New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 760051 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Ill in sandbox::ResourceLimits::AdjustCurrent

Project Member Reported by ClusterFuzz, Aug 29 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6171607952523264

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Ill
Crash Address: 0x7fb653330e28
Crash State:
  sandbox::ResourceLimits::AdjustCurrent
  v8::internal::wasm::NewArrayBuffer
  v8::WebAssemblyMemory
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495357:495412

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6171607952523264

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Core
Labels: Test-Predator-Wrong-CLs M-62
Owner: eholk@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "resource_limits.cc" assigning to the concern owner from GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/f35574bba03c09b60ca6fa4cb9428c873f3706ef

@eholk -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by eholk@chromium.org, Aug 29 2017

This looks pretty similar to the issue in https://bugs.chromium.org/p/chromium/issues/detail?id=759533.

The stack trace shows a crash in ValueOrDie in the safe math library. This means we got an overflow and the browser chose to safely crash instead, which is the expected behavior.

I'm concerned about why we got the overflow in the first place though, so I will investigate further.

Comment 3 by eholk@chromium.org, Aug 29 2017

Status: Started (was: Assigned)
The reason we were getting an overflow is that the limits had not been lowered from their initial maximum. The fix is to clamp the limit changes at rlim_max so that we will continue to work even when the limits have not been lowered.

There is a fix out for review at https://chromium-review.googlesource.com/c/chromium/src/+/642350

Project Member

Comment 4 by bugdroid1@chromium.org, Aug 30 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87

commit 5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87
Author: Eric Holk <eholk@chromium.org>
Date: Wed Aug 30 01:03:21 2017

Clamp resource limit adjustment to current hard limit

Attempting to raise the soft limit was failing if the limit had not
previously been lowered. This change clamps the new limit to rlim_max,
which means it will continue to work even if the resource limit is at
its maximum.

Bug:  chromium:760051 
Change-Id: Ia57a6dcdb1e28ffe12c3883f91a9427339d63be2
Reviewed-on: https://chromium-review.googlesource.com/642350
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#498323}
[modify] https://crrev.com/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87/sandbox/linux/services/resource_limits.cc
[modify] https://crrev.com/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87/sandbox/linux/services/resource_limits.h

Project Member

Comment 5 by ClusterFuzz, Aug 30 2017

ClusterFuzz has detected this issue as fixed in range 498140:498364.

Detailed report: https://clusterfuzz.com/testcase?key=6171607952523264

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Ill
Crash Address: 0x7fb653330e28
Crash State:
  sandbox::ResourceLimits::AdjustCurrent
  v8::internal::wasm::NewArrayBuffer
  v8::WebAssemblyMemory
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495357:495412
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=498140:498364

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6171607952523264

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 30 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6171607952523264 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment