Unit tests - current failures

assigned to @sblin and @ffauteux-chapleau

changed the description

=================================================================
==626048==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f1289beef00 at pc 0x0000014a0996 bp 0x7f1289bedfd0 sp 0x7f1289bedfc8
READ of size 8 at 0x7f1289beef00 thread T1077
[1715350521.610|36225] NAT-PMP: Renewal request for mapping JAMI-TCP:10414 on 192.168.0.1 succeeded
[1715350521.610|36225] Mapping JAMI-UDP:24540 (on IGD 192.168.0.1 [NAT-PMP]) successfully performed
    #0 0x14a0995 in dht::net::UdpSocket::openSockets(dht::SockAddr const&, dht::SockAddr const&)::{lambda()#1}::operator()() (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x14a0995) (BuildId: d5c112d84f479b1753871931b2bacb795662530d)
    #1 0x7f12bfae6593 in execute_native_thread_routine (/lib64/libstdc++.so.6+0xe6593) (BuildId: 0d19f6c805b24e0163b51491ffe60ca28abb01c6)
    #2 0x7f12c145db45 in asan_thread_start(void*) (/lib64/libasan.so.8+0x5db45) (BuildId: 9398d675390359c74744b0e7714408910d853874)
    #3 0x7f12bf8a91b6 in start_thread (/lib64/libc.so.6+0x961b6) (BuildId: b098f1c75a76548bb230d8f551eae07a2aeccf06)
    #4 0x7f12bf92b39b in clone3 (/lib64/libc.so.6+0x11839b) (BuildId: b098f1c75a76548bb230d8f551eae07a2aeccf06)

Address 0x7f1289beef00 is located in stack of thread T1077 at offset 3680 in frame
    #0 0x149bc8f in dht::net::UdpSocket::openSockets(dht::SockAddr const&, dht::SockAddr const&)::{lambda()#1}::operator()() (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x149bc8f) (BuildId: d5c112d84f479b1753871931b2bacb795662530d)

  This frame has 115 object(s):
    [48, 49) '<unknown>'
    [64, 65) '<unknown>'
    [80, 81) '<unknown>'
    [96, 97) '<unknown>'
    [112, 113) '<unknown>'
    [128, 129) '<unknown>'
    [144, 145) '<unknown>'
    [160, 161) '<unknown>'
    [176, 177) '<unknown>'
    [192, 193) '<unknown>'
    [208, 212) 'from_len' (line 265)
    [224, 228) '__args#0'
    [240, 244) '__args#0'
    [256, 264) '<unknown>'
    [288, 296) '<unknown>'
    [320, 328) '<unknown>'
    [352, 360) '<unknown>'
    [384, 392) '<unknown>'
    [416, 424) '<unknown>'
    [448, 456) '<unknown>'
    [480, 488) '<unknown>'
    [512, 520) '<unknown>'
    [544, 552) '<unknown>'
    [576, 584) '__dnew'
    [608, 616) '__guard'
    [640, 648) '__s'
    [672, 680) '__ns'
    [704, 712) '<unknown>'
    [736, 744) '<unknown>'
    [768, 776) '<unknown>'
    [800, 808) '<unknown>'
    [832, 840) '<unknown>'
    [864, 872) '<unknown>'
    [896, 904) '<unknown>'
    [928, 936) '<unknown>'
    [960, 968) '__tmp'
    [992, 1000) 'begIt'
    [1024, 1032) 'begItNext'
    [1056, 1064) '<unknown>'
    [1088, 1096) '<unknown>'
    [1120, 1128) '<unknown>'
    [1152, 1160) '<unknown>'
    [1184, 1192) '<unknown>'
    [1216, 1224) '<unknown>'
    [1248, 1256) '<unknown>'
    [1280, 1288) '<unknown>'
    [1312, 1320) '__beyond'
    [1344, 1352) '<unknown>'
    [1376, 1384) '<unknown>'
    [1408, 1416) '<unknown>'
    [1440, 1448) '<unknown>'
    [1472, 1480) '<unknown>'
    [1504, 1512) '<unknown>'
    [1536, 1544) '<unknown>'
    [1568, 1576) '<unknown>'
    [1600, 1608) '<unknown>'
    [1632, 1640) '<unknown>'
    [1664, 1672) '<unknown>'
    [1696, 1704) '<unknown>'
    [1728, 1736) '<unknown>'
    [1760, 1768) '<unknown>'
    [1792, 1800) '<unknown>'
    [1824, 1832) '<unknown>'
    [1856, 1864) '<unknown>'
    [1888, 1896) '<unknown>'
    [1920, 1928) '<unknown>'
    [1952, 1960) '<unknown>'
    [1984, 1992) '<unknown>'
    [2016, 2024) '<unknown>'
    [2048, 2056) '<unknown>'
    [2080, 2088) 'lk'
    [2112, 2120) '<unknown>'
    [2144, 2152) '<unknown>'
    [2176, 2184) '<unknown>'
    [2208, 2216) '<unknown>'
    [2240, 2248) '<unknown>'
    [2272, 2280) '<unknown>'
    [2304, 2312) '__dnew'
    [2336, 2344) '__guard'
    [2368, 2380) '<unknown>'
    [2400, 2412) '<unknown>'
    [2432, 2448) '<unknown>'
    [2464, 2480) '<unknown>'
    [2496, 2512) '<unknown>'
    [2528, 2544) '<unknown>'
    [2560, 2576) 'lk' (line 294)
    [2592, 2608) '<unknown>'
    [2624, 2640) '<unknown>'
    [2656, 2672) '<unknown>'
    [2688, 2704) 'lk' (line 339)
    [2720, 2736) '<unknown>'
    [2752, 2768) '<unknown>'
    [2784, 2800) '<unknown>'
    [2816, 2832) '<unknown>'
    [2848, 2864) '<unknown>'
    [2880, 2896) '<unknown>'
    [2912, 2928) '<unknown>'
    [2944, 2960) '__ts'
    [2976, 2992) '__guard'
    [3008, 3024) '<unknown>'
    [3040, 3056) '<unknown>'
    [3072, 3088) '<unknown>'
    [3104, 3120) '<unknown>'
    [3136, 3152) '<unknown>'
    [3168, 3192) 'pkts' (line 282)
    [3232, 3256) 'r'
    [3296, 3328) '<unknown>'
    [3360, 3392) '<unknown>'
    [3424, 3456) '<unknown>'
    [3488, 3520) '<unknown>'
    [3552, 3680) 'readfds' (line 241) <== Memory access at offset 3680 overflows this variable
    [3712, 3840) 'from' (line 264)
    [3872, 4408) 'buf'
    [4544, 5080) 'buf'
    [5216, 70752) 'buf' (line 263)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T1077 created by T2 here:
    #0 0x7f12c14ee7d1 in pthread_create (/lib64/libasan.so.8+0xee7d1) (BuildId: 9398d675390359c74744b0e7714408910d853874)
    #1 0x7f12bfae6668 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib64/libstdc++.so.6+0xe6668) (BuildId: 0d19f6c805b24e0163b51491ffe60ca28abb01c6)

Thread T2 created by T0 here:
    #0 0x7f12c14ee7d1 in pthread_create (/lib64/libasan.so.8+0xee7d1) (BuildId: 9398d675390359c74744b0e7714408910d853874)
    #1 0x7f12bfae6668 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib64/libstdc++.so.6+0xe6668) (BuildId: 0d19f6c805b24e0163b51491ffe60ca28abb01c6)
    #2 0x772e64 in jami::ScheduledExecutor::ScheduledExecutor(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/amarok/Projects/jami-client-qt/daemon/src/scheduled_executor.cpp:30
    #3 0x649cff in jami::Manager::ManagerPimpl::ManagerPimpl(jami::Manager&) /home/amarok/Projects/jami-client-qt/daemon/src/manager.cpp:456
    #4 0x696ee8 in std::__detail::_MakeUniq<jami::Manager::ManagerPimpl>::__single_object std::make_unique<jami::Manager::ManagerPimpl, jami::Manager&>(jami::Manager&) (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x696ee8) (BuildId: d5c112d84f479b1753871931b2bacb795662530d)
    #5 0x64dd03 in jami::Manager::Manager() /home/amarok/Projects/jami-client-qt/daemon/src/manager.cpp:756
    #6 0x64db45 in jami::Manager::instance() /home/amarok/Projects/jami-client-qt/daemon/src/manager.cpp:729
    #7 0x76f953 in libjami::init(libjami::InitFlag) /home/amarok/Projects/jami-client-qt/daemon/src/ring_api.cpp:69
    #8 0x4fd7a0 in jami::test::ConversationTest::setUp() conversation/conversation.cpp:222
    #9 0x619dd1 in CppUnit::TestCaller<jami::test::ConversationTest>::setUp() (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x619dd1) (BuildId: d5c112d84f479b1753871931b2bacb795662530d)
    #10 0x7f12c1b78b95 in CppUnit::TestCaseMethodFunctor::operator()() const (/lib64/libcppunit-1.15.so.1+0x19b95) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #11 0x7f12c1b83f73 in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (/lib64/libcppunit-1.15.so.1+0x24f73) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #12 0x7f12c1b7a79a in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (/lib64/libcppunit-1.15.so.1+0x1b79a) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #13 0x7f12c1b85dd0 in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/lib64/libcppunit-1.15.so.1+0x26dd0) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #14 0x7f12c1b7fa23 in CppUnit::TestCase::run(CppUnit::TestResult*) (/lib64/libcppunit-1.15.so.1+0x20a23) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #15 0x7f12c1b843be in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (/lib64/libcppunit-1.15.so.1+0x253be) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #16 0x7f12c1b841cb in CppUnit::TestComposite::run(CppUnit::TestResult*) (/lib64/libcppunit-1.15.so.1+0x251cb) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #17 0x7f12c1b843be in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (/lib64/libcppunit-1.15.so.1+0x253be) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #18 0x7f12c1b841cb in CppUnit::TestComposite::run(CppUnit::TestResult*) (/lib64/libcppunit-1.15.so.1+0x251cb) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #19 0x7f12c1b84d96 in CppUnit::TestResult::runTest(CppUnit::Test*) (/lib64/libcppunit-1.15.so.1+0x25d96) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #20 0x7f12c1b8a0b5 in CppUnit::TestRunner::run(CppUnit::TestResult&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/lib64/libcppunit-1.15.so.1+0x2b0b5) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #21 0x7f12c1b8d0a5 in CppUnit::TextTestRunner::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool, bool, bool) (/lib64/libcppunit-1.15.so.1+0x2e0a5) (BuildId: 6106167c8b6ecd908512a104683034d5e661d7fb)
    #22 0x593fe5 in main conversation/conversation.cpp:2409
    #23 0x7f12bf83d087 in __libc_start_call_main (/lib64/libc.so.6+0x2a087) (BuildId: b098f1c75a76548bb230d8f551eae07a2aeccf06)
    #24 0x7f12bf83d14a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x2a14a) (BuildId: b098f1c75a76548bb230d8f551eae07a2aeccf06)
    #25 0x4eb224 in _start (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x4eb224) (BuildId: d5c112d84f479b1753871931b2bacb795662530d)

SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/amarok/Projects/jami-client-qt/daemon/test/unitTest/ut_conversation+0x14a0995) (BuildId: d5c112d84f479b1753871931b2bacb795662530d) in dht::net::UdpSocket::openSockets(dht::SockAddr const&, dht::SockAddr const&)::{lambda()#1}::operator()()
Shadow bytes around the buggy address:
  0x7f1289beec80: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2
  0x7f1289beed00: 00 00 00 f2 f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f2
  0x7f1289beed80: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2
  0x7f1289beee00: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2
  0x7f1289beee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7f1289beef00:[f2]f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f1289beef80: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
  0x7f1289bef000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f1289bef080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f1289bef100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f1289bef180: 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==626048==ABORTING

I think the buffer overflows are due to the fact that we call FD_SET (in network_utils.cpp at lines 244-248) with file descriptors that are above the maximum limit of FD_SETSIZE (= 1024). This would also explain why the error only occurs after we've run several tests.

Thread 922 "ut_conversation" hit Breakpoint 3, operator() (__closure=0x7fffc40a2b08) at /home/fsimon/jami-client-qt/daemon/contrib/native-x86_64-linux-gnu/opendht/src/network_utils.cpp:243
243	                FD_ZERO(&readfds);
(gdb) p ls4
$1 = 1027
(gdb) p ls6
$2 = 1028
(gdb) p stop_readfd
$3 = 1024
(gdb) c
Continuing.
F[1715625199.280|2066|common.cpp              :112 ] Removing 3 accounts...
[...]
[1715625199.281|3272|jamiaccount.cpp         :2353] [Account 2cbb79c125568374] dht shutdown complete
*** buffer overflow detected ***: terminated
[Thread 0x7ffe0f7fe640 (LWP 265416) exited]
[New Thread 0x7ffe34ff9640 (LWP 265467)]
[New Thread 0x7ffe0f7fe640 (LWP 265468)]

Thread 922 "ut_conversation" received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140735877740096) at ./nptl/pthread_kill.c:44
44	./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140735877740096) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140735877740096) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140735877740096, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff6a42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff6a287f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff6a89676 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff6bdb92e "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:155
#6  0x00007ffff6b3659a in __GI___fortify_fail (msg=msg@entry=0x7ffff6bdb8d4 "buffer overflow detected") at ./debug/fortify_fail.c:26
#7  0x00007ffff6b34f16 in __GI___chk_fail () at ./debug/chk_fail.c:28
#8  0x00007ffff6b364db in __fdelt_chk (d=<optimized out>) at ./debug/fdelt_chk.c:25
#9  0x0000555555eb3415 in operator()() (__closure=0x7fffc40a2b08) at /home/fsimon/jami-client-qt/daemon/contrib/native-x86_64-linux-gnu/opendht/src/network_utils.cpp:244
#10 0x00007ffff7cdc253 in std::execute_native_thread_routine(void*) (__p=0x7fffc40a2b00) at ../../../../../src/libstdc++-v3/src/c++11/thread.cc:82
#11 0x00007ffff6a94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#12 0x00007ffff6b26850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
(gdb) frame 9
#9  0x0000555555eb3415 in operator() (__closure=0x7fffc40a2b08) at /home/fsimon/jami-client-qt/daemon/contrib/native-x86_64-linux-gnu/opendht/src/network_utils.cpp:244
244	                FD_SET(stop_readfd, &readfds);
(gdb) p stop_readfd
$4 = 1024

changed the description

mentioned in commit 69102c7a

changed the description

mentioned in commit 65624e1e

changed the description

mentioned in commit e2107772

added SprintTo review label

mentioned in commit 314d3df0

mentioned in commit 3dc8883c

removed SprintTo review label

closed

Unit tests - current failures

ut_conversation

Buffer overflow

Deadlock

ut_conversation_call

ut_conversationMemberEvents

Weird log

Designs

Child items ...

Activity