New issue
Advanced search Search tips

Issue 868644 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 1
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug

Blocking:
issue 852111



Sign in to add a comment

ASSERT: eglInitialize(cookie.display, NULL, NULL)

Project Member Reported by ClusterFuzz, Jul 28

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5409626817036288

Fuzzer: libFuzzer_chromeos_virgl_fuzzer
Job Type: libfuzzer_asan_chromeos
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  eglInitialize(cookie.display, NULL, NULL)
  virgl_fuzzer.c
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=2790753:2791191

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5409626817036288

Issue filed automatically.

See https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md#Reproducing-crashes-from-ClusterFuzz for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 28

Cc: davidriley@google.com marcheu@google.com zachr@google.com
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by sheriffbot@chromium.org, Jul 28

Labels: M-69 Target-69
Project Member

Comment 3 by sheriffbot@chromium.org, Jul 28

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Jul 28

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Jul 29

Labels: -Security_Impact-Head Security_Impact-Beta
Components: OS>Kernel>Graphics
Labels: -Type-Bug-Security -Pri-1 -Restrict-View-SecurityTeam -Security_Severity-High -Security_Impact-Beta -ReleaseBlock-Stable -M-69 -Target-69 Pri-2 Type-Bug
Owner: davidri...@chromium.org
Stack trace for convenience:

virgl_fuzzer: virgl_fuzzer.c:125: int initialize_environment(): Assertion `eglInitialize(cookie.display, NULL, NULL)' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7ff937e7cdd2 bp 0x7ffe2933e390 sp 0x7ffe2933e268 T0)
SCARINESS: 10 (signal)
#0 0x7ff937e7cdd1 in gsignal
#1 0x7ff937e75d64 in libc.so.6
#2 0x7ff937e75e12 in __assert_fail
#3 0x55e331d63bba in initialize_environment /build/amd64-generic/tmp/portage/media-libs/virglrenderer-0.6.0_p20180727-r1/work/virglrenderer-9c420d224d86215d408dff8dea599ed9414a24d6/tests/fuzzer/virgl_fuzzer.c:125:7
#4 0x55e331d63bba in LLVMFuzzerTestOneInput /build/amd64-generic/tmp/portage/media-libs/virglrenderer-0.6.0_p20180727-r1/work/virglrenderer-9c420d224d86215d408dff8dea599ed9414a24d6/tests/fuzzer/virgl_fuzzer.c:168
#5 0x55e331c6ea4c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long)
#6 0x55e331c5f426 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long)
#7 0x55e331c652cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long))
#8 0x55e331c8fc82 in main
#9 0x7ff937e69735 in __libc_start_main
#10 0x55e331c5e9e8 in _start


Failure to initialize EGL -> fuzzer init / infra problem and not a security issue. Relabeling appropriately.
This error is because surfaceless still expects the DRM device nodes which aren't available in the minijail'd clusterfuzz.  Changes to address this are currently blocked on mesa upstream.

I've posted ebuild patch that would get us blocked in the interim while continuing to work with upstream to get the patches in:
https://chromium-review.googlesource.com/c/chromiumos/overlays/chromiumos-overlay/+/1153992
Blocking: 852111
Cc: pwang@chromium.org
Status: Fixed (was: Untriaged)
Fixed from change in c#7.
Project Member

Comment 11 by ClusterFuzz, Aug 2

ClusterFuzz has detected this issue as fixed in range 2801419:2801745.

Detailed report: https://clusterfuzz.com/testcase?key=5409626817036288

Fuzzer: libFuzzer_chromeos_virgl_fuzzer
Job Type: libfuzzer_asan_chromeos
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  eglInitialize(cookie.display, NULL, NULL)
  virgl_fuzzer.c
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=2790753:2791191
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=2801419:2801745

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5409626817036288

See https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md#Reproducing-crashes-from-ClusterFuzz for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Aug 2

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5409626817036288 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment