Bug 1843838

Summary: heap-use-after-free in slapi_be_getsuffix
Product: Red Hat Enterprise Linux 8 Reporter: sgouvern
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED ERRATA QA Contact: RHDS QE <ds-qe-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: ---CC: pasik, spichugi, tbordaz, vashirov
Target Milestone: rcKeywords: TestCaseProvided, Triaged
Target Release: 8.0Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-1.4-8040020201216214810.866effaa Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-18 15:45:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description sgouvern 2020-06-04 09:26:39 UTC
Description of problem:
ASAN report :

=================================================================
==278094==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000230850 at pc 0x7f3b5b63f580 bp 0x7ffd71325a60 sp 0x7ffd71325a50
READ of size 4 at 0x611000230850 thread T0
    #0 0x7f3b5b63f57f in slapi_be_getsuffix (/usr/lib64/dirsrv/libslapd.so.0+0xd657f)
    #1 0x7f3b4b5f60cb in ldbm_instance_search_config_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:759
    #2 0x7f3b5b6658c9  (/usr/lib64/dirsrv/libslapd.so.0+0xfc8c9)
    #3 0x7f3b5b665b04  (/usr/lib64/dirsrv/libslapd.so.0+0xfcb04)
    #4 0x7f3b5b7cf3f3  (/usr/lib64/dirsrv/libslapd.so.0+0x2663f3)
    #5 0x7f3b5b7cf3d3  (/usr/lib64/dirsrv/libslapd.so.0+0x2663d3)
    #6 0x7f3b5b7cf3d3  (/usr/lib64/dirsrv/libslapd.so.0+0x2663d3)
    #7 0x7f3b5b664e81  (/usr/lib64/dirsrv/libslapd.so.0+0xfbe81)
    #8 0x7f3b5b66c6ff in dse_modify (/usr/lib64/dirsrv/libslapd.so.0+0x1036ff)
    #9 0x7f3b5b6e9973  (/usr/lib64/dirsrv/libslapd.so.0+0x180973)
    #10 0x7f3b5b6ebf58  (/usr/lib64/dirsrv/libslapd.so.0+0x182f58)
    #11 0x7f3b5b6ee25b in slapi_modify_internal (/usr/lib64/dirsrv/libslapd.so.0+0x18525b)
    #12 0x7f3b5b7ba70c  (/usr/lib64/dirsrv/libslapd.so.0+0x25170c)
    #13 0x7f3b5b7ba99f in uuid_cleanup (/usr/lib64/dirsrv/libslapd.so.0+0x25199f)
    #14 0x55e3388b535e in slapd_daemon ldap/servers/slapd/daemon.c:1212
    #15 0x55e338891af2 in main (/usr/sbin/ns-slapd+0x30af2)
    #16 0x7f3b57f877b2 in __libc_start_main (/lib64/libc.so.6+0x237b2)
    #17 0x55e338893ced in _start (/usr/sbin/ns-slapd+0x32ced)

0x611000230850 is located 144 bytes inside of 208-byte region [0x6110002307c0,0x611000230890)
freed by thread T33 here:
    #0 0x7f3b5bbd07e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0)
    #1 0x7f3b5b64643c in slapi_ch_free (/usr/lib64/dirsrv/libslapd.so.0+0xdd43c)
    #2 0x7f3b5b641d2f in slapi_be_free (/usr/lib64/dirsrv/libslapd.so.0+0xd8d2f)
    #3 0x55e3388aee17 in disk_monitoring_thread ldap/servers/slapd/daemon.c:712
    #4 0x7f3b58f31567  (/lib64/libnspr4.so+0x2b567)

previously allocated by thread T0 here:
    #0 0x7f3b5bbd0db0 in calloc (/lib64/libasan.so.5+0xefdb0)
    #1 0x7f3b5b646035 in slapi_ch_calloc (/usr/lib64/dirsrv/libslapd.so.0+0xdd035)
    #2 0x7f3b5b641993 in slapi_be_new (/usr/lib64/dirsrv/libslapd.so.0+0xd8993)
    #3 0x7f3b4b5f9126 in ldbm_instance_generate ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:889
    #4 0x7f3b4b5f9862 in ldbm_instance_add_instance_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1108
    #5 0x7f3b4b5d15d7 in ldbm_config_read_instance_entries ldap/servers/slapd/back-ldbm/ldbm_config.c:1005
    #6 0x7f3b4b5d4d9e in ldbm_config_load_dse_info ldap/servers/slapd/back-ldbm/ldbm_config.c:1096
    #7 0x7f3b4b58360b in dblayer_setup ldap/servers/slapd/back-ldbm/dblayer.c:275
    #8 0x7f3b4b627ba9 in ldbm_back_start ldap/servers/slapd/back-ldbm/start.c:46
    #9 0x7f3b5b726993  (/usr/lib64/dirsrv/libslapd.so.0+0x1bd993)
    #10 0x7f3b5b72d573 in plugin_startall (/usr/lib64/dirsrv/libslapd.so.0+0x1c4573)
    #11 0x55e3388919c0 in main (/usr/sbin/ns-slapd+0x309c0)
    #12 0x7f3b57f877b2 in __libc_start_main (/lib64/libc.so.6+0x237b2)

Thread T33 created by T0 here:
    #0 0x7f3b5bb33ea3 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52ea3)
    #1 0x7f3b58f3123e  (/lib64/libnspr4.so+0x2b23e)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/dirsrv/libslapd.so.0+0xd657f) in slapi_be_getsuffix
Shadow bytes around the buggy address:
  0x0c228003e0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e0c0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c228003e0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e0e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c228003e0f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c228003e100: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x0c228003e110: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c228003e120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e130: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c228003e140: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c228003e150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==278094==ABORTING


Version-Release number of selected component (if applicable):
389-ds-base-1.4.3.8-2.1asan.el8.x86_64 / 389-ds-base-1.4.3.8-2.module+el8.3.0+6591+ebfc9766.x86_64

How reproducible:
always

Steps to Reproduce:
run dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py with the ASAN build

Comment 1 Viktor Ashirov 2020-06-04 10:33:03 UTC
The ASAN output has missing symbols. Could you please install the relevant debuginfo packages and rerun test again?

Comment 2 sgouvern 2020-06-04 17:31:18 UTC
 dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py run with the asan build and all relevant debuginfo packages :

=================================================================
==283581==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000230850 at pc 0x7f7ebb729580 bp 0x7ffd60363f90 sp 0x7ffd60363f80
READ of size 4 at 0x611000230850 thread T0
    #0 0x7f7ebb72957f in slapi_be_getsuffix (/usr/lib64/dirsrv/libslapd.so.0+0xd657f)
    #1 0x7f7eab6f60cb in ldbm_instance_search_config_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:759
    #2 0x7f7ebb74f8c9 in dse_call_callback ldap/servers/slapd/dse.c:2646
    #3 0x7f7ebb74fb04 in dse_write_entry ldap/servers/slapd/dse.c:1053
    #4 0x7f7ebb8b93f3 in avl_inapply ldap/libraries/libavl/avl.c:484
    #5 0x7f7ebb8b93d3 in avl_inapply ldap/libraries/libavl/avl.c:481
    #6 0x7f7ebb8b93d3 in avl_inapply ldap/libraries/libavl/avl.c:481
    #7 0x7f7ebb74ee81 in dse_write_file_nolock ldap/servers/slapd/dse.c:980
    #8 0x7f7ebb7566ff in dse_replace_entry ldap/servers/slapd/dse.c:1295
    #9 0x7f7ebb7566ff in dse_modify ldap/servers/slapd/dse.c:2019
    #10 0x7f7ebb7d3973 in op_shared_modify ldap/servers/slapd/modify.c:1021
    #11 0x7f7ebb7d5f58  (/usr/lib64/dirsrv/libslapd.so.0+0x182f58)
    #12 0x7f7ebb7d825b in slapi_modify_internal ldap/servers/slapd/modify.c:408
    #13 0x7f7ebb8a470c in modify_state_entry ldap/servers/slapd/uuid.c:679
    #14 0x7f7ebb8a499f in write_state_to_entry ldap/servers/slapd/uuid.c:603
    #15 0x7f7ebb8a499f in write_state ldap/servers/slapd/uuid.c:561
    #16 0x7f7ebb8a499f in uuid_cleanup ldap/servers/slapd/uuid.c:201
    #17 0x560d27f3835e in slapd_daemon ldap/servers/slapd/daemon.c:1212
    #18 0x560d27f14af2 in main (/usr/sbin/ns-slapd+0x30af2)
    #19 0x7f7eb80717b2 in __libc_start_main (/lib64/libc.so.6+0x237b2)
    #20 0x560d27f16ced in _start (/usr/sbin/ns-slapd+0x32ced)

0x611000230850 is located 144 bytes inside of 208-byte region [0x6110002307c0,0x611000230890)
freed by thread T33 here:
    #0 0x7f7ebbcba7e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0)
    #1 0x7f7ebb73043c in slapi_ch_free (/usr/lib64/dirsrv/libslapd.so.0+0xdd43c)
    #2 0x7f7ebb72bd2f in slapi_be_free (/usr/lib64/dirsrv/libslapd.so.0+0xd8d2f)
    #3 0x560d27f31e17 in disk_monitoring_thread ldap/servers/slapd/daemon.c:712
    #4 0x7f7eb901b567 in _pt_root ../../.././nspr/pr/src/pthreads/ptthread.c:201

previously allocated by thread T0 here:
    #0 0x7f7ebbcbadb0 in calloc (/lib64/libasan.so.5+0xefdb0)
    #1 0x7f7ebb730035 in slapi_ch_calloc (/usr/lib64/dirsrv/libslapd.so.0+0xdd035)
    #2 0x7f7ebb72b993 in slapi_be_new (/usr/lib64/dirsrv/libslapd.so.0+0xd8993)
    #3 0x7f7eab6f9126 in ldbm_instance_generate ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:889
    #4 0x7f7eab6f9862 in ldbm_instance_add_instance_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1108
    #5 0x7f7eab6d15d7 in ldbm_config_read_instance_entries ldap/servers/slapd/back-ldbm/ldbm_config.c:1005
    #6 0x7f7eab6d4d9e in ldbm_config_load_dse_info ldap/servers/slapd/back-ldbm/ldbm_config.c:1096
    #7 0x7f7eab68360b in dblayer_setup ldap/servers/slapd/back-ldbm/dblayer.c:275
    #8 0x7f7eab727ba9 in ldbm_back_start ldap/servers/slapd/back-ldbm/start.c:46
    #9 0x7f7ebb810993 in plugin_call_func ldap/servers/slapd/plugin.c:2030
    #10 0x7f7ebb817573 in plugin_call_one ldap/servers/slapd/plugin.c:1979
    #11 0x7f7ebb817573 in plugin_dependency_startall ldap/servers/slapd/plugin.c:1733
    #12 0x560d27f149c0 in main (/usr/sbin/ns-slapd+0x309c0)
    #13 0x7f7eb80717b2 in __libc_start_main (/lib64/libc.so.6+0x237b2)

Thread T33 created by T0 here:
    #0 0x7f7ebbc1dea3 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52ea3)
    #1 0x7f7eb901b23e in _PR_CreateThread ../../.././nspr/pr/src/pthreads/ptthread.c:433

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/dirsrv/libslapd.so.0+0xd657f) in slapi_be_getsuffix
Shadow bytes around the buggy address:
  0x0c228003e0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e0c0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c228003e0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e0e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c228003e0f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c228003e100: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x0c228003e110: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c228003e120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c228003e130: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c228003e140: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c228003e150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==283581==ABORTING

Comment 4 mreynolds 2020-10-20 13:30:23 UTC
This might have been indrectly fixed via:  https://bugzilla.redhat.com/show_bug.cgi?id=1859225 (not in POST yet, but will be soon)

Comment 6 sgouvern 2020-12-07 15:13:24 UTC
openstack upgrade impacting the availability of a 1mt machine to test 
-> moving to ITM 6

Comment 7 sgouvern 2020-12-08 16:45:33 UTC
# rpm -qa | grep 389
389-ds-base-debuginfo-1.4.3.16-4asan.el8.x86_64
python3-lib389-1.4.3.16-4asan.el8.noarch
389-ds-base-legacy-tools-debuginfo-1.4.3.16-4asan.el8.x86_64
389-ds-base-legacy-tools-1.4.3.16-4asan.el8.x86_64
389-ds-base-libs-1.4.3.16-4asan.el8.x86_64
389-ds-base-snmp-1.4.3.16-4asan.el8.x86_64
389-ds-base-debugsource-1.4.3.16-4asan.el8.x86_64
389-ds-base-1.4.3.16-4asan.el8.x86_64
389-ds-base-snmp-debuginfo-1.4.3.16-4asan.el8.x86_64
389-ds-base-libs-debuginfo-1.4.3.16-4asan.el8.x86_64

running # PYTHONPATH=src/lib389/ DISK_MONITORING_ACK=1 py.test -s -v dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py

heap-use-after-free is still there in slapi_be_getsuffix

=================================================================
==276359==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100002745c0 at pc 0x7fd14fbb97ac bp 0x7fff8bd1b810 sp 0x7fff8bd1b800
READ of size 4 at 0x6100002745c0 thread T0
    #0 0x7fd14fbb97ab in slapi_be_getsuffix (/usr/lib64/dirsrv/libslapd.so.0+0xd67ab)
    #1 0x7fd13f90d497 in ldbm_instance_search_config_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:758
    #2 0x7fd14fbdfca9 in dse_call_callback ldap/servers/slapd/dse.c:2667
    #3 0x7fd14fbdfee4 in dse_write_entry ldap/servers/slapd/dse.c:1053
    #4 0x7fd14fd4ae83 in avl_inapply ldap/libraries/libavl/avl.c:484
    #5 0x7fd14fd4ae63 in avl_inapply ldap/libraries/libavl/avl.c:481
    #6 0x7fd14fd4ae63 in avl_inapply ldap/libraries/libavl/avl.c:481
    #7 0x7fd14fbdf261 in dse_write_file_nolock ldap/servers/slapd/dse.c:980
    #8 0x7fd14fbe6b80 in dse_replace_entry ldap/servers/slapd/dse.c:1298
    #9 0x7fd14fbe6b80 in dse_modify ldap/servers/slapd/dse.c:2024
    #10 0x7fd14fc64283 in op_shared_modify ldap/servers/slapd/modify.c:1025
    #11 0x7fd14fc669e8  (/usr/lib64/dirsrv/libslapd.so.0+0x1839e8)
    #12 0x7fd14fc68ceb in slapi_modify_internal ldap/servers/slapd/modify.c:408
    #13 0x7fd14fd3617c in modify_state_entry ldap/servers/slapd/uuid.c:679
    #14 0x7fd14fd3640f in write_state_to_entry ldap/servers/slapd/uuid.c:603
    #15 0x7fd14fd3640f in write_state ldap/servers/slapd/uuid.c:561
    #16 0x7fd14fd3640f in uuid_cleanup ldap/servers/slapd/uuid.c:201
    #17 0x5653acea157e in slapd_daemon ldap/servers/slapd/daemon.c:1219
    #18 0x5653ace7ddc6 in main (/usr/sbin/ns-slapd+0x30dc6)
    #19 0x7fd14c5028e2 in __libc_start_main (/lib64/libc.so.6+0x238e2)
    #20 0x5653ace7fffd in _start (/usr/sbin/ns-slapd+0x32ffd)

0x6100002745c0 is located 128 bytes inside of 192-byte region [0x610000274540,0x610000274600)
freed by thread T25 here:
    #0 0x7fd15014c7e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0)
    #1 0x7fd14fbc052c in slapi_ch_free (/usr/lib64/dirsrv/libslapd.so.0+0xdd52c)
    #2 0x7fd14fbbbf3f in slapi_be_free (/usr/lib64/dirsrv/libslapd.so.0+0xd8f3f)
    #3 0x5653ace9b1e7 in disk_monitoring_thread ldap/servers/slapd/daemon.c:712
    #4 0x7fd14d4ac5a7  (/lib64/libnspr4.so+0x2b5a7)

previously allocated by thread T0 here:
    #0 0x7fd15014cdb0 in calloc (/lib64/libasan.so.5+0xefdb0)
    #1 0x7fd14fbc0125 in slapi_ch_calloc (/usr/lib64/dirsrv/libslapd.so.0+0xdd125)
    #2 0x7fd14fbbbba3 in slapi_be_new (/usr/lib64/dirsrv/libslapd.so.0+0xd8ba3)
    #3 0x7fd13f910338 in ldbm_instance_generate ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:887
    #4 0x7fd13f910ac2 in ldbm_instance_add_instance_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1090
    #5 0x7fd13f8e8837 in ldbm_config_read_instance_entries ldap/servers/slapd/back-ldbm/ldbm_config.c:1005
    #6 0x7fd13f8ebffc in ldbm_config_load_dse_info ldap/servers/slapd/back-ldbm/ldbm_config.c:1096
    #7 0x7fd13f89a3ab in dblayer_setup ldap/servers/slapd/back-ldbm/dblayer.c:275
    #8 0x7fd13f940629 in ldbm_back_start ldap/servers/slapd/back-ldbm/start.c:46
    #9 0x7fd14fca16a3 in plugin_call_func ldap/servers/slapd/plugin.c:2030
    #10 0x7fd14fca8283 in plugin_call_one ldap/servers/slapd/plugin.c:1979
    #11 0x7fd14fca8283 in plugin_dependency_startall ldap/servers/slapd/plugin.c:1733
    #12 0x5653ace7dc94 in main (/usr/sbin/ns-slapd+0x30c94)
    #13 0x7fd14c5028e2 in __libc_start_main (/lib64/libc.so.6+0x238e2)

Thread T25 created by T0 here:
    #0 0x7fd1500afea3 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52ea3)
    #1 0x7fd14d4ac27e  (/lib64/libnspr4.so+0x2b27e)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/dirsrv/libslapd.so.0+0xd67ab) in slapi_be_getsuffix
Shadow bytes around the buggy address:
  0x0c2080046860: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2080046870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2080046880: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2080046890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c20800468a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c20800468b0: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
  0x0c20800468c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c20800468d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c20800468e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c20800468f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2080046900: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==276359==ABORTING


marking FailedQA / ASSIGNED

Comment 8 mreynolds 2020-12-11 20:29:53 UTC
Upstream ticket:

https://github.com/389ds/389-ds-base/issues/4483

Comment 10 sgouvern 2021-01-14 17:51:30 UTC
With build 389-ds-base-1.4.3.16-8.1asan.el8.x86_64

running # PYTHONPATH=src/lib389/ DISK_MONITORING_ACK=1 ASAN=1 py.test -s -v dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py

no heap-use-after-free is detected 

=> marking as verified:tested

Comment 13 sgouvern 2021-01-18 14:11:39 UTC
wrong build attached to the errata -> moving to ITM12

Comment 14 sgouvern 2021-01-18 14:44:23 UTC
Correct build now attached to the errata : as per comment 10, marking as VERIFIED and moving back to ITM11

Comment 16 errata-xmlrpc 2021-05-18 15:45:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (389-ds:1.4 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1835