New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 721352 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in base::PersistentHistogramAllocator::CreateHistogram

Project Member Reported by ClusterFuzz, May 11 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4653417418194944

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7f57b8a60194
Crash State:
  base::PersistentHistogramAllocator::CreateHistogram
  base::PersistentHistogramAllocator::GetHistogram
  base::GlobalHistogramAllocator::ImportHistogramsToStatisticsRecorder
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=468321:468328

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4653417418194944


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Metrics
Labels: M-60 Test-Predator-Correct-CLs
Owner: bcwh...@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: bcwhite
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fa8485bd1548ab76854d5d01ea2c4cd31d719aeb
Time: Mon May 01 16:43:25 2017
Lines 279-284 of file histogram.cc which potentially caused crash are changed in this cl (frame #5, "base::Histogram::FactoryTimeGet"). 

Lines 608-612 of file persistent_histogram_allocator.cc which potentially caused crash are changed in this cl (frame #0, "base::PersistentHistogramAllocator::CreateHistogram").
Minimum distance from crash line to modified line: 0. (file: histogram.cc, crashed on: 279, modified: 279).

@bcwhite -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by bugdroid1@chromium.org, May 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e0ecce46642e1d001deae09f41429c44517d84b9

commit e0ecce46642e1d001deae09f41429c44517d84b9
Author: bcwhite <bcwhite@chromium.org>
Date: Fri May 12 00:30:18 2017

Copy only accessed PersistentHistogramData fields when validating.

The DelayedPersistentAllocation added an atomic field to the
PersistentHistogramData structure that cannot be copied using
operator= (at least not without redefining it).  Copies of only
some of the fields are needed so explicitly copy only those; the
atomic field is not one of them.

BUG= 721352 

Review-Url: https://codereview.chromium.org/2875643004
Cr-Commit-Position: refs/heads/master@{#471143}

[modify] https://crrev.com/e0ecce46642e1d001deae09f41429c44517d84b9/base/metrics/persistent_histogram_allocator.cc

Status: Fixed (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, May 16 2017

ClusterFuzz has detected this issue as fixed in range 471790:471812.

Detailed report: https://clusterfuzz.com/testcase?key=4653417418194944

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7f57b8a60194
Crash State:
  base::PersistentHistogramAllocator::CreateHistogram
  base::PersistentHistogramAllocator::GetHistogram
  base::GlobalHistogramAllocator::ImportHistogramsToStatisticsRecorder
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=468321:468328
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=471790:471812

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4653417418194944


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
New report appears to be  Issue 722169 , which is also (just) fixed.

Sign in to add a comment