000429d8)
    #8 0x7fff20404f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c)

==9920==ABORTING

62/75 Test #62: queue-test ........................Subprocess aborted***Exception:  11.40 sec

[BEGIN] UNIT TEST

[BEGIN] 01 SETUP
[  END] No test cases

[BEGIN] 01 QueueTimeoutTest
[ PASS] 01.001 queue-test.c:147 - MsgQ create Id=20001 Rc=0
[ PASS] 01.002 queue-test.c:154 - Task 1 create Id=10001 Rc=0
Starting task 1
Delay for 1 second before starting
[ PASS] 01.003 queue-test.c:160 - Timer 1 create Id=90001 Rc=0
[ INFO] queue-test.c:161:Timer Accuracy = 10000 microseconds
[ PASS] 01.004 queue-test.c:167 - Timer 1 set Rc=0
TASK 1: Timeout on Queue! Timer counter = 20
TASK 1: Timeout on Queue! Timer counter = 30
TASK 1: Timeout on Queue! Timer counter = 40
TASK 1: Timeout on Queue! Timer counter = 50
TASK 1: Timeout on Queue! Timer counter = 60
TASK 1: Timeout on Queue! Timer counter = 70
TASK 1: Timeout on Queue! Timer counter = 80
TASK 1: Timeout on Queue! Timer counter = 90
[ PASS] 01.005 queue-test.c:113 - Timer delete Rc=0
[ PASS] 01.006 queue-test.c:115 - Task 1 delete Rc=0
[ PASS] 01.007 queue-test.c:117 - Queue 1 delete Rc=0
[ PASS] 01.008 queue-test.c:120 - Task 1 failures = 0
[ PASS] 01.009 queue-test.c:126 - Task 1 messages = 0
[ PASS] 01.010 queue-test.c:130 - Task 1 timeouts 8 <= 10
[ PASS] 01.011 queue-test.c:134 - Task 1 timeouts 8 >= 6
[  END] 01 QueueTimeoutTest     TOTAL::11    PASS::11    FAIL::0     MIR::0     TSF::0     TTF::0     WARN::0

[BEGIN] 02 QueueMessageCheck
[ PASS] 02.001 queue-test.c:207 - MsgQ create Id=20002 Rc=0
[ PASS] 02.002 queue-test.c:214 - Task 1 create Id=10002 Rc=0
Starting task 1
Delay for 1 second before starting
[ PASS] 02.003 queue-test.c:220 - Timer 1 create Id=90002 Rc=0
[ INFO] queue-test.c:221:Timer Accuracy = 10000 microseconds
[ PASS] 02.004 queue-test.c:227 - Timer 1 set Rc=0
[ PASS] 02.005 queue-test.c:240 - OS Queue Put Rc=0
[ PASS] 02.006 queue-test.c:240 - OS Queue Put Rc=0
[ PASS] 02.007 queue-test.c:240 - OS Queue Put Rc=0
[ PASS] 02.008 queue-test.c:240 - OS Queue Put Rc=0
[ PASS] 02.009 queue-test.c:240 - OS Queue Put Rc=0
[ PASS] 02.010 queue-test.c:240 - OS Queue Put Rc=0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==9911==ERROR: AddressSanitizer: stack-overflow on address 0x700004583e38 (pc 0x00010c79cc70 bp 0x700004584680 sp 0x700004583e40 T6)
    #0 0x10c79cc70 in wrap_memmove+0xc0 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1cc70)
    #1 0x7fff202fa098 in __sfvwrite+0x15a (libsystem_c.dylib:x86_64+0x3c098)
    #2 0x7fff20302e2b in __vfprintf+0x2d69 (libsystem_c.dylib:x86_64+0x44e2b)
    #3 0x7fff20327964 in __v2printf+0x1d4 (libsystem_c.dylib:x86_64+0x69964)
    #4 0x7fff2030da34 in _vsnprintf+0x19a (libsystem_c.dylib:x86_64+0x4fa34)
    #5 0x7fff2030dadb in vsnprintf+0x43 (libsystem_c.dylib:x86_64+0x4fadb)
    #6 0x10c7a3a7a in wrap_vsnprintf+0xaa (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x23a7a)
    #7 0x10c7a44c5 in wrap_snprintf+0xa5 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x244c5)
    #8 0x10c700699 in UtAssert_DoReport+0x2b9 (queue-test:x86_64+0x100005699)
    #9 0x10c701615 in UtAssertEx+0x3a5 (queue-test:x86_64+0x100006615)
    #10 0x10c6fe530 in task_1+0x350 (queue-test:x86_64+0x100003530)
    #11 0x10c71b42a in OS_TaskEntryPoint+0x14a (queue-test:x86_64+0x10002042a)
    #12 0x10c729ca6 in OS_PthreadTaskEntry+0x176 (queue-test:x86_64+0x10002eca6)
    #13 0x7fff203e98fb in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x68fb)
    #14 0x7fff203e5442 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x2442)

SUMMARY: AddressSanitizer: stack-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1cc70) in wrap_memmove+0xc0
Thread T6 created by T0 here:
    #0 0x10c7c258a in wrap_pthread_create+0x5a (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4258a)
    #1 0x10c72935f in OS_Posix_InternalTaskCreate_Impl+0x46f (queue-test:x86_64+0x10002e35f)
    #2 0x10c72999c in OS_TaskCreate_Impl+0x2ec (queue-test:x86_64+0x10002e99c)
    #3 0x10c71be7f in OS_TaskCreate+0x4df (queue-test:x86_64+0x100020e7f)
    #4 0x10c6ffe6b in QueueMessageSetup+0x3ab (queue-test:x86_64+0x100004e6b)
    #5 0x10c7050e7 in UtTest_Run+0x237 (queue-test:x86_64+0x10000a0e7)
    #6 0x10c703528 in OS_Application_Run+0x8 (queue-test:x86_64+0x100008528)
    #7 0x10c73d9b8 in main+0x178 (queue-test:x86_64+0x1000429b8)
    #8 0x7fff20404f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c)

==9911==ABORTING

@stanislaw stanislaw changed the title coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS (and 2 other potentials bugs) coverage-vxworks-timebase: potential bug in the test implementation reported by Clang Address Sanitizer on macOS Sep 22, 2021
@skliper skliper added bug unit-test Tickets related to the OSAL unit testing (functional and/or coverage) labels Sep 22, 2021
@skliper
Copy link
Contributor

skliper commented Sep 22, 2021

Thanks for the report! Running the code through an address sanitizer has been a recent topic... it'd be nice to get it in CI at some point and/or at least have a triggerable workflow.

jphickey pushed a commit to jphickey/osal that referenced this issue Aug 10, 2022
@astrogeco
Merge pull request nasa#1163 from skliper/fix1162-add_codeql
bd54771 
Fix nasa#1162, Add CodeQL analysis to workflow
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug unit-test Tickets related to the OSAL unit testing (functional and/or coverage)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@stanislaw @skliper