Re: [BUG] rebase: can write reflog with uninit. `action` string

From: Kristoffer Haugsbakk <code@khaugsbakk.name>
Date: Apr 30, 2025, 15:17 UTC
Message-ID: <6743a9fc-11ca-45ac-bc40-4148f5d85d27@app.fastmail.com>
In-Reply-To: <20250429215155.GA36727@coredump.intra.peff.net>

On Tue, Apr 29, 2025, at 23:51, Jeff King wrote:

Show 17 quoted lines

> On Tue, Apr 29, 2025 at 09:40:13PM +0200, Kristoffer Haugsbakk wrote:
>
>> On Tue, Apr 29, 2025, at 11:22, Phillip Wood wrote:
>> >> #0  run_git_commit (defmsg=0x555555babe70 "<repo path>/MERGE_MSG", opts=0x7fffffffc070, flags=0) at sequencer.c:1158
>> >
>> > Thanks for the backtrace. It would be useful to know what's stored in
>> > opts->ctx->reflog_message at this point if it's not too much trouble
>> > please can you run "print *opts" and "print *opts->ctx" here.
>>
>> Today I ran on f65182a99e5 (The ninth batch, 2025-04-24) at
>> sequencer.c:1148.  I was never able to reproduce this
>> `opts->ctx->reflog_message` having a weird value with GDB today.  The
>> reflog was also fine.
>>
>> Then I ran without GDB and I got the weird reflog that I expected.
>
> Have you tried building with "make SANITIZE=address,undefined"?

No I haven’t.  Thank you.  The following is with that `make`.

Still on f65182a99e5 (The ninth batch, 2025-04-24). I eventually[1] got this:

[1] I run through 19 merge conflicts which I `--continue` (using rerere)
    until the rebase is done

```
detached HEAD 5d96584c836] Merge branch '<branch>' into <something else>
 Author: [author]
=================================================================
==87324==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001daa0 at pc 0x79371ca5df89 bp 0x7fff8e215a50 sp 0x7fff8e2151c8
READ of size 2 at 0x60300001daa0 thread T0
    #0 0x79371ca5df88 in printf_common ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:553
    #1 0x79371ca5fbd5 in __interceptor_vsnprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1668
    #2 0x5702aa6bd851 in strbuf_vaddf /home/kristoffer/programming/git/strbuf.c:415
    #3 0x5702aa6d2384 in strvec_pushf /home/kristoffer/programming/git/strvec.c:35
    #4 0x5702aa629087 in run_git_commit /home/kristoffer/programming/git/sequencer.c:1148
    #5 0x5702aa64c652 in do_merge /home/kristoffer/programming/git/sequencer.c:4363
    #6 0x5702aa655714 in pick_commits /home/kristoffer/programming/git/sequencer.c:5029
    #7 0x5702aa659a68 in sequencer_continue /home/kristoffer/programming/git/sequencer.c:5461
    #8 0x5702a9d0f5ce in run_sequencer_rebase builtin/rebase.c:370
    #9 0x5702a9d14cd9 in run_specific_rebase builtin/rebase.c:747
    #10 0x5702a9d23798 in cmd_rebase builtin/rebase.c:1887
    #11 0x5702a9a3c26c in run_builtin /home/kristoffer/programming/git/git.c:480
    #12 0x5702a9a3d3d5 in handle_builtin /home/kristoffer/programming/git/git.c:744
    #13 0x5702a9a3dc2c in run_argv /home/kristoffer/programming/git/git.c:811
    #14 0x5702a9a3f17c in cmd_main /home/kristoffer/programming/git/git.c:951
    #15 0x5702a9e77aa3 in main /home/kristoffer/programming/git/common-main.c:9
    #16 0x79371be29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x79371be29e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #18 0x5702a9a35384 in _start (/home/kristoffer/programming/git/git+0x12a0384)

0x60300001daa0 is located 0 bytes inside of 24-byte region [0x60300001daa0,0x60300001dab8)
freed by thread T0 here:
    #0 0x79371cab4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x5702aa7ecdca in xrealloc /home/kristoffer/programming/git/wrapper.c:140
    #2 0x5702aa6b83b7 in strbuf_grow /home/kristoffer/programming/git/strbuf.c:114
    #3 0x5702aa6bd8ca in strbuf_vaddf /home/kristoffer/programming/git/strbuf.c:420
    #4 0x5702aa6476dc in reflog_message /home/kristoffer/programming/git/sequencer.c:3948
    #5 0x5702aa648e42 in do_reset /home/kristoffer/programming/git/sequencer.c:4059
    #6 0x5702aa65545e in pick_commits /home/kristoffer/programming/git/sequencer.c:5026
    #7 0x5702aa659a68 in sequencer_continue /home/kristoffer/programming/git/sequencer.c:5461
    #8 0x5702a9d0f5ce in run_sequencer_rebase builtin/rebase.c:370
    #9 0x5702a9d14cd9 in run_specific_rebase builtin/rebase.c:747
    #10 0x5702a9d23798 in cmd_rebase builtin/rebase.c:1887
    #11 0x5702a9a3c26c in run_builtin /home/kristoffer/programming/git/git.c:480
    #12 0x5702a9a3d3d5 in handle_builtin /home/kristoffer/programming/git/git.c:744
    #13 0x5702a9a3dc2c in run_argv /home/kristoffer/programming/git/git.c:811
    #14 0x5702a9a3f17c in cmd_main /home/kristoffer/programming/git/git.c:951
    #15 0x5702a9e77aa3 in main /home/kristoffer/programming/git/common-main.c:9
    #16 0x79371be29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x79371cab4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x5702aa7ecdca in xrealloc /home/kristoffer/programming/git/wrapper.c:140
    #2 0x5702aa6b83b7 in strbuf_grow /home/kristoffer/programming/git/strbuf.c:114
    #3 0x5702aa6bbeae in strbuf_add /home/kristoffer/programming/git/strbuf.c:313
    #4 0x5702aa61da33 in strbuf_addstr /home/kristoffer/programming/git/strbuf.h:310
    #5 0x5702aa64766a in reflog_message /home/kristoffer/programming/git/sequencer.c:3943
    #6 0x5702aa659637 in sequencer_continue /home/kristoffer/programming/git/sequencer.c:5426
    #7 0x5702a9d0f5ce in run_sequencer_rebase builtin/rebase.c:370
    #8 0x5702a9d14cd9 in run_specific_rebase builtin/rebase.c:747
    #9 0x5702a9d23798 in cmd_rebase builtin/rebase.c:1887
    #10 0x5702a9a3c26c in run_builtin /home/kristoffer/programming/git/git.c:480
    #11 0x5702a9a3d3d5 in handle_builtin /home/kristoffer/programming/git/git.c:744
    #12 0x5702a9a3dc2c in run_argv /home/kristoffer/programming/git/git.c:811
    #13 0x5702a9a3f17c in cmd_main /home/kristoffer/programming/git/git.c:951
    #14 0x5702a9e77aa3 in main /home/kristoffer/programming/git/common-main.c:9
    #15 0x79371be29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:553 in printf_common
Shadow bytes around the buggy address:
  0x0c067fffbb00: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fa
  0x0c067fffbb10: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd
  0x0c067fffbb20: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c067fffbb30: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
  0x0c067fffbb40: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
=>0x0c067fffbb50: fd fa fa fa[fd]fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fffbb60: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x0c067fffbb70: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fffbb80: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fffbb90: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c067fffbba0: fa fa fd fd fd fa fa fa fd fd fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==87324==ABORTING
```

> This is a wild guess, but since ctx->reflog_message is pointing to a
> static strbuf, it could be a use after free if the strbuf is reallocated
> due to another call to reflog_message(), but we are still holding the
> old pointer via ctx->reflog_message.