Skip to content

[Bug]: tokenizer_c report heap-use-after-free when e2e test #42576

Open
@chyezh

Description

@chyezh

Is there an existing issue for this?

  • I have searched the existing issues

Environment

- Milvus version: cc5ac1c220f3990cf1b67100257c99aac52b98e9
- Deployment mode(standalone or cluster):
- MQ type(rocksmq, pulsar or kafka):    
- SDK version(e.g. pymilvus v2.0.0rc2):
- OS(Ubuntu or CentOS): 
- CPU/Memory: 
- GPU: 
- Others:

Current Behavior

2025-06-06 15:30:20.109	=================================================================
2025-06-06 15:30:20.109	==8==ERROR: AddressSanitizer: heap-use-after-free on address 0x602002a60490 at pc 0x7f69ecde14d0 bp 0x7f6776756c70 sp 0x7f6776756c60
2025-06-06 15:30:20.109	READ of size 8 at 0x602002a60490 thread T261
2025-06-06 15:30:20.304	{"level":"info","ts":"2025-06-06T07:30:20.304744Z","caller":"traceutil/trace.go:171","msg":"trace[1427374784] transaction","detail":"{read_only:false; response_revision:13159; number_of_response:1; }","duration":"121.959814ms","start":"2025-06-06T07:30:20.182763Z","end":"2025-06-06T07:30:20.304723Z","steps":["trace[1427374784] 'process raft request'  (duration: 121.736377ms)"],"step_count":1}
2025-06-06 15:30:21.651	    #0 0x7f69ecde14cf in clone_tokenizer /workspace/source/internal/core/src/segcore/tokenizer_c.cpp:37
2025-06-06 15:30:21.651	    #1 0x57315c9 in _cgo_134b5c27bdc9_Cfunc_clone_tokenizer /tmp/go-build/cgo-gcc-prolog:55
2025-06-06 15:30:21.651	    #2 0x1f63503 in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:923
2025-06-06 15:30:21.651	
2025-06-06 15:30:21.651	0x602002a60490 is located 0 bytes inside of 8-byte region [0x602002a60490,0x602002a60498)
2025-06-06 15:30:21.651	freed by thread T257 here:
2025-06-06 15:30:21.651	    #0 0x7f69f74c4540 in operator delete(void*, unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:164
2025-06-06 15:30:21.651	    #1 0x1f63503 in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:923
2025-06-06 15:30:21.651	
2025-06-06 15:30:21.651	previously allocated by thread T261 here:
2025-06-06 15:30:21.651	    #0 0x7f69f74c3498 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
2025-06-06 15:30:21.651	    #1 0x7f69ecdea61e in std::__detail::_MakeUniq<milvus::tantivy::Tokenizer>::__single_object std::make_unique<milvus::tantivy::Tokenizer, char const*&>(char const*&) /usr/include/c++/12/bits/unique_ptr.h:1065
2025-06-06 15:30:21.651	    #2 0x7f69ecdea61e in create_tokenizer /workspace/source/internal/core/src/segcore/tokenizer_c.cpp:25
2025-06-06 15:30:21.651	    #3 0x5731959 in _cgo_134b5c27bdc9_Cfunc_create_tokenizer /tmp/go-build/cgo-gcc-prolog:55
2025-06-06 15:30:21.651	    #4 0x1f63503 in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:923
2025-06-06 15:30:21.651	
2025-06-06 15:30:21.652	Thread T261 created by T65 here:
2025-06-06 15:30:21.740	    #0 0x7f69f744df85 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
2025-06-06 15:30:21.741	    #1 0x542351a in _cgo_try_pthread_create /_/GOROOT/src/runtime/cgo/gcc_libinit.c:161
2025-06-06 15:30:21.741	    #2 0x5423a53 in _cgo_sys_thread_start /_/GOROOT/src/runtime/cgo/gcc_linux_amd64.c:70
2025-06-06 15:30:21.741	    #3 0x1f6353c in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:951
2025-06-06 15:30:21.741	    #4 0x1f28104 in runtime.newm1 /usr/local/go/src/runtime/proc.go:2821
2025-06-06 15:30:21.741	    #5 0x1f28004 in runtime.newm /usr/local/go/src/runtime/proc.go:2801
2025-06-06 15:30:21.741	    #6 0x1f285f8 in runtime.startm /usr/local/go/src/runtime/proc.go:2995
2025-06-06 15:30:21.741	    #7 0x1f28ad7 in runtime.handoffp /usr/local/go/src/runtime/proc.go:3036
2025-06-06 15:30:21.741	    #8 0x1f30894 in runtime.retake /usr/local/go/src/runtime/proc.go:6310
2025-06-06 15:30:21.741	    #9 0x1f30524 in runtime.sysmon /usr/local/go/src/runtime/proc.go:6214
2025-06-06 15:30:21.741	    #10 0x1f26ad2 in runtime.mstart1 /usr/local/go/src/runtime/proc.go:1855
2025-06-06 15:30:21.741	    #11 0x1f26a14 in runtime.mstart0 /usr/local/go/src/runtime/proc.go:1808
2025-06-06 15:30:21.741	    #12 0x1f617c4 in runtime.mstart /usr/local/go/src/runtime/asm_amd64.s:395
2025-06-06 15:30:21.741	    #13 0x7f69e8e77ac2  (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2)
2025-06-06 15:30:21.741	
2025-06-06 15:30:21.741	Thread T65 created by T0 here:
2025-06-06 15:30:21.741	    #0 0x7f69f744df85 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
2025-06-06 15:30:21.741	    #1 0x542351a in _cgo_try_pthread_create /_/GOROOT/src/runtime/cgo/gcc_libinit.c:161
2025-06-06 15:30:21.741	    #2 0x5423a53 in _cgo_sys_thread_start /_/GOROOT/src/runtime/cgo/gcc_linux_amd64.c:70
2025-06-06 15:30:21.741	    #3 0x1f6353c in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:951
2025-06-06 15:30:21.741	    #4 0x1f28104 in runtime.newm1 /usr/local/go/src/runtime/proc.go:2821
2025-06-06 15:30:21.741	    #5 0x1f28004 in runtime.newm /usr/local/go/src/runtime/proc.go:2801
2025-06-06 15:30:21.741	    #6 0x1f54784 in runtime.main.func1 /usr/local/go/src/runtime/proc.go:173
2025-06-06 15:30:21.741	    #7 0x1f618c9 in runtime.systemstack /usr/local/go/src/runtime/asm_amd64.s:514
2025-06-06 15:30:21.741	
2025-06-06 15:30:21.741	Thread T257 created by T65 here:
2025-06-06 15:30:21.741	    #0 0x7f69f744df85 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
2025-06-06 15:30:21.741	    #1 0x542351a in _cgo_try_pthread_create /_/GOROOT/src/runtime/cgo/gcc_libinit.c:161
2025-06-06 15:30:21.741	    #2 0x5423a53 in _cgo_sys_thread_start /_/GOROOT/src/runtime/cgo/gcc_linux_amd64.c:70
2025-06-06 15:30:21.741	    #3 0x1f6353c in runtime.asmcgocall /usr/local/go/src/runtime/asm_amd64.s:951
2025-06-06 15:30:21.741	    #4 0x1f28104 in runtime.newm1 /usr/local/go/src/runtime/proc.go:2821
2025-06-06 15:30:21.741	    #5 0x1f28004 in runtime.newm /usr/local/go/src/runtime/proc.go:2801
2025-06-06 15:30:21.741	    #6 0x1f285f8 in runtime.startm /usr/local/go/src/runtime/proc.go:2995
2025-06-06 15:30:21.741	    #7 0x1f28ad7 in runtime.handoffp /usr/local/go/src/runtime/proc.go:3036
2025-06-06 15:30:21.741	    #8 0x1f30894 in runtime.retake /usr/local/go/src/runtime/proc.go:6310
2025-06-06 15:30:21.741	    #9 0x1f30524 in runtime.sysmon /usr/local/go/src/runtime/proc.go:6214
2025-06-06 15:30:21.741	    #10 0x1f26ad2 in runtime.mstart1 /usr/local/go/src/runtime/proc.go:1855
2025-06-06 15:30:21.741	    #11 0x1f26a14 in runtime.mstart0 /usr/local/go/src/runtime/proc.go:1808
2025-06-06 15:30:21.741	    #12 0x1f617c4 in runtime.mstart /usr/local/go/src/runtime/asm_amd64.s:395
2025-06-06 15:30:21.741	    #13 0x7f69e8e77ac2  (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2)
2025-06-06 15:30:21.741	
2025-06-06 15:30:21.741	SUMMARY: AddressSanitizer: heap-use-after-free /workspace/source/internal/core/src/segcore/tokenizer_c.cpp:37 in clone_tokenizer
2025-06-06 15:30:21.741	Shadow bytes around the buggy address:
2025-06-06 15:30:21.741	  0x0c0480544040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2025-06-06 15:30:21.741	  0x0c0480544050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2025-06-06 15:30:21.741	  0x0c0480544060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2025-06-06 15:30:21.741	  0x0c0480544070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2025-06-06 15:30:21.741	  0x0c0480544080: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
2025-06-06 15:30:21.741	=>0x0c0480544090: fa fa[fd]fa fa fa 00 00 fa fa 00 00 fa fa 00 00
2025-06-06 15:30:21.741	  0x0c04805440a0: fa fa 00 07 fa fa fd fd fa fa fd fd fa fa fd fd
2025-06-06 15:30:21.741	  0x0c04805440b0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
2025-06-06 15:30:21.741	  0x0c04805440c0: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa 00 00
2025-06-06 15:30:21.741	  0x0c04805440d0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
2025-06-06 15:30:21.741	  0x0c04805440e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
2025-06-06 15:30:21.741	Shadow byte legend (one shadow byte represents 8 application bytes):
2025-06-06 15:30:21.741	  Addressable:           00
2025-06-06 15:30:21.741	  Partially addressable: 01 02 03 04 05 06 07 
2025-06-06 15:30:21.741	  Heap left redzone:       fa
2025-06-06 15:30:21.741	  Freed heap region:       fd
2025-06-06 15:30:21.741	  Stack left redzone:      f1
2025-06-06 15:30:21.741	  Stack mid redzone:       f2
2025-06-06 15:30:21.741	  Stack right redzone:     f3
2025-06-06 15:30:21.741	  Stack after return:      f5
2025-06-06 15:30:21.741	  Stack use after scope:   f8
2025-06-06 15:30:21.741	  Global redzone:          f9
2025-06-06 15:30:21.741	  Global init order:       f6
2025-06-06 15:30:21.741	  Poisoned by user:        f7
2025-06-06 15:30:21.741	  Container overflow:      fc
2025-06-06 15:30:21.741	  Array cookie:            ac
2025-06-06 15:30:21.741	  Intra object redzone:    bb
2025-06-06 15:30:21.741	  ASan internal:           fe
2025-06-06 15:30:21.741	  Left alloca redzone:     ca
2025-06-06 15:30:21.741	  Right alloca redzone:    cb
2025-06-06 15:30:21.741	==8==ABORTING

Expected Behavior

No response

Steps To Reproduce

Milvus Log

No response

Anything else?

No response

Metadata

Metadata

Assignees

Labels

kind/bugIssues or changes related a bugseverity/criticalCritical, lead to crash, data missing, wrong result, function totally doesn't work.triage/acceptedIndicates an issue or PR is ready to be actively worked on.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions