Memory leak with ASAN and RUST_BACKTRACE=1

[jynnantonix]

Hello,

There appears to be a memory leak when running a test that should panic with RUST_BACKTRACE=1. To reproduce, create a new library crate and modify the src/lib.rs so that it contains:

#[cfg(test)]
mod tests {
    #[test]
    #[should_panic]
    fn it_works() {
        assert_eq!(2 + 2, 7);
    }
}

Then run the tests with:

$ RUST_BACKTRACE=1 RUSTFLAGS="-Zsanitizer=address" cargo +nightly test

This results in the following memory leaks:

=================================================================
==352==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 720 byte(s) in 6 object(s) allocated from:
    #0 0x561fff474fd3 in malloc /cargo/registry/src/github.com-1ecc6299db9ec823/compiler_builtins-0.1.5/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x561fff4e35b7 in __rdos_backtrace_alloc /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/alloc.c:57:9
    #2 0x561fff4e495a in build_address_map /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1561:5
    #3 0x561fff4e495a in build_dwarf_data /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3020
    #4 0x561fff4e495a in __rdos_backtrace_dwarf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3080
    #5 0x561fff4e1fce in elf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3172:8
    #6 0x561fff4e214c in phdr_callback /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3270:7
    #7 0x7f2a2022ae8b in dl_iterate_phdr (/lib64/libc.so.6+0x131e8b)

Direct leak of 11 byte(s) in 1 object(s) allocated from:
    #0 0x561fff474fd3 in malloc /cargo/registry/src/github.com-1ecc6299db9ec823/compiler_builtins-0.1.5/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x561fff4e35b7 in __rdos_backtrace_alloc /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/alloc.c:57:9
    #2 0x561fff4e814c in read_line_header /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1804:9
    #3 0x561fff4e814c in read_line_info /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:2082
    #4 0x561fff4e70c0 in dwarf_lookup_pc /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:2808:11
    #5 0x561fff4e50ef in dwarf_fileline /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:2964:10
    #6 0x561fff4d9d9e in foreach_symbol_fileline<closure> /rustc/9d71ec1358ac063fe6ff1eaed0ba6ed3cedde610/src/libstd/sys_common/gnu/libbacktrace.rs:32:12
    #7 0x561fff4d9d9e in std::sys_common::backtrace::_print::he80662c8149842c5 /rustc/9d71ec1358ac063fe6ff1eaed0ba6ed3cedde610/src/libstd/sys_common/backtrace.rs:85

Indirect leak of 2752 byte(s) in 6 object(s) allocated from:
    #0 0x561fff474fd3 in malloc /cargo/registry/src/github.com-1ecc6299db9ec823/compiler_builtins-0.1.5/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x561fff4e35b7 in __rdos_backtrace_alloc /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/alloc.c:57:9
    #2 0x561fff4e3f22 in read_abbrevs /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1157:9
    #3 0x561fff4e3f22 in build_address_map /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1554
    #4 0x561fff4e3f22 in build_dwarf_data /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3020
    #5 0x561fff4e3f22 in __rdos_backtrace_dwarf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3080
    #6 0x561fff4e1fce in elf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3172:8
    #7 0x561fff4e214c in phdr_callback /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3270:7
    #8 0x7f2a2022ae8b in dl_iterate_phdr (/lib64/libc.so.6+0x131e8b)

Indirect leak of 2432 byte(s) in 86 object(s) allocated from:
    #0 0x561fff474fd3 in malloc /cargo/registry/src/github.com-1ecc6299db9ec823/compiler_builtins-0.1.5/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x561fff4e35b7 in __rdos_backtrace_alloc /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/alloc.c:57:9
    #2 0x561fff4e43ca in read_abbrevs /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1200:6
    #3 0x561fff4e43ca in build_address_map /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:1554
    #4 0x561fff4e43ca in build_dwarf_data /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3020
    #5 0x561fff4e43ca in __rdos_backtrace_dwarf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/dwarf.c:3080
    #6 0x561fff4e1fce in elf_add /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3172:8
    #7 0x561fff4e214c in phdr_callback /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-sys-0.1.27/src/libbacktrace/elf.c:3270:7
    #8 0x7f2a2022ae8b in dl_iterate_phdr (/lib64/libc.so.6+0x131e8b)

SUMMARY: AddressSanitizer: 5915 byte(s) leaked in 99 allocation(s).

My rustc version is rustc 1.35.0-nightly (9d71ec135 2019-03-10). Please let me know if you need more information.

[jynnantonix]

These do seem like legitimate leaks.

I would guess that there needs to be a free_abbrevs and a backtrace_free call on line 1599 in dwarf.c.

The read_line_header function appears to set hdr->filenames[i] to either memory allocated via backtrace_alloc or a pointer into a struct declared on the stack in the same function (!) based on whether the filename is absolute. It should probably just always be allocated via backtrace_alloc. Returning pointers to memory allocated on the stack seems like asking for trouble.

[jynnantonix]

Looks like fixes have already been posted upstream:

Fix memory leak in build_address_map
Fix memory leak in loop in build_address_map

Maybe this issue should be moved to the libbacktrace repo.

[mimoo]

any timeline on when this will be fixed? (Our current solution for LeakSanitizer to ignore this issue is to have backtrace in a suppression file.)

[tmiasko]

This was fixed either by one of backtrace-rs upgrades or switch to gimli in #74682.