Undefined behavior in subscription_options.hpp

[zhoulaifu]

Undefined behavior is detected by running a unit test from the tf2_ros package with Undefined Behavior Sanitizer (UBSAN, https://www.kernel.org/doc/html/v4.14/dev-tools/ubsan.html). The unit test used here is tf2_ros_test_message_filter from the geometry2 package.

Tested on ros2 eloquent. The error points to /opt/ros/eloquent/include/rclcpp/subscription_options.hpp:79:62: runtime error: reference binding to null pointer of type 'struct allocator'.

Below is the full error message.

root@b49ee72fcb7b:/opt/ros_ws# ./build/tf2_ros/tf2_ros_test_message_filter
[==========] Running 3 tests from 1 test case.
[----------] Global test environment set-up.
[----------] 3 tests from tf2_ros_message_filter
[ RUN      ] tf2_ros_message_filter.construction_and_destruction
[       OK ] tf2_ros_message_filter.construction_and_destruction (20 ms)
[ RUN      ] tf2_ros_message_filter.multiple_frames_and_time_tolerance
/opt/ros/eloquent/include/rclcpp/subscription_options.hpp:79:62: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/7/bits/shared_ptr.h:707:42: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/move.h:74:36: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/7/bits/shared_ptr.h:691:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr.h:344:64: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:1295:35: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:638:28: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:526:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/alloc_traits.h:475:4: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/ext/new_allocator.h:136:46: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/ext/new_allocator.h:136:4: runtime error: reference binding to null pointer of type 'const struct allocator'

[INFO] [tf2_ros_message_filter]: filter callback: trigger(0)
[INFO] [tf2_ros_message_filter]: filter callback: trigger(2)
[INFO] [tf2_ros_message_filter]: filter callback: trigger(2)
[INFO] [tf2_ros_message_filter]: filter callback: trigger(4)
[INFO] [tf2_ros_message_filter]: filter callback: trigger(4)
[INFO] [tf2_ros_message_filter]: filter callback: trigger(6)
[       OK ] tf2_ros_message_filter.multiple_frames_and_time_tolerance (6043 ms)
[ RUN      ] tf2_ros_message_filter.failure_reason_string_conversion
[       OK ] tf2_ros_message_filter.failure_reason_string_conversion (0 ms)
[----------] 3 tests from tf2_ros_message_filter (6063 ms total)

[----------] Global test environment tear-down
[==========] 3 tests from 1 test case ran. (6063 ms total)
[  PASSED  ] 3 tests.

[zhoulaifu]

Just found out that the same error can be triggered by running tf2_monitor of geometry2, with Undefined Behavior Sanitizer on.

root@f4ceac09462e:/opt/ros_ws# ./build/tf2_ros/tf2_monitor
/opt/ros/eloquent/include/rclcpp/subscription_options.hpp:79:62: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/7/bits/shared_ptr.h:707:42: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/move.h:74:36: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/7/bits/shared_ptr.h:691:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr.h:344:64: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:1295:35: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:638:28: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/shared_ptr_base.h:526:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/bits/alloc_traits.h:475:4: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/ext/new_allocator.h:136:46: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/7/ext/new_allocator.h:136:4: runtime error: reference binding to null pointer of type 'const struct allocator' 

[clalancette]

@zhoulaifu Can you try with rolling or from sources instead of Eloquent? Eloquent is out of support, and we've had more than a year of fixes since then, so these results aren't too helpful.

[zhoulaifu]

On foxy, these are what I got.
Let me know if you need a dockerfile to reproduce the errors.

root@19a4c225d2e4:/opt/ros_ws# ./build/tf2_ros/tf2_ros_test_message_filter
[==========] Running 3 tests from 1 test case.
[----------] Global test environment set-up.
[----------] 3 tests from tf2_ros_message_filter
[ RUN      ] tf2_ros_message_filter.construction_and_destruction
[       OK ] tf2_ros_message_filter.construction_and_destruction (48 ms)
[ RUN      ] tf2_ros_message_filter.multiple_frames_and_time_tolerance
/opt/ros/foxy/include/rclcpp/subscription_options.hpp:104:62: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/9/bits/shared_ptr.h:718:42: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/move.h:75:36: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/9/bits/shared_ptr.h:702:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr.h:359:59: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:1344:71: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:680:47: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:548:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/alloc_traits.h:484:4: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/ext/new_allocator.h:147:46: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/ext/new_allocator.h:147:4: runtime error: reference binding to null pointer of type 'const struct allocator'
[INFO] [1612722523.985853300] [tf2_ros_message_filter]: filter callback: trigger(0)
[INFO] [1612722524.984741100] [tf2_ros_message_filter]: filter callback: trigger(1)
[INFO] [1612722525.986539800] [tf2_ros_message_filter]: filter callback: trigger(2)
[INFO] [1612722526.985085800] [tf2_ros_message_filter]: filter callback: trigger(3)
[INFO] [1612722527.984925100] [tf2_ros_message_filter]: filter callback: trigger(4)
[INFO] [1612722528.985593000] [tf2_ros_message_filter]: filter callback: trigger(5)
[INFO] [1612722529.985126000] [tf2_ros_message_filter]: filter callback: trigger(6)
[       OK ] tf2_ros_message_filter.multiple_frames_and_time_tolerance (7029 ms)
[ RUN      ] tf2_ros_message_filter.failure_reason_string_conversion
[       OK ] tf2_ros_message_filter.failure_reason_string_conversion (0 ms)
[----------] 3 tests from tf2_ros_message_filter (7077 ms total)

[----------] Global test environment tear-down
[==========] 3 tests from 1 test case ran. (7078 ms total)
[  PASSED  ] 3 tests.


root@19a4c225d2e4:/opt/ros_ws# ./build/tf2_ros/tf2_monitor
/opt/ros/foxy/include/rclcpp/subscription_options.hpp:104:62: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/9/bits/shared_ptr.h:718:42: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/move.h:75:36: runtime error: reference binding to null pointer of type 'struct allocator'
/usr/include/c++/9/bits/shared_ptr.h:702:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr.h:359:59: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:1344:71: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:680:47: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/shared_ptr_base.h:548:39: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/bits/alloc_traits.h:484:4: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/ext/new_allocator.h:147:46: runtime error: reference binding to null pointer of type 'struct type'
/usr/include/c++/9/ext/new_allocator.h:147:4: runtime error: reference binding to null pointer of type 'const struct allocator'
Gathering data on all frames for 10 seconds...

[fujitatomoya]

could we have a complete procedure to reproduce this issue? i want to check if this happens with source build.

[zhoulaifu]

You can use this Dockerfile here to reproduce the environmental setting. In the docker container, you have a rox:foxy system with geometry2 compiled with the Undefined Behavior Sanitizer (UBSan). Then run the two binaries from the tf2_ros package to reproduce the bugs:

First, run ${ROS_WS}/build/tf2_ros/tf2_ros_test_message_filter
Then, run ${ROS_WS}/build/tf2_ros/tf2_monitor

i hope it helps.

[fujitatomoya]

I cannot reproduce this issue with source build ros2/ros2@9552559.

colcon_ws# VERBOSE=1 CXX="g++" CXXFLAGS="--coverage -g -fsanitize=undefined" colcon build --event-handlers console_direct+ --packages-select test_tf2
colcon_ws# ./build/tf2_ros/tf2_ros_test_message_filter
[==========] Running 3 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 3 tests from tf2_ros_message_filter
[ RUN      ] tf2_ros_message_filter.construction_and_destruction
[       OK ] tf2_ros_message_filter.construction_and_destruction (11 ms)
[ RUN      ] tf2_ros_message_filter.multiple_frames_and_time_tolerance
[INFO] [1612786758.938836787] [tf2_ros_message_filter]: filter callback: trigger(1)
[INFO] [1612786759.938814515] [tf2_ros_message_filter]: filter callback: trigger(2)
[INFO] [1612786760.938823356] [tf2_ros_message_filter]: filter callback: trigger(3)
[INFO] [1612786761.938804123] [tf2_ros_message_filter]: filter callback: trigger(4)
[INFO] [1612786762.938330639] [tf2_ros_message_filter]: filter callback: trigger(5)
[INFO] [1612786763.938811528] [tf2_ros_message_filter]: filter callback: trigger(6)
[       OK ] tf2_ros_message_filter.multiple_frames_and_time_tolerance (6012 ms)
[ RUN      ] tf2_ros_message_filter.failure_reason_string_conversion
[       OK ] tf2_ros_message_filter.failure_reason_string_conversion (0 ms)
[----------] 3 tests from tf2_ros_message_filter (6023 ms total)

[----------] Global test environment tear-down
[==========] 3 tests from 1 test suite ran. (6023 ms total)
[  PASSED  ] 3 tests.
colcon_ws# ./build/tf2_ros/tf2_monitor
Gathering data on all frames for 10 seconds...



RESULTS: for all Frames

Frames:

All Broadcasters:



RESULTS: for all Frames
<...snip>

[zhoulaifu]

That is good to know. Thanks.

BTW, which ROS version do you refer to by "source build"? Does a bug reported on ROS foxy remain relevant?

[clalancette]

BTW, which ROS version do you refer to by "source build"?

All of the development for ROS 2 is done on the "master" or "ros2" branches of the repositories. After we fix whatever issues are happening, we then determine if we can backport it to still supported distributions (which are Foxy and Dashing at the moment).

You can build from source by following the instructions here: https://index.ros.org/doc/ros2/Installation/Rolling/Linux-Development-Setup/

Does a bug reported on ROS foxy remain relevant?

Yes, Foxy bug reports are still relevant. It is best to see first if it is fixed on the latest sources. If that is fixed, then checking if it is fixed on Foxy is a good second step (since we sometimes forget to backport things to Foxy).

In this case, since @fujitatomoya says it is fixed on master, I'm going to change the title to reflect that it is still a problem on Foxy. @zhoulaifu if you'd like to look into backporting the fix to Foxy, that would be welcome.

[zhoulaifu]

@fujitatomoya Perhaps you are aware of this: above, you were compiling with --packages-select test_tf2, but later ran package in the command line but then ran a unit test in tf2_ros, tf2_ros/tf2_ros_test_message_filter. A bit strange. Maybe double check you indeed had compiled tf2_ros with ASan before doing the test.

[zhoulaifu]

Besides, @fujitatomoya . FYI, I just checked that the errors remain in ros:rolling, but I have not tried with the upstream branch.

[clalancette]

This actually looks similar to #849 , though this is for the subscription_options instead of the publisher_options.