Actions
Bug #9137
open
PA
OD
tm-threads: use-after-free in TmThreadsTimeSubsysIsReady
Bug #9137:
tm-threads: use-after-free in TmThreadsTimeSubsysIsReady
Affected Versions:
Effort:
Difficulty:
Label:
Description
==3206291==ERROR: AddressSanitizer: heap-use-after-free on address 0x51d005cf1290 at pc 0x64cf5d0cea8c bp 0x7000c55fc930 sp 0x7000c55fc928
READ of size 4 at 0x51d005cf1290 thread T29 (FM#01)
#0 0x64cf5d0cea8b in TmThreadsTimeSubsysIsReady /tmp/.git_build_suri/suricata/src/tm-threads.c:2308:16
#1 0x64cf5d13c03f in TimeModeIsReady /tmp/.git_build_suri/suricata/src/util-time.c:97:12
#2 0x64cf5d3ceae4 in FlowManager /tmp/.git_build_suri/suricata/src/flow-manager.c:851:13
#3 0x64cf5d0d18ef in TmThreadsManagement /tmp/.git_build_suri/suricata/src/tm-threads.c:573:9
#4 0x64cf5d072a8c in asan_thread_start(void*) asan_interceptors.cpp.o
#5 0x70012529caa3 in start_thread nptl/pthread_create.c:447:8
#6 0x700125329c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
0x51d005cf1290 is located 16 bytes inside of 2048-byte region [0x51d005cf1280,0x51d005cf1a80)
freed by thread T0 (Suricata-Main) here:
#0 0x64cf5d0753c0 in realloc (/opt/gitrun/suri/bin/suricata+0x33f3c0) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
#1 0x64cf5d108c99 in SCReallocFunc /tmp/.git_build_suri/suricata/src/util-mem.c:46:20
#2 0x64cf5d0c8b2c in TmThreadsRegisterThread /tmp/.git_build_suri/suricata/src/tm-threads.c:2221:20
#3 0x64cf5d0c8e9f in TmThreadCreateMgmtThread /tmp/.git_build_suri/suricata/src/tm-threads.c:1104:18
#4 0x64cf5d6b51c3 in LogMaintenanceThreadSpawn /tmp/.git_build_suri/suricata/src/log-maintenance.c:118:13
#5 0x64cf5d446c95 in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:454:9
#6 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
#7 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
#8 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
previously allocated by thread T0 (Suricata-Main) here:
#0 0x64cf5d07518d in calloc (/opt/gitrun/suri/bin/suricata+0x33f18d) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
#1 0x64cf5d108e39 in SCCallocFunc /tmp/.git_build_suri/suricata/src/util-mem.c:60:20
#2 0x64cf5d0c88ad in TmThreadsRegisterThread /tmp/.git_build_suri/suricata/src/tm-threads.c:2198:32
#3 0x64cf5d0c87a0 in TmThreadCreatePacketHandler /tmp/.git_build_suri/suricata/src/tm-threads.c:1077:18
#4 0x64cf5d720f2b in RunModeFilePcapAutoFp /tmp/.git_build_suri/suricata/src/runmode-pcap-file.c:163:9
#5 0x64cf5d446c4b in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:438:5
#6 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
#7 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
#8 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
Thread T29 (FM#01) created by T0 (Suricata-Main) here:
#0 0x64cf5d05a915 in pthread_create (/opt/gitrun/suri/bin/suricata+0x324915) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
#1 0x64cf5d0cc4a2 in TmThreadSpawn /tmp/.git_build_suri/suricata/src/tm-threads.c:1723:14
#2 0x64cf5d3cce1c in FlowManagerThreadSpawn /tmp/.git_build_suri/suricata/src/flow-manager.c:1036:13
#3 0x64cf5d446c73 in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:448:9
#4 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
#5 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
#6 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#7 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#8 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
Race condition as TmThreadsTimeSubsysIsReady is missing SCMutexLock(&thread_store_lock);
No data to display
Actions