New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 739695 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jul 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in close

Project Member Reported by ClusterFuzz, Jul 6 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4960981645262848

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 8
Crash Address: 0x7ba000004810
Crash State:
  close
  libasound.so.2
  midi::MidiManager::ShutdownOnSessionThread
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=484025:484263

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4960981645262848


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Labels: M-61 Test-Predator-Wrong
Owner: toyoshim@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "midi_manager.cc" assigning to the concern owner using GIT Blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/29aaa95a4444e6d4ce9bb789cc7996821f044e52

@toyoshim -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: Started (was: Assigned)
Cc: agoode@chromium.org
cc: agoode for code review
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6ada1228cab216200b10d43871266639f9db9ac8

commit 6ada1228cab216200b10d43871266639f9db9ac8
Author: Takashi Toyoshima <toyoshim@chromium.org>
Date: Wed Jul 19 09:54:14 2017

Web MIDI: fix a data race on close in ShutdownOnSessionThread

This patch reintroduce lazy_init_member_lock_ to avoid a potential
data race on close. It protects members that are initialized before
other thread usages and are finalized after all other usages.

Also this patch add new dedicated lock for out_client_ so to
fix another potential race of SendMidiData. out_client_ is exceptionally
destructed to notify the event loop running on another thread to quit.

Bug:  739695 
Test: clusterfuzz reproduce 4960981645262848 --current
Change-Id: Ied8cd0d10dc9fcd4881dbe5f17c05276b67d28d8
Reviewed-on: https://chromium-review.googlesource.com/571211
Reviewed-by: Adam Goode <agoode@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#487809}
[modify] https://crrev.com/6ada1228cab216200b10d43871266639f9db9ac8/media/midi/midi_manager_alsa.cc
[modify] https://crrev.com/6ada1228cab216200b10d43871266639f9db9ac8/media/midi/midi_manager_alsa.h

Project Member

Comment 5 by ClusterFuzz, Jul 20 2017

ClusterFuzz has detected this issue as fixed in range 487805:487810.

Detailed report: https://clusterfuzz.com/testcase?key=4960981645262848

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 8
Crash Address: 0x7ba000004810
Crash State:
  close
  libasound.so.2
  midi::MidiManager::ShutdownOnSessionThread
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=484025:484263
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=487805:487810

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4960981645262848


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Status: Fixed (was: Started)

Sign in to add a comment