Crash in ASAN debug builds due to use-after-free memory in draw code - instances issue? #55243

New Issue

Bastien Montagne · 2018-05-29T11:43:38+02:00

Bastien Montagne commented

2018-05-29 11:43:38 +02:00

Found while checking #55204. Just open /scenes/01-opening/01_050_A/01_050_A.anim.28.blend in an ASAN-enabled debug build of Blender2.8, immediately crash on first drawing with following info:

=================================================================
==4716==ERROR: AddressSanitizer: heap-use-after-free on address 0x61901a7b6fac at pc 0x7fedf46826c2 bp 0x7ffe9d2f8b00 sp 0x7ffe9d2f82b0
READ of size 12 at 0x61901a7b6fac thread T0
    - 0 0x7fedf46826c1  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1)
    - 1 0x7fedc6b44627  (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f3627)
    - 2 0x7fedc6b45b16  (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f4b16)
    - 3 0x564258500bb4 in GPU_shader_uniform_vector /home/guest/blender/blender/source/blender/gpu/intern/gpu_shader.c:623
    - 4 0x56425857ce2a in draw_shgroup /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:988
    - 5 0x56425857eb07 in drw_draw_pass_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1202
    - 6 0x56425857eecb in DRW_draw_pass /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1235
    - 7 0x5642586635bf in workbench_deferred_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:569
    - 8 0x56425860d67e in workbench_solid_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:71
    - 9 0x564258564c91 in drw_engines_draw_scene /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:891
    - 10 0x564258566c9e in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1334
    - 11 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    - 12 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    - 13 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    - 14 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    - 15 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    - 16 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    - 17 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    - 18 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    - 19 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    - 20 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)
    - 21 0x56425676d349 in _start (/home/guest/blender/build_2.8_debug/bin/blender+0x3318349)

0x61901a7b6fac is located 44 bytes inside of 904-byte region [0x61901a7b6f80,0x61901a7b7308)
freed by thread T0 here:
    - 0 0x7fedf46e58c8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd98c8)
    - 1 0x564259cb9f83 in MEM_lockfree_freeN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164
    - 2 0x564259cba226 in MEM_lockfree_reallocN_id /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:223
    - 3 0x56425855f3f1 in DRW_instance_data_next /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:329
    - 4 0x5642585643f5 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:768
    - 5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349
    - 6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481
    - 7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53
    - 8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841
    - 9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289
    - 10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    - 11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    - 12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    - 13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    - 14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    - 15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    - 16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    - 17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    - 18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    - 19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)

previously allocated by thread T0 here:
    - 0 0x7fedf46e5c20 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9c20)
    - 1 0x564259cba713 in MEM_lockfree_mallocN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:318
    - 2 0x56425855efee in drw_instance_data_create /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:295
    - 3 0x56425855f68d in DRW_instance_data_request /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:355
    - 4 0x564258564356 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:766
    - 5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349
    - 6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481
    - 7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53
    - 8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841
    - 9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289
    - 10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    - 11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    - 12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    - 13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    - 14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    - 15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    - 16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    - 17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    - 18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    - 19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) 
Shadow bytes around the buggy address:
  0x0c32834eeda0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedd0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
  0x0c32834eede0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c32834eedf0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Found while checking #55204. Just open /scenes/01-opening/01_050_A/01_050_A.anim.28.blend in an ASAN-enabled debug build of Blender2.8, immediately crash on first drawing with following info: ``` ================================================================= ==4716==ERROR: AddressSanitizer: heap-use-after-free on address 0x61901a7b6fac at pc 0x7fedf46826c2 bp 0x7ffe9d2f8b00 sp 0x7ffe9d2f82b0 READ of size 12 at 0x61901a7b6fac thread T0 - 0 0x7fedf46826c1 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) - 1 0x7fedc6b44627 (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f3627) - 2 0x7fedc6b45b16 (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f4b16) - 3 0x564258500bb4 in GPU_shader_uniform_vector /home/guest/blender/blender/source/blender/gpu/intern/gpu_shader.c:623 - 4 0x56425857ce2a in draw_shgroup /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:988 - 5 0x56425857eb07 in drw_draw_pass_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1202 - 6 0x56425857eecb in DRW_draw_pass /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1235 - 7 0x5642586635bf in workbench_deferred_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:569 - 8 0x56425860d67e in workbench_solid_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:71 - 9 0x564258564c91 in drw_engines_draw_scene /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:891 - 10 0x564258566c9e in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1334 - 11 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231 - 12 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245 - 13 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265 - 14 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472 - 15 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536 - 16 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662 - 17 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816 - 18 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551 - 19 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514 - 20 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) - 21 0x56425676d349 in _start (/home/guest/blender/build_2.8_debug/bin/blender+0x3318349) 0x61901a7b6fac is located 44 bytes inside of 904-byte region [0x61901a7b6f80,0x61901a7b7308) freed by thread T0 here: - 0 0x7fedf46e58c8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd98c8) - 1 0x564259cb9f83 in MEM_lockfree_freeN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164 - 2 0x564259cba226 in MEM_lockfree_reallocN_id /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:223 - 3 0x56425855f3f1 in DRW_instance_data_next /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:329 - 4 0x5642585643f5 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:768 - 5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349 - 6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481 - 7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53 - 8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841 - 9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289 - 10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231 - 11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245 - 12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265 - 13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472 - 14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536 - 15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662 - 16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816 - 17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551 - 18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514 - 19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) previously allocated by thread T0 here: - 0 0x7fedf46e5c20 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9c20) - 1 0x564259cba713 in MEM_lockfree_mallocN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:318 - 2 0x56425855efee in drw_instance_data_create /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:295 - 3 0x56425855f68d in DRW_instance_data_request /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:355 - 4 0x564258564356 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:766 - 5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349 - 6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481 - 7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53 - 8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841 - 9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289 - 10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231 - 11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245 - 12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265 - 13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472 - 14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536 - 15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662 - 16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816 - 17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551 - 18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514 - 19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) Shadow bytes around the buggy address: 0x0c32834eeda0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32834eedb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32834eedc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32834eedd0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa 0x0c32834eede0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c32834eedf0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x0c32834eee00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c32834eee10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c32834eee20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c32834eee30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c32834eee40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ```

Clément Foucault was assigned by Bastien Montagne

2018-05-29 11:43:39 +02:00

Bastien Montagne commented

2018-05-29 11:43:39 +02:00

Added subscriber: @mont29