Issue metadata
Sign in to add a comment
|
Mac GPU ASAN bot failing with buffer overflow in gpu::gles2::Program::Update() |
||||||||||||||||||||||
Issue description
The Mac ASAN bot on the chromium.gpu.fyi waterfall has been red for a while. It's building again after the fixes in Issue 742004 and earlier bugs and is catching a real bug now in gles2_conform_test. Full excerpt from one of the failures follows. Investigating.
==3600==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff580d186d at pc 0x00010905a24e bp 0x7fff580ce7f0 sp 0x7fff580ce7e8
READ of size 1 at 0x7fff580d186d thread T0
#0 0x10905a24d in gpu::gles2::Program::Update() ??:0:0
#1 0x109067e56 in gpu::gles2::Program::Link(gpu::gles2::ShaderManager*, gpu::gles2::Program::VaryingsPackingOption, gpu::gles2::GLES2DecoderClient*) ??:0:0
#2 0x108f56ae6 in gpu::gles2::GLES2DecoderImpl::DoLinkProgram(unsigned int) ??:0:0
#3 0x108ed0bf8 in gpu::gles2::GLES2DecoderImpl::HandleLinkProgram(unsigned int, void const volatile*) ??:0:0
#4 0x108f37928 in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) ??:0:0
#5 0x108e29a78 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) ??:0:0
#6 0x108e282a4 in gpu::CommandBufferDirect::Flush(int) ??:0:0
#7 0x107d996db in gpu::CommandBufferHelper::Flush() ??:0:0
#8 0x107d9a17e in gpu::CommandBufferHelper::Finish() ??:0:0
#9 0x107f934dd in gpu::gles2::GLES2Implementation::WaitForCmd() ??:0:0
#10 0x107feb267 in gpu::gles2::GLES2Implementation::IsShader(unsigned int) ??:0:0
#11 0x107d780dc in GTFLinkProgram_2_0 ??:0:0
#12 0x107d38430 in GTFTestBuildGLApply ??:0:0
#13 0x107d552fb in GTFRunTest ??:0:0
#14 0x107d50464 in GTFRunTestDriver ??:0:0
#15 0x107d23d0f in GTFRun ??:0:0
#16 0x107d189b3 in GTFInitEGL ??:0:0
#17 0x107d22939 in GTFMain ??:0:0
#18 0x107d8dfa8 in main ??:0:0
#19 0x7fff9475d234 in start ??:0:0
Address 0x7fff580d186d is located in stack of thread T0 at offset 301 in frame
#0 0x107d53fbf in GTFRunTest ??:0:0
This frame has 9 object(s):
[32, 40) 'mode'
[64, 72) 'pattern'
[96, 104) 'root'
[128, 132) 'err_line'
[144, 160) 'dir'
[176, 192) 'name'
[208, 224) 'ext'
[240, 256) 'group_name'
[272, 288) 'err_msg' <== Memory access at offset 301 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/b/s/w/ir/out/Release/gles2_conform_test_windowless:x86_64+0x10152d24d)
Shadow bytes around the buggy address:
0x1fffeb01a2b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1fffeb01a2c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1fffeb01a2d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1fffeb01a2e0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
0x1fffeb01a2f0: 00 f2 f2 f2 00 f2 f2 f2 04 f2 00 00 f2 f2 00 00
=>0x1fffeb01a300: f2 f2 00 00 f2 f2 00 00 f2 f2 00 00 f3[f3]f3 f3
0x1fffeb01a310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1fffeb01a320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1fffeb01a330: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x1fffeb01a340: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2
0x1fffeb01a350: 00 00 f2 f2 00 f2 f2 f2 04 f2 00 00 00 f3 f3 f3
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3600==ABORTING
gen/gpu/gles2_conform_support/gles2_conform_test_autogen.cc:566: Failure
Value of: RunGLES2ConformTest("GL2Tests/validate_program/input.run")
Actual: false
Expected: true
[ FAILED ] GLES2ConformTest.GL2Tests_validate_program_input_run (262 ms)
,
Jul 13 2017
The bug's caused specifically by this test harness. Fix in https://chromium-review.googlesource.com/570675/ .
,
Jul 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d72b8780344f261a3b29b13f9af757d635ac1144 commit d72b8780344f261a3b29b13f9af757d635ac1144 Author: Kenneth Russell <kbr@chromium.org> Date: Fri Jul 14 02:05:01 2017 Fixed ASAN error in gles2_conform_test. Make a copy of the GpuPreferences inside the ContextGroup to make it easier for all callers -- including test harnesses -- to be correct. BUG= 742440 Change-Id: I839866e24ec6ebe7b88e7012b7165ac5f9e10bc0 Reviewed-on: https://chromium-review.googlesource.com/570675 Reviewed-by: Zhenyao Mo <zmo@chromium.org> Reviewed-by: Antoine Labour <piman@chromium.org> Commit-Queue: Kenneth Russell <kbr@chromium.org> Cr-Commit-Position: refs/heads/master@{#486630} [modify] https://crrev.com/d72b8780344f261a3b29b13f9af757d635ac1144/gpu/command_buffer/service/context_group.h
,
Jul 14 2017
,
Jul 15 2017
This bot's finally green again as of https://luci-milo.appspot.com/buildbot/chromium.gpu.fyi/Mac%20GPU%20ASAN%20Release/5060 .
,
Oct 14 2017
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by kbr@chromium.org
, Jul 13 2017Incredibly, it's this dereference: ==32404==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff5d2e490d at pc 0x000104bd611e bp 0x7fff5d2e1670 sp 0x7fff5d2e1668 READ of size 1 at 0x7fff5d2e490d thread T0 #0 0x104bd611d in gpu::gles2::Program::Update() program_manager.cc:770 #1 0x104be3ff6 in gpu::gles2::Program::Link(gpu::gles2::ShaderManager*, gpu::gles2::Program::VaryingsPackingOption, gpu::gles2::GLES2DecoderClient*) program_manager.cc:1430 #2 0x104ac4bd6 in gpu::gles2::GLES2DecoderImpl::DoLinkProgram(unsigned int) gles2_cmd_decoder.cc:8786 #3 0x104a38538 in gpu::gles2::GLES2DecoderImpl::HandleLinkProgram(unsigned int, void const volatile*) gles2_cmd_decoder_autogen.h:2400 #4 0x104aa3698 in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gles2_cmd_decoder.cc:5285 which is: >>if (manager_->gpu_preferences_.enable_gpu_service_logging_gpu) { DVLOG(1) << "----: attribs for service_id: " << service_id(); for (size_t ii = 0; ii < attrib_infos_.size(); ++ii) { The gpu_preferences_ reference appears to have gone stale. Certainly manually removing this dereference fixes the ASAN error.