Use after scope bug in memory generator

[DerangedMonkeyNinja]

The memory generator contains a data race on a stack allocated struct between two threads. This causes itermittent memory corruption issues. This might also be possible in other generators, e.g. block and network, as they use the same generator framework.

Output from a run with -fsanitize=address follows.

==94992==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f8d4eff2760 at pc 0x55f144d65e27 bp 0x7f8d517f3b90 sp 0x7f8d517f3358
READ of size 208 at 0x7f8d4eff2760 thread T7
    #0 0x55f144d65e26 in __asan_memcpy (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x147de26)
    #1 0x55f1458601a7 in openperf::memory::internal::generator::stat() const /home/timmons/Developer/openperf/src/modules/memory/generator.cpp:226:17
    #2 0x55f1458723f0 in operator()<const std::pair<const std::basic_string<char>, std::variant<std::reference_wrapper<openperf::memory::internal::generator>, openperf::memory::generator_collection::stat_t> > > /home/timmons/Developer/openperf/src/modules/memory/generator_collection.cpp:219:46
    #3 0x55f1458723f0 in transform<std::__detail::_Node_const_iterator<std::pair<const std::basic_string<char>, std::variant<std::reference_wrapper<openperf::memory::internal::generator>, openperf::memory::generator_collection::stat_t> >, false, true>, std::front_insert_iterator<std::forward_list<openperf::memory::generator_collection::stat_t> >, (lambda at /home/timmons/Developer/openperf/src/modules/memory/generator_collection.cpp:215:27)> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_algo.h:4296:14
    #4 0x55f1458723f0 in openperf::memory::generator_collection::stats() const /home/timmons/Developer/openperf/src/modules/memory/generator_collection.cpp:227:5
    #5 0x55f14589f599 in openperf::memory::api::server::handle_request(openperf::memory::api::request::statistic::list const&) /home/timmons/Developer/openperf/src/modules/memory/server.cpp:311:41
    #6 0x55f1458a0b78 in operator()<openperf::memory::api::request::statistic::list> /home/timmons/Developer/openperf/src/modules/memory/server.cpp:27:21
    #7 0x55f1458a0b78 in __invoke_impl<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item>, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item>, openperf::memory::api::reply::statistic::item>, (lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, openperf::memory::api::request::statistic::list &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
    #8 0x55f1458a0b78 in __invoke<(lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, openperf::memory::api::request::statistic::list &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14
    #9 0x55f1458a0b78 in std::__detail::__variant::__gen_vtable_impl<std::__detail::__variant::_Multi_array<std::__detail::__variant::__deduce_visit_result<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item, std::allocator<openperf::memory::api::reply::generator::item> >, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item, std::allocator<openperf::memory::api::reply::statistic::item> >, openperf::memory::api::reply::statistic::item> > (*)(openperf::memory::api::server::handle_rpc_request(op_event_data const*)::$_0&, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create, std::allocator<openperf::memory::api::request::generator::create> >, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase>&)>, std::integer_sequence<unsigned long, 11ul> >::__visit_invoke(openperf::memory::api::server::handle_rpc_request(op_event_data const*)::$_0&, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create, std::allocator<openperf::memory::api::request::generator::create> >, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1013:11
    #10 0x55f14589756f in __do_visit<std::__detail::__variant::__deduce_visit_result<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item>, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item>, openperf::memory::api::reply::statistic::item> >, (lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create>, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase> &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1735:14
    #11 0x55f14589756f in visit<(lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create>, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase> &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1766:13
    #12 0x55f14589756f in openperf::memory::api::server::handle_rpc_request(op_event_data const*) /home/timmons/Developer/openperf/src/modules/memory/server.cpp:29:22
    #13 0x55f14573d775 in _do_event_handling /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:522:24
    #14 0x55f14573e4c9 in op_event_loop_run_timeout /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:664:17
    #15 0x55f145895fb9 in op_event_loop_run_forever /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:690:13
    #16 0x55f145895fb9 in run /home/timmons/Developer/openperf/src/framework/core/op_event_loop.hpp:20:24
    #17 0x55f145895fb9 in openperf::memory::service::start()::'lambda'()::operator()() const /home/timmons/Developer/openperf/src/modules/memory/init.cpp:82:21
    #18 0x55f1452eac53 in execute_native_thread_routine (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x1a02c53)
    #19 0x7f8d581b6926 in start_thread nptl/pthread_create.c:435:8
    #20 0x7f8d582469e3 in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100

Address 0x7f8d4eff2760 is located in stack of thread T55 at offset 32 in frame
    #0 0x55f145864707 in void openperf::framework::generator::controller::start<openperf::memory::internal::memory_stat, openperf::memory::internal::generator::generator()::$_0>(openperf::memory::internal::generator::generator()::$_0&&)::'lambda'()::operator()() const /home/timmons/Developer/openperf/src/framework/generator/controller.hpp:105

  This frame has 3 object(s):
    [32, 240) 'stat_copy.i' <== Memory access at offset 32 is inside this variable
    [304, 336) 'msg' (line 115)
    [368, 576) 'stats' (line 128)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T55 created by T7 here:
    #0 0x55f144d5117c in pthread_create (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x146917c)
    #1 0x55f1452ead99 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x1a02d99)
    #2 0x55f145856e17 in openperf::memory::internal::generator::generator(openperf::memory::internal::generator::config_t const&) /home/timmons/Developer/openperf/src/modules/memory/generator.cpp:144:7
    #3 0x55f1458742d6 in pair<std::basic_string<char>, const openperf::memory::internal::generator::config_t &, false> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_pair.h:362:35
    #4 0x55f1458742d6 in construct<std::pair<const std::basic_string<char>, openperf::memory::internal::generator>, std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:162:23
    #5 0x55f1458742d6 in construct<std::pair<const std::basic_string<char>, openperf::memory::internal::generator>, std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:512:8
    #6 0x55f1458742d6 in _M_allocate_node<std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable_policy.h:1875:6
    #7 0x55f1458742d6 in _Scoped_node<std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable.h:289:19
    #8 0x55f1458742d6 in std::pair<std::__detail::_Node_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, openperf::memory::internal::generator>, false, true>, bool> std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, openperf::memory::internal::generator>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, openperf::memory::internal::generator> >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_emplace<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, openperf::memory::internal::generator::config_t const&>(std::integral_constant<bool, true>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&&, openperf::memory::internal::generator::config_t const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable.h:1945:15
    #9 0x55f14586f24c in emplace<std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable.h:898:11
    #10 0x55f14586f24c in emplace<std::basic_string<char>, const openperf::memory::internal::generator::config_t &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unordered_map.h:389:16
    #11 0x55f14586f24c in openperf::memory::generator_collection::create(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, openperf::memory::internal::generator::config_t const&) /home/timmons/Developer/openperf/src/modules/memory/generator_collection.cpp:70:32
    #12 0x55f14589914d in openperf::memory::api::server::handle_request(openperf::memory::api::request::generator::create const&) /home/timmons/Developer/openperf/src/modules/memory/server.cpp:96:38
    #13 0x55f1458a0a0c in operator()<openperf::memory::api::request::generator::create> /home/timmons/Developer/openperf/src/modules/memory/server.cpp:27:21
    #14 0x55f1458a0a0c in __invoke_impl<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item>, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item>, openperf::memory::api::reply::statistic::item>, (lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, openperf::memory::api::request::generator::create &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
    #15 0x55f1458a0a0c in __invoke<(lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, openperf::memory::api::request::generator::create &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14
    #16 0x55f1458a0a0c in std::__detail::__variant::__gen_vtable_impl<std::__detail::__variant::_Multi_array<std::__detail::__variant::__deduce_visit_result<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item, std::allocator<openperf::memory::api::reply::generator::item> >, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item, std::allocator<openperf::memory::api::reply::statistic::item> >, openperf::memory::api::reply::statistic::item> > (*)(openperf::memory::api::server::handle_rpc_request(op_event_data const*)::$_0&, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create, std::allocator<openperf::memory::api::request::generator::create> >, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase>&)>, std::integer_sequence<unsigned long, 4ul> >::__visit_invoke(openperf::memory::api::server::handle_rpc_request(op_event_data const*)::$_0&, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create, std::allocator<openperf::memory::api::request::generator::create> >, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1013:11
    #17 0x55f14589756f in __do_visit<std::__detail::__variant::__deduce_visit_result<std::variant<openperf::memory::api::reply::ok, openperf::memory::api::reply::error, openperf::memory::memory_info::info_t, std::vector<openperf::memory::api::reply::generator::item>, openperf::memory::api::reply::generator::item, std::vector<openperf::memory::api::reply::statistic::item>, openperf::memory::api::reply::statistic::item> >, (lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create>, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase> &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1735:14
    #18 0x55f14589756f in visit<(lambda at /home/timmons/Developer/openperf/src/modules/memory/server.cpp:26:32) &, std::variant<openperf::memory::api::request::info, openperf::memory::api::request::generator::list, openperf::memory::api::request::generator::get, openperf::memory::api::request::generator::erase, openperf::memory::api::request::generator::create, std::vector<openperf::memory::api::request::generator::create>, openperf::memory::api::request::generator::bulk::erase, openperf::memory::api::request::generator::start, openperf::memory::api::request::generator::stop, openperf::memory::api::request::generator::bulk::start, openperf::memory::api::request::generator::bulk::stop, openperf::memory::api::request::statistic::list, openperf::memory::api::request::statistic::get, openperf::memory::api::request::statistic::erase> &> /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/variant:1766:13
    #19 0x55f14589756f in openperf::memory::api::server::handle_rpc_request(op_event_data const*) /home/timmons/Developer/openperf/src/modules/memory/server.cpp:29:22
    #20 0x55f14573d775 in _do_event_handling /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:522:24
    #21 0x55f14573e4c9 in op_event_loop_run_timeout /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:664:17
    #22 0x55f145895fb9 in op_event_loop_run_forever /home/timmons/Developer/openperf/src/framework/core/op_event_loop_epoll.c:690:13
    #23 0x55f145895fb9 in run /home/timmons/Developer/openperf/src/framework/core/op_event_loop.hpp:20:24
    #24 0x55f145895fb9 in openperf::memory::service::start()::'lambda'()::operator()() const /home/timmons/Developer/openperf/src/modules/memory/init.cpp:82:21
    #25 0x55f1452eac53 in execute_native_thread_routine (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x1a02c53)

Thread T7 created by T0 here:
    #0 0x55f144d5117c in pthread_create (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x146917c)
    #1 0x55f1452ead99 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x1a02d99)
    #2 0x55f145895100 in openperf::memory::service::start() /home/timmons/Developer/openperf/src/modules/memory/init.cpp:61:21
    #3 0x55f145895016 in memory_generator_start /home/timmons/Developer/openperf/src/modules/memory/init.cpp:101:8
    #4 0x55f145736bf0 in op_modules_start /home/timmons/Developer/openperf/src/framework/core/op_modules.c:134:19
    #5 0x55f14573421c in op_init /home/timmons/Developer/openperf/src/framework/core/op_init.c:83:9
    #6 0x55f14531f3e9 in main /home/timmons/Developer/openperf/targets/openperf/main.c:26:5
    #7 0x7f8d5814bfcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: stack-use-after-scope (/home/timmons/Developer/openperf/build/openperf-linux-x86_64-testing/bin/openperf+0x147de26) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0ff229df6490: 00 00 00 00 f1 f1 f1 f1 00 00 00 f2 f2 f2 f2 f2
  0x0ff229df64a0: 04 f2 f8 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 f1
  0x0ff229df64b0: 00 f8 f2 f2 f8 f8 f2 00 f8 00 f2 f2 f8 00 00 00
  0x0ff229df64c0: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3
  0x0ff229df64d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff229df64e0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1[f8]f8 f8 f8
  0x0ff229df64f0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x0ff229df6500: f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f2 f2 f2 00 00
  0x0ff229df6510: 00 00 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x0ff229df6520: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x0ff229df6530: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==94992==ABORTING