tp-start: 1592098131.108765, rumpkern/t_tsleep, 1 tc-start: 1592098131.108784, tsleep tc-se:================================================================= tc-se:==2428==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900000b630 at pc 0x7f7ff72ed71e bp 0x7f7fffffcc90 sp 0x7f7fffffcc88 tc-se:READ of size 8 at 0x61900000b630 thread T0 tc-se: #0 0x7f7ff72ed71d in rumpns_kthread_join /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/threads.c:243:2 tc-se: tc-se:0x61900000b630 is located 432 bytes inside of 1032-byte region [0x61900000b480,0x61900000b888) tc-se:freed by thread T21 here: tc-se: #0 0x30c912 in free (/usr/tests/rump/rumpkern/t_tsleep+0x10c912) tc-se: #1 0x7f7ff72f37ea in lwproc_freelwp /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/lwproc.c:338:2 tc-se: #2 0x7f7ff72f37ea in rump_lwproc_switch /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/lwproc.c:521:3 tc-se: tc-se:previously allocated by thread T0 here: tc-se: #0 0x30d499 in posix_memalign (/usr/tests/rump/rumpkern/t_tsleep+0x10d499) tc-se: #1 0x7f7ff680f59a in rumpuser_malloc /public/src.git.2/lib/librumpuser/rumpuser_mem.c:55:7 tc-se: #2 0x7f7ff721815f in kmem_intr_alloc /public/src.git.2/lib/librump/../../sys/rump/../kern/subr_kmem.c:196:6 tc-se: #3 0x7f7ff721815f in kmem_intr_zalloc /public/src.git.2/lib/librump/../../sys/rump/../kern/subr_kmem.c:256:6 tc-se: #4 0x7f7ff721815f in rumpns_kmem_zalloc /public/src.git.2/lib/librump/../../sys/rump/../kern/subr_kmem.c:341:6 tc-se: #5 0x7f7ff72f25a6 in lwproc_makelwp /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/lwproc.c:349:18 tc-se: #6 0x31615b in rumptest_tsleep /public/src.git.2/tests/rump/kernspace/tsleep.c:91:8 tc-se: #7 0x7f7ff601abaf in run_tc /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:510:15 tc-se: #8 0x7f7ff601abaf in controlled_main /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:580:15 tc-se: #9 0x7f7ff601abaf in atf_tp_main /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:610:11 tc-se: #10 0x21fe0c in ___start (/usr/tests/rump/rumpkern/t_tsleep+0x1fe0c) tc-se: tc-se:Thread T21 created by T0 here: tc-se: #0 0x2db8bd in pthread_create (/usr/tests/rump/rumpkern/t_tsleep+0xdb8bd) tc-se: #1 0x7f7ff681cebe in rumpuser_thread_create /public/src.git.2/lib/librumpuser/rumpuser_pth.c:77:8 tc-se: #2 0x7f7ff72ed178 in rumpns_kthread_create /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/threads.c:211:7 tc-se: #3 0x31615b in rumptest_tsleep /public/src.git.2/tests/rump/kernspace/tsleep.c:91:8 tc-se: #4 0x7f7ff601abaf in run_tc /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:510:15 tc-se: #5 0x7f7ff601abaf in controlled_main /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:580:15 tc-se: #6 0x7f7ff601abaf in atf_tp_main /public/src.git.2/external/bsd/atf/dist/atf-c/detail/tp_main.c:610:11 tc-se: #7 0x21fe0c in ___start (/usr/tests/rump/rumpkern/t_tsleep+0x1fe0c) tc-se: tc-se:SUMMARY: AddressSanitizer: heap-use-after-free /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/threads.c:243:2 in rumpns_kthread_join tc-se: tc-se:SUMMARY: AddressSanitizer: heap-use-after-free /public/src.git.2/lib/librump/../../sys/rump/librump/rumpkern/threads.c:243:2 in rumpns_kthread_join tc-se:Shadow bytes around the buggy address: tc-se: 0x4c3200001670: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa tc-se: 0x4c3200001680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa tc-se: 0x4c3200001690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c32000016a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c32000016b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se:=>0x4c32000016c0: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd tc-se: 0x4c32000016d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c32000016e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c32000016f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c3200001700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd tc-se: 0x4c3200001710: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa tc-se:Shadow byte legend (one shadow byte represents 8 application bytes): tc-se: Addressable: 00 tc-se: Partially addressable: 01 02 03 04 05 06 07 tc-se: Heap left redzone: fa tc-se: Freed heap region: fd tc-se: Stack left redzone: f1 tc-se: Stack mid redzone: f2 tc-se: Stack right redzone: f3 tc-se: Stack after return: f5 tc-se: Stack use after scope: f8 tc-se: Global redzone: f9 tc-se: Global init order: f6 tc-se: Poisoned by user: f7 tc-se: Container overflow: fc tc-se: Array cookie: ac tc-se: Intra object redzone: bb tc-se: ASan internal: fe tc-se: Left alloca redzone: ca tc-se: Right alloca redzone: cb tc-se: Shadow gap: cc tc-se:==2428==ABORTING tc-end: 1592098131.251618, tsleep, failed, Test case exited normally but failed to create the results file: Failed to open /tmp/atf-run.TtOFmT/tcr tp-end: 1592098131.251822, rumpkern/t_tsleep