envoyproxy / envoy-wasm

*ATTENTION!: The content of this repo is merged into https://github.com/envoyproxy/envoy and future development is happening there.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Segfault while parsing CEL: proxy 1.6-alpha

mandarjog opened this issue · comments

Istio-proxy: Version 1.6-alpha.f63181a5c5d886aa309f67ab098897e85f3b573c
With the following stats config:

 - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
            subFilter:
              name: envoy.router
      proxy:
        proxyVersion: ^1\.6.*
    patch:
      operation: INSERT_BEFORE
      value:
        name: istio.stats
        typed_config:
          '@type': type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
          value:
            config:
              configuration: |
                {
                  "debug": "false",
                  "stat_prefix": "istio",
                  "metrics": [
                      {
                        "name": "requests_total",
                        "dimensions": {
                           "request_operation": "istio.operationId"
                      }
                      }
                  ]
                }
              root_id: stats_outbound
              vm_config:
                code:
                  local:
                    inline_string: envoy.wasm.stats
                runtime: envoy.wasm.runtime.null
                vm_id: stats_outbound
[Envoy (Epoch 0)] [2020-04-28 16:46:13.742][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:104] Caught Se
gmentation fault, suspect faulting address 0x0
[Envoy (Epoch 0)] [2020-04-28 16:46:13.742][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:91] Backtrace
(use tools/stack_decode.py to get line numbers):
[Envoy (Epoch 0)] [2020-04-28 16:46:13.742][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:92] Envoy vers
ion: 7598da631d123f45b5f7e142848e59f94b60bfde/1.14.0-dev/Clean/RELEASE/BoringSSL
[Envoy (Epoch 0)] [2020-04-28 16:46:13.742][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #0: __rest
ore_rt [0x7f305ce74890]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.755][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #1: antlr4
::atn::ParserATNSimulator::execATN() [0x5622ca09503f]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.767][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #2: antlr4
::atn::ParserATNSimulator::adaptivePredict() [0x5622ca094a20]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.778][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #3: cel_gr
ammar::CelParser::unary() [0x5622ca05f034]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.789][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #4: cel_gr
ammar::CelParser::calc() [0x5622ca05e446]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.799][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #5: cel_gr
ammar::CelParser::relation() [0x5622ca05db88]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.812][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #6: cel_gr
ammar::CelParser::conditionalAnd() [0x5622ca05d468]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.824][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #7: cel_gr
ammar::CelParser::conditionalOr() [0x5622ca05cc26]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.836][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #8: cel_gr
ammar::CelParser::expr() [0x5622ca05c64e]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.847][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #9: cel_gr
ammar::CelParser::start() [0x5622ca05c23d]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.858][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #10: googl
e::api::expr::parser::ParseWithMacros() [0x5622ca048072]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.869][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #11: googl
e::api::expr::parser::Parse() [0x5622ca047ea5]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.880][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #1[9/1853$
::Extensions::Common::Wasm::CreateExpressionFactory::create()::{lambda()#1}::operator()() [0x5622c95f1caf]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.892][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #13: std::
__1::__invoke_void_return_wrapper<>::__call<>() [0x5622c95f1b47]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.904][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #14: Envoy
::Extensions::Common::Wasm::Exports::call_foreign_function() [0x5622c95e8f9c]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.915][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #15: Envoy
::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::addStringExpression() [0x5622c8d2be73]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.928][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #16: Envoy
::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::initializeDimensions() [0x5622c8d2a07f]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.941][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #17: Envo$::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::onConfigure() [0x5622c8d2da97]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.955][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #18: std:$__1::__function::__func<>::operator()() [0x5622c8dcdc7b]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.968][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #19: Envo$::Extensions::Common::Wasm::Context::onConfigure() [0x5622c95d746e]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.982][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #20: Envo$::Extensions::Common::Wasm::getOrCreateThreadLocalWasm() [0x5622c95fc844]
[Envoy (Epoch 0)] [2020-04-28 16:46:13.994][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #21: std:$__1::__function::__func<>::operator()() [0x5622c911d4d7]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.008][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #22: std:$__1::__function::__func<>::operator()() [0x5622ca303cb8]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.022][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #23: std:$__1::__function::__func<>::operator()() [0x5622ca304ee8]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.035][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #24: Envo$::Event::DispatcherImpl::runPostCallbacks() [0x5622ca377fc6]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.049][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #25: even$_process_active_single_queue [0x5622ca6c2fd6]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.063][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #26: even$_base_loop [0x5622ca6c1b5e]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.077][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #27: Envo$::Server::WorkerImpl::threadRoutine() [0x5622ca36ecb8]
[Envoy (Epoch 0)] [2020-04-28 16:46:14.089][31][critical][backtrace] [bazel-out/k8-opt/bin/external/envoy/source/server/_virtual_includes/backtrace_lib/server/backtrace.h:96] #28: Envo$::Thread::ThreadImplPosix::ThreadImplPosix()::$_0::__invoke() [0x5622ca88b533]
[Envoy (Epoch 0)] [2020-04-28

Got the same error with the latest build.
2020-05-06T06:41:32.080874Z info Version 1.6-alpha.68e623cb1793eb25f1d8a8d7c9e155b8435039d2-68e623cb1793eb25f1d8a8d7c9e155b8435039d2-Clean

 Caught Segmentation fault, suspect faulting address 0x8
 Backtrace (use tools/stack_decode.py to get line numbers):
 Envoy version: ff8d26a507d4e75863c9800c143a5b94b2a3fdd5/1.14.1/Clean/RELEASE/BoringSSL
 #0: __restore_rt [0x7f2de1032890]
 #1: antlr4::atn::ParserATNSimulator::execATN() [0x55ac6be8f16f]
 #2: antlr4::atn::ParserATNSimulator::adaptivePredict() [0x55ac6be8eb50]
 #3: cel_grammar::CelParser::exprList() [0x55ac6be5ae78]
 #4: cel_grammar::CelParser::primary() [0x55ac6be5a2a2]
 #5: cel_grammar::CelParser::member() [0x55ac6be581c5]
 #6: cel_grammar::CelParser::unary() [0x55ac6be57681]
 #7: cel_grammar::CelParser::calc() [0x55ac6be56166]
 #8: cel_grammar::CelParser::relation() [0x55ac6be558a8]
 #9: cel_grammar::CelParser::conditionalAnd() [0x55ac6be55188]
 #10: cel_grammar::CelParser::conditionalOr() [0x55ac6be54946]
 #11: cel_grammar::CelParser::expr() [0x55ac6be5436e]
 #12: cel_grammar::CelParser::start() [0x55ac6be53f5d]
 #13: google::api::expr::parser::ParseWithMacros() [0x55ac6be402a2]
 #14: google::api::expr::parser::Parse() [0x55ac6be400d5]
 #15: Envoy::Extensions::Common::Wasm::CreateExpressionFactory::create()::{lambda()#1}::operator()() [0x55ac6b3f02e7]
 #16: std::__1::__invoke_void_return_wrapper<>::__call<>() [0x55ac6b3f0197]
 #17: Envoy::Extensions::Common::Wasm::Exports::call_foreign_function() [0x55ac6b3e736c]
 #18: Envoy::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::addStringExpression() [0x55ac6ab09133]
 #19: std::__1::__function::__func<>::operator()() [0x55ac6ab134e4]
 #20: Wasm::Common::JsonArrayIterate() [0x55ac6ab1ad4b]
 #21: Envoy::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::initializeDimensions() [0x55ac6ab04e9d]
 #22: Envoy::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::onConfigure() [0x55ac6ab08306]
 #23: std::__1::__function::__func<>::operator()() [0x55ac6abb17ab]
 #24: Envoy::Extensions::Common::Wasm::Context::onConfigure() [0x55ac6b3d4b7e]
 #25: Envoy::Extensions::Common::Wasm::getOrCreateThreadLocalWasm() [0x55ac6b3fbe84]
 #26: std::__1::__function::__func<>::operator()() [0x55ac6af14067]
 #27: std::__1::__function::__func<>::operator()() [0x55ac6c0ffcd8]
 #28: std::__1::__function::__func<>::operator()() [0x55ac6c100f08]
 #29: Envoy::Event::DispatcherImpl::runPostCallbacks() [0x55ac6c179266]
 #30: event_process_active_single_queue [0x55ac6c5c2256]
 #31: event_base_loop [0x55ac6c5c0dde]
 #32: Envoy::Server::WorkerImpl::threadRoutine() [0x55ac6c16f474]
 #33: Envoy::Thread::ThreadImplPosix::ThreadImplPosix()::$_0::__invoke() [0x55ac6c676ee3]
 #34: start_thread [0x7f2de10276db]

@TristonianJones Does the above segfault make sense to you?

Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/local/bin/envoy -c etc/istio/proxy/envoy-rev0.json --restart-epoch 0 --dra'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[Current thread is 1 (Thread 0x7f2dde429700 (LWP 28))]
(gdb) bt
#0  raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x000055ac6c63e0c5 in Envoy::SignalAction::sigHandler(int, siginfo_t*, void*) ()
#2  <signal handler called>
#3  0x000055ac6be90208 in antlr4::atn::ParserATNSimulator::getExistingTargetState(antlr4::dfa::DFAState*, unsigned long) ()
#4  0x000055ac6be8f16f in antlr4::atn::ParserATNSimulator::execATN(antlr4::dfa::DFA&, antlr4::dfa::DFAState*, antlr4::TokenStream*, unsigned long, antlr4::ParserRuleContext*) ()
#5  0x000055ac6be8eb50 in antlr4::atn::ParserATNSimulator::adaptivePredict(antlr4::TokenStream*, unsigned long, antlr4::ParserRuleContext*) ()
#6  0x000055ac6be5ae78 in cel_grammar::CelParser::exprList() ()
#7  0x000055ac6be5a2a2 in cel_grammar::CelParser::primary() ()
#8  0x000055ac6be581c5 in cel_grammar::CelParser::member(int) ()
#9  0x000055ac6be57681 in cel_grammar::CelParser::unary() ()
#10 0x000055ac6be56166 in cel_grammar::CelParser::calc(int) ()
#11 0x000055ac6be558a8 in cel_grammar::CelParser::relation(int) ()
#12 0x000055ac6be55188 in cel_grammar::CelParser::conditionalAnd() ()
#13 0x000055ac6be54946 in cel_grammar::CelParser::conditionalOr() ()
#14 0x000055ac6be5436e in cel_grammar::CelParser::expr() ()
#15 0x000055ac6be53f5d in cel_grammar::CelParser::start() ()
#16 0x000055ac6be402a2 in google::api::expr::parser::ParseWithMacros(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<google::api::expr::parser::Macro, std::__1::allocator<google::api::expr::parser::Macro> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) ()
#17 0x000055ac6be400d5 in google::api::expr::parser::Parse(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) ()
#18 0x000055ac6b3f02e7 in Envoy::Extensions::Common::Wasm::CreateExpressionFactory::create() const::{lambda(Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view, std::__1::function<void* (unsigned long)>)#1}::operator()(Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view, std::__1::function<void* (unsigned long)>) const ()
#19 0x000055ac6b3f0197 in Envoy::Extensions::Common::Wasm::WasmResult std::__1::__invoke_void_return_wrapper<Envoy::Extensions::Common::Wasm::WasmResult>::__call<Envoy::Extensions::Common::Wasm::CreateExpressionFactory::create() const::{lambda(Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view, std::__1::function<void* (unsigned long)>)#1}&, Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view, std::__1::function<void* (unsigned long)> >(Envoy::Extensions::Common::Wasm::CreateExpressionFactory::create() const::{lambda(Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view, std::__1::function<void* (unsigned long)>)#1}&, Envoy::Extensions::Common::Wasm::Wasm&, absl::string_view&&, std::__1::function<void* (unsigned long)>&&) ()
#20 0x000055ac6b3e736c in Envoy::Extensions::Common::Wasm::Exports::call_foreign_function(void*, Envoy::Extensions::Common::Wasm::Word, Envoy::Extensions::Common::Wasm::Word, Envoy::Extensions::Common::Wasm::Word, Envoy::Extensions::Common::Wasm::Word, Envoy::Extensions::Common::Wasm::Word, Envoy::Extensions::Common::Wasm::Word) ()
#21 0x000055ac6ab09133 in Envoy::Extensions::Common::Wasm::Null::Plugin::Stats::PluginRootContext::addStringExpression(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) ()

@mandarjog that error is coming from deep in the ANTLR stack. Which component of the config is the CEL expression? I wonder if this can be reproduced with just the CEL toolchain outside Envoy. I take it this is using the C++ stack, or is the Go one complied to WASM?

@TristonianJones This is using the c++ cel stack, and (kuat is ooo). I will check which expression it was trying to compile. It does not always happen though.

Give it a go. Can't hurt.

commented

I think having an expression that causes parser to fail would help. I doubt it is an ANTLR issue (otherwise, you should be able to replicate it in google3). Seems like a memory corruption or lifecycle issue.

expression: has(wasm.istio.operationId)?wasm.istio.operationId:'unknown'

#23 Envoy::Extensions::Common::Wasm::Exports::call_foreign_function (raw_context=<optimized out>, function_name=..., function_name_size=..., arguments=..., arguments_size=..., results=...,
    results_size=...) at external/envoy/source/extensions/common/wasm/exports.cc:244
#24 0x000055ac6ab09133 in Envoy::Extensions::Common::Wasm::Null::Plugin::proxy_call_foreign_function (function_name_size=11,
    arguments=0x55ac703b7a40 "has(wasm.istio.operationId)?wasm.istio.operationId:'unkown'", arguments_size=59, results=0x7f2dde414520, results_size=0x7f2dde414500, function_name=<optimized out>)
    at bazel-out/k8-opt/bin/external/envoy/source/extensions/common/wasm/null/_virtual_includes/null_plugin_lib/extensions/common/wasm/null/wasm_api_impl.h:258
---Type <return> to continue, or q <return> to quit---
#25 Envoy::Extensions::Common::Wasm::Null::Plugin::createExpression (expr=..., token=<optimized out>) at external/envoy/api/wasm/cpp/contrib/proxy_expr.h:6

Per offline discussion, Tristan will upgrade CEL-cpp antlr 4.7.2. (old version 4.7.1) and then we can import it into Envoy-wasm / envoy.

Comments by Tim Niemueller
( upgrading ) this would be my guess and our already existing suspicion it might be lifecycle related gives me confidence. While I did not run envoy-wasm myself, the indications are:

  • The stack trace occurs within Antlr (generated) code
  • the failing test when running multi-threaded with Antlr 4.7.1 and the fix by upgrading runtime dependency to Antlr 4.7.2.

It would now be a good time to test envoy-wasm with the patched cel-cpp version if the problem persists or is resolved.

I've just created cel-cpp v0.2.0. I can submit a PR to update envoy-wasm

This has been merged.