Project

General

Profile

Actions

Bug #9137

open
PA OD

tm-threads: use-after-free in TmThreadsTimeSubsysIsReady

Bug #9137: tm-threads: use-after-free in TmThreadsTimeSubsysIsReady

Added by Philippe Antoine 6 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

==3206291==ERROR: AddressSanitizer: heap-use-after-free on address 0x51d005cf1290 at pc 0x64cf5d0cea8c bp 0x7000c55fc930 sp 0x7000c55fc928
READ of size 4 at 0x51d005cf1290 thread T29 (FM#01)
    #0 0x64cf5d0cea8b in TmThreadsTimeSubsysIsReady /tmp/.git_build_suri/suricata/src/tm-threads.c:2308:16
    #1 0x64cf5d13c03f in TimeModeIsReady /tmp/.git_build_suri/suricata/src/util-time.c:97:12
    #2 0x64cf5d3ceae4 in FlowManager /tmp/.git_build_suri/suricata/src/flow-manager.c:851:13
    #3 0x64cf5d0d18ef in TmThreadsManagement /tmp/.git_build_suri/suricata/src/tm-threads.c:573:9
    #4 0x64cf5d072a8c in asan_thread_start(void*) asan_interceptors.cpp.o
    #5 0x70012529caa3 in start_thread nptl/pthread_create.c:447:8
    #6 0x700125329c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
0x51d005cf1290 is located 16 bytes inside of 2048-byte region [0x51d005cf1280,0x51d005cf1a80)
freed by thread T0 (Suricata-Main) here:
    #0 0x64cf5d0753c0 in realloc (/opt/gitrun/suri/bin/suricata+0x33f3c0) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
    #1 0x64cf5d108c99 in SCReallocFunc /tmp/.git_build_suri/suricata/src/util-mem.c:46:20
    #2 0x64cf5d0c8b2c in TmThreadsRegisterThread /tmp/.git_build_suri/suricata/src/tm-threads.c:2221:20
    #3 0x64cf5d0c8e9f in TmThreadCreateMgmtThread /tmp/.git_build_suri/suricata/src/tm-threads.c:1104:18
    #4 0x64cf5d6b51c3 in LogMaintenanceThreadSpawn /tmp/.git_build_suri/suricata/src/log-maintenance.c:118:13
    #5 0x64cf5d446c95 in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:454:9
    #6 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
    #7 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
    #8 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #9 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #10 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
previously allocated by thread T0 (Suricata-Main) here:
    #0 0x64cf5d07518d in calloc (/opt/gitrun/suri/bin/suricata+0x33f18d) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
    #1 0x64cf5d108e39 in SCCallocFunc /tmp/.git_build_suri/suricata/src/util-mem.c:60:20
    #2 0x64cf5d0c88ad in TmThreadsRegisterThread /tmp/.git_build_suri/suricata/src/tm-threads.c:2198:32
    #3 0x64cf5d0c87a0 in TmThreadCreatePacketHandler /tmp/.git_build_suri/suricata/src/tm-threads.c:1077:18
    #4 0x64cf5d720f2b in RunModeFilePcapAutoFp /tmp/.git_build_suri/suricata/src/runmode-pcap-file.c:163:9
    #5 0x64cf5d446c4b in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:438:5
    #6 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
    #7 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
    #8 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #9 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #10 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
Thread T29 (FM#01) created by T0 (Suricata-Main) here:
    #0 0x64cf5d05a915 in pthread_create (/opt/gitrun/suri/bin/suricata+0x324915) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)
    #1 0x64cf5d0cc4a2 in TmThreadSpawn /tmp/.git_build_suri/suricata/src/tm-threads.c:1723:14
    #2 0x64cf5d3cce1c in FlowManagerThreadSpawn /tmp/.git_build_suri/suricata/src/flow-manager.c:1036:13
    #3 0x64cf5d446c73 in RunModeDispatch /tmp/.git_build_suri/suricata/src/runmodes.c:448:9
    #4 0x64cf5d0c0fde in SuricataInit /tmp/.git_build_suri/suricata/src/suricata.c:3200:5
    #5 0x64cf5d0b3639 in main /tmp/.git_build_suri/suricata/src/main.c:57:5
    #6 0x70012522a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #7 0x70012522a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #8 0x64cf5cfda154 in _start (/opt/gitrun/suri/bin/suricata+0x2a4154) (BuildId: 1b42cdce52a702d1826bae7624f57ece0c093243)

Race condition as TmThreadsTimeSubsysIsReady is missing SCMutexLock(&thread_store_lock);

No data to display

Actions

Also available in: PDF Atom