SEGV is issued while enabling address sanitizer

[eecheng87]

To enable the address sanitizer and reproduce the error messages encountered after launching cserv, you can modify the Makefile with the following options:

- CFLAGS += -O2 -g 
+ CFLAGS += -O2 -g -fsanitize=address -static-libasan
- LDFLAGS= -ldl
+ LDFLAGS = -ldl -fsanitize=address -static-libasan

After adding these changes, the following error messages are displayed:

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/coro/sched.c:125 in add_to_timer_node
==18485==ABORTING
AddressSanitizer:DEADLYSIGNAL
=================================================================
==18503==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5650ef110a5a bp 0x7f47deeabf10 sp 0x7f47deeabed0 T0)
==18503==The signal is caused by a READ memory access.
==18503==Hint: address points to the zero page.
    #0 0x5650ef110a59 in add_to_timer_node src/coro/sched.c:125
    #1 0x5650ef110ccb in move_to_inactive_tree src/coro/sched.c:160
    #2 0x5650ef111485 in schedule_timeout src/coro/sched.c:346
    #3 0x5650ef1153b7 in worker_accept_cycle src/process.c:170
    #4 0x5650ef111325 in coro_routine_proxy src/coro/sched.c:322
    #5 0x5650ef10fe58  (/home/eecheng/cserv/cserv+0x146e58)

Based on the information provided, it is suspected that the error is caused by the casting of the address 0 in the container_of macro. One possible workaround to address this issue is to use a suppression for the address sanitizer, such as the attribute __attribute__((no_sanitize("address"))). You can find more details on how to disable address sanitizer partially in the following link: Disabling Instrumentation with attribute no_sanitize("address").

[JoshuaLee0321]

I added this attribute in add_to_timer_node, the problem switchs to the invalid access of local variable integer

- static void add_to_timer_node(struct timer_node *tm_node,
                              struct coroutine *coro)
+  static void __attribute__((no_sanitize("address"))) add_to_timer_node(struct timer_node *tm_node,
                              struct coroutine *coro)

result in this:

SUMMARY: AddressSanitizer: SEGV src/coro/sched.c:132 in add_to_timer_node
==274985==ABORTING
    #0 0x55b7328cb067 in add_to_timer_node src/coro/sched.c:132
    #1 0x55b7328cb067 in move_to_inactive_tree src/coro/sched.c:170
    #2 0x55b7328cb067 in schedule_timeout src/coro/sched.c:378
    #3 0x55b7328cdbef in worker_accept_cycle src/process.c:170
    #4 0x55b7328ca83e in coro_routine_proxy src/coro/sched.c:350
    #5 0x55b7328ca500  (/home/joshua/linux2023/cserv/cserv+0xef500)

[JoshuaLee0321]

[solved] by initializing tmp node in move_to_inactive_tree

    struct timer_node *tmp = memcache_alloc(sched.cache);
    if (unlikely(!tmp)) /* still in active list */
        return;

+   tmp->root = RB_ROOT;
    tmp->timeout = coro->timeout;
    add_to_timer_node(tmp, coro);
    rb_link_node(&tmp->node, parent, newer);
    rb_insert_color(&tmp->node, &sched.inactive);

[jserv]

[solved] by initializing tmp node in move_to_inactive_tree

Great. Please send a pull request to close this issue.