Skip to content

Conversation

darosior
Copy link
Member

@darosior darosior commented Jan 2, 2024

Catching the exception in AddCoin and continuing will lead to the calculated memory usage of the cache to be out of sync (lower by the size of the existing coin). If we later remove more coins, this can lead to an underflow and the sanitizer will trip on a later overflow when we add back to cachedCoinsUsage. See #28216 (comment).

I found this while rebasing #28216 but another way of exposing this mistake is to simply run the cache sanity check after the LIMITED_WHILE loop. This PR fixes the underflow by not continuing when hitting this exception and adds the sanity check.

The crash can be reproduced with the following seed:

q6urNzc3NzfHx8fHx8fHx8fHx8cBpwAAAAD//wD/////7/+CAAAAAAAAAAGCgv9Z/////////8dDbwBcXW+XbyEhL01BTklGRVNULTAwMCEhBQUFBQUFBQX///////8hISMjIyP/ISHd//9rQ0P/AQAAISEhISMjIyP/ISHd//9rQ0MhISEFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQAFBf8BAAAhISEhIyMjI/8hISEhISMjIyP/ISHd//9rQ0P/AQAAISEhISMjIyP/ISHd//9rQ0MhIUM/ISEhIf//////AH//////AQAAISEhISMjIyP/ISHd//9rQ0P/AQAAISEhISMjIyP/ISEhISEjIyMj/yEh3f//a0ND/wEAACEhISEjIyMj/yEh3f//a0NDISEhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUABQUFBQUFx/9rQ0P/AQAAISEhISMjIyP/ISHd//9rQ0MhISEFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQAFBQUFBQXHx8fHx8fHx8fHx8fHxzc3Nzc3NzfHx8fHx8cFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFIf//ISEhISMjIyP/ISHd//////////////8x////////////ISHd//////////////8y/////+//////////////////f2vHx0ND/8fHxzc3Nzc3Nzc=

@DrahtBot
Copy link
Contributor

DrahtBot commented Jan 2, 2024

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.
A summary of reviews will appear here.

@maflcko
Copy link
Member

maflcko commented Jan 2, 2024

fuzz: coins.cpp:338: void CCoinsViewCache::SanityCheck() const: Assertion `recomputed_usage == cachedCoinsUsage' failed.

@darosior
Copy link
Member Author

darosior commented Jan 2, 2024

My bad, i ran the new coins_db introduced in #28216 for a while but not this one.. Will debug to find the other source of inconsistency.

@maflcko
Copy link
Member

maflcko commented Jan 2, 2024

The crash can be reproduced with the following seed:

On what commit? For me it seems to pass on current master.

@darosior
Copy link
Member Author

darosior commented Jan 2, 2024

You need to add the sanity check to trigger it.

@darosior
Copy link
Member Author

darosior commented Jan 2, 2024

Sigh... I'm tired of this target just doing random things. Turns out you can't perform the sanity checks because it's using a dummy backend where Flush() won't actually erase the cache. I'll just use a hack to avoid the crash in #28216.

@darosior darosior closed this Jan 2, 2024
@bitcoin bitcoin locked and limited conversation to collaborators Jan 1, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants