New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 623235 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
please use my google.com address
Closed: Jun 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Catch uninitialized bytes in IPC messages while still in a useful stack trace

Project Member Reported by roc...@chromium.org, Jun 24 2016

Issue description

If there are uninitialized bytes in any outgoing IPC messages sent from off the IO thread (i.e. most IPC messages), memory bots will flag an uninitialized read which contains no useful information in the stack trace. This leads to blanket suppressions being added to green the bots while masking all such bugs and hiding the underlying source of trouble.

We should find a way to trigger uninit read detection at the call site of the original IPC Send without impacting performance so we can get useful stack traces.
 

Comment 1 by roc...@chromium.org, Jun 24 2016

Cc: amistry@chromium.org
I think the most reasonable course of action here is to add some uninit-read-triggering logic to IPC::ChannelProxy::Send which only compiles if defined(MEMORY_SANITIZER).

Note that while msan bots don't currently catch these bugs, it's only because of  issue 619972 . That doesn't block this since we can just trigger the error using some other mechanism like conditional branching.
Project Member

Comment 2 by bugdroid1@chromium.org, Jun 24 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bf1598991bbbf0a9b34764a37a9c1b97ea50ca4f

commit bf1598991bbbf0a9b34764a37a9c1b97ea50ca4f
Author: rockot <rockot@chromium.org>
Date: Fri Jun 24 23:33:42 2016

Remove uninit read suppression for Mojo EDK writes

This is a common codepath through which all IPC data is
transmitted. Suppressing this supresses all potential
uninitialized read bugs in any code which prepares IPC
messages for transit (e.g. any IPC::ParamTraits
implementation.)

This suppression was recently relanded as a result of an
uninitialized read in some IPC message contents. It's possible
that the actual bug has been fixed, but it's unclear.

Since I'm unable to repro locally I'm removing the suppression
to see if the memory bots go red again.

Memory sheriffs *please* ping rockot@ before relanding this
suppression.

BUG= 398547 , 623235 
TBR=amistry@chromium.org

Review-Url: https://codereview.chromium.org/2098963002
Cr-Commit-Position: refs/heads/master@{#402013}

[modify] https://crrev.com/bf1598991bbbf0a9b34764a37a9c1b97ea50ca4f/tools/valgrind/drmemory/suppressions_full.txt

Comment 3 by roc...@chromium.org, Jun 25 2016

Status: WontFix (was: Assigned)
Actually, looks like base::Pickle already uses MSAN_CHECK_MEM_IS_INITIALIZED so this bug is invalid. If uninit bytes show up again they must be coming from somewhere else.

Sign in to add a comment