New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 883512 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Sep 21
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

betty-asan failing due to heap-buffer-overflow in libchromeos-ui tests

Project Member Reported by newcomer@chromium.org, Sep 12

Issue description

This is an informational builder, so P-1.

 ASAN error detected:
libchromeos-ui-0.0.1-r1547:  * =================================================================
libchromeos-ui-0.0.1-r1547:  * ==17==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000021c at pc 0x7f284d313c54 bp 0x7ffce81799e0 sp 0x7ffce8179180
libchromeos-ui-0.0.1-r1547:  * READ of size 16 at 0x60200000021c thread T0
libchromeos-ui-0.0.1-r1547:  *     #0 0x7f284d313c53 in __interceptor_memcpy ??:0:0
libchromeos-ui-0.0.1-r1547:  *     #1 0x7f284c7da610 in memcpy(void*, void const* pass_object_size0, unsigned long) /build/betty/tmp/portage/chromeos-base/libchrome-395517-r45/work/libchrome-395517/../../../../../../usr/include/bits/string3.h:65:10
libchromeos-ui-0.0.1-r1547:  *     #2 0x7f284c7da610 in std::__1::enable_if<((is_same<std::__1::allocator<int>, std::__1::allocator<int> >::value) || (!(__has_construct<std::__1::allocator<int>, int*, int>::value))) && (is_trivially_move_constructible<int>::value), void>::type std::__1::allocator_traits<std::__1::allocator<int> >::__construct_backward<int>(std::__1::allocator<int>&, int*, int*, int*&) /usr/bin/../include/c++/v1/memory:1698:0
libchromeos-ui-0.0.1-r1547:  *     #3 0x7f284c7da610 in std::__1::vector<int, std::__1::allocator<int> >::__swap_out_circular_buffer(std::__1::__split_buffer<int, std::__1::allocator<int>&>&) /usr/bin/../include/c++/v1/vector:931:0
libchromeos-ui-0.0.1-r1547:  *     #4 0x7f284c7d9cb3 in void std::__1::vector<int, std::__1::allocator<int> >::__push_back_slow_path<int>(int&&) /usr/bin/../include/c++/v1/vector:1615:5
libchromeos-ui-0.0.1-r1547:  *     #5 0x7f284d23b2ad in std::__1::vector<int, std::__1::allocator<int> >::push_back(int&&) /usr/bin/../include/c++/v1/vector:1652:9
libchromeos-ui-0.0.1-r1547:  *     #6 0x7f284d23b2ad in testing::TestCase::AddTestInfo(testing::TestInfo*) /build/betty/tmp/portage/dev-cpp/gtest-1.8.0-r1/work/googletest-release-1.8.0/googletest-abi_x86_64.amd64/./src/gtest.cc:2755:0
libchromeos-ui-0.0.1-r1547:  *     #7 0x7f284d23b2ad in testing::internal::UnitTestImpl::AddTestInfo(void (*)(), void (*)(), testing::TestInfo*) /build/betty/tmp/portage/dev-cpp/gtest-1.8.0-r1/work/googletest-release-1.8.0/googletest-abi_x86_64.amd64/./src/gtest-internal-inl.h:664:0
libchromeos-ui-0.0.1-r1547:  *     #8 0x7f284d221d73 in testing::internal::MakeAndRegisterTestInfo(char const*, char const*, char const*, char const*, testing::internal::CodeLocation, void const*, void (*)(), void (*)(), testing::internal::TestFactoryBase*) /build/betty/tmp/portage/dev-cpp/gtest-1.8.0-r1/work/googletest-release-1.8.0/googletest-abi_x86_64.amd64/./src/gtest.cc:2556:22
libchromeos-ui-0.0.1-r1547:  *     #9 0x7f284d2f8894 in __cxx_global_var_init.33 /build/betty/var/cache/portage/chromeos-base/libchromeos-ui/out/Default/../../../../../../../tmp/portage/chromeos-base/libchromeos-ui-0.0.1-r1547/work/libchromeos-ui-0.0.1/platform2/libchromeos-ui/chromeos/ui/chromium_command_builder_unittest.cc:130:1
libchromeos-ui-0.0.1-r1547:  *     #10 0x7f284d2f8894 in _GLOBAL__sub_I_chromium_command_builder_unittest.cc /build/betty/var/cache/portage/chromeos-base/libchromeos-ui/out/Default/../../../../../../../tmp/portage/chromeos-base/libchromeos-ui-0.0.1-r1547/work/libchromeos-ui-0.0.1/platform2/libchromeos-ui/chromeos/ui/chromium_command_builder_unittest.cc:0:0
libchromeos-ui-0.0.1-r1547:  *     #11 0x7f284d40e62e in __libc_csu_init /var/tmp/portage/cross-x86_64-cros-linux-gnu/glibc-2.23-r19/work/glibc-2.23/csu/elf-init.c:88:0
libchromeos-ui-0.0.1-r1547:  *     #12 0x7f284b8376c4 in __libc_start_main /var/tmp/portage/cross-x86_64-cros-linux-gnu/glibc-2.23-r19/work/glibc-2.23/csu/../csu/libc-start.c:245:0
libchromeos-ui-0.0.1-r1547:  *     #13 0x7f284d2f9ac8 in _start ??:0:0
libchromeos-ui-0.0.1-r1547:  * 
 
Cc: nya@chromium.org oka@chromium.org
Components: OS>Systems
Summary: betty-asan failing due to heap-buffer-overflow in libchromeos-ui tests (was: betty-asan failing due to leaks in libchromeos-ui)
It doesn't look like it's reporting a leak.

It didn't fail in this run at 2018-09-10 08:09: http://cros-goldeneye/chromeos/healthmonitoring/buildDetails?buildbucketId=8935760638046188128

I think that the first failure was in this build that started 2018-09-11 08:02: http://cros-goldeneye/chromeos/healthmonitoring/buildDetails?buildbucketId=8935670041274521488

And then the most recent build at 2018-09-12 08:09 also failed: http://cros-goldeneye/chromeos/healthmonitoring/buildDetails?buildbucketId=8935579443772288560

libchromeos-ui's code hasn't had substantial changes in a very long time. It was converted to build with gn rather than GYP in https://crrev.com/c/1201282, which went in on 2018-09-09, but I think that should've been in the passing build described above, so it's unlikely to be responsible.

The stack trace looks more like a gtest issue than a libchromeos-ui issue. chromium_command_builder_unittest.cc:130 is an invocation of the TEST_F macro:

TEST_F(ChromiumCommandBuilderTest, IsTestBuild) {
Bluetooth and drivefs are also failing, are they different errors?
Those are not migrated to GN yet.

For chromeos-ui, I double-checked compiler options by GN and GYP, but coundn't find any essential difference.
Cc: manojgupta@chromium.org derat@chromium.org cmt...@chromium.org llozano@chromium.org
Owner: manojgupta@chromium.org
I think that someone on the toolchain team needs to take a look at this. I don't see any evidence in the stack traces that this is related to libchromeos-ui's code. It looks like the error is caused by a gtest macro, but there aren't any recent updates to gtest.

Manoj, I'm assigning this to you since you made an earlier fix to gtest last year. Please let me know if I'm missing something.
Labels: OS-Chrome
Owner: oka@chromium.org
Pretty sure that it was caused by gyp to gn migration.

https://chromium-review.googlesource.com/c/chromiumos/platform2/+/1201282 landed on Sep 9, 10:34 am
betty-asan run on Sept 9 (started at 8am before the CL landed): Passed
https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?id=2925928 

betty-asan run on Sept 10 : Failed
https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?id=2928295

Looking at amd64-generic-asan:
Run that started at 9am before the CL landed: Passed
https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?buildbucketId=8935846625728386016

Next run that started at 12pm and included this CL: Failed
https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?buildbucketId=8935837111261633200

oka@ Can you inspect the command lines differences between gyp vs gn builds? In particular, pay attention to the "-fvisibility=" and "-fsanitize=" flags.

Note that to repo:
$ ./setup_board --board=amd64-generic --profile=asan
(Slightly reduced list of packages for shorter build times)
$ ./build_packages --board=amd64-generic virtual/implicit-system libchromeos-ui
(Run with tests enabled)
$ FEATURES=test emerge-amd64-generic libchromeos-ui
Ah sorry.
Recent changes about asan was not reflected to GN configurations file.
That's why -fsanitize flag is not passed to libchromeos-ui .
I am going to submit https://chromium-review.googlesource.com/c/chromiumos/platform2/+/1223930.
It has been merged.
The unit test is still failing. oka@ Can you capture the compiler command lines for gyp and gn builds and compare them?
Hmm #6 passes on local environment. Not sure what makes difference.

Here is the GN compiler flags and GYP compiler flags.
I will examine them tomorrow.

If it's important to fix the test, please feel free to revert the CL.

gyp_compiler_options.txt
9.8 KB View Download
gn_compiler_options.txt
9.8 KB View Download
This is the first failure in amd64-generic-asan:

https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?id=2926357

Bad version:  R71-11051.0.0-b2926357
Good version: R71-11050.0.0-b2925965
Delta: https://crosland.corp.google.com/log/11050.0.0..11051.0.0

Only change mentioning libchromeos-ui:

	879f680c	1201282	767517	Fri Aug 31 04:24:16 2018	oka@chromium.org	libchromeos-ui: migrate the package to GN

Which basically confirms what has already been identified.

I'd hate to have to revert back to using GYP, especially if we have the same root cause for the vpn-manager failures (that's next on my list to triage).

We can definitely wait until tomorrow, thanks for investigating!

First failure for vpn-manager:
https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?id=2943276

Bad version: R71-11067.0.0-b2943276
Good version: R71-11066.0.0-b2942607
Delta: https://crosland.corp.google.com/log/11066.0.0..11067.0.0

Suspect CL is the same root cause as suspected:

	2b8a5484	1201248	767517	Fri Aug 31 04:24:16 2018	oka@chromium.org	vpn: migrate the package to GN

The command lines in #11 are identical so I am not sure what could be causing the fails.

oka@ can you dump and compare output of env before the test starts running? Maybe, something is different here which is causing the fails.

Comment 15 Deleted

Comment 16 Deleted

Sorry I couldn't figure it out today. Thank you for creating the reverts. Let's submit them.
OK. I reproduced the error locally using betty.
Here are the compile commands of GYP and GN.

Commands I ran are as follows:

% cros_sdk BOARD=betty
$ FEATURES=test emerge-amd64-generic libchromeos-ui
$ ./setup_board --board=$BOARD --profile=asan
$ ./build_packages --board=$BOARD libchromeos-ui
$ VERBOSE=1 FEATURES=test emerge-$BOARD libchromeos-ui

Are the attached logs in #18 correct? The command lines are referring to amd64-generic, not betty.
I'm sorry. They are not correct. Re-uploaded correct files.

gyp_compiler_options.txt
9.3 KB View Download
gn_compiler_options.txt
7.6 KB View Download
One possible suspect:
GYP linked binaries have the linker options that are missing from GN builds:
-Wl,-rpath=$ORIGIN/lib/
-Wl,-rpath-link=lib/

There is also another giant if-else statement in GYP builds that is not present in GN builds, but not sure how important that is:
mmon-mk/libtestrunner.a obj/common-mk/testrunner.testrunner.o
[6/8] if [ ! -e lib/libchromeos-ui-395517.so -o ! -e
lib/libchromeos-ui-395517.so.TOC ]; then x86_64-cros-linux-gnu-clang++ -shared
-Wl,-O1 -Wl,-O2 -Wl,--as-needed -fsanitize=address -fsanitize=alignment
-fsanitize=shift -Wl,-z,relro -Wl,-z,noexecstack -Wl,-z,now -Wl,--as-needed
--sysroot=/build/betty -o lib/libchromeos-ui-395517.so
-Wl,-soname=libchromeos-ui-395517.so @lib/libchromeos-ui-395517.so.rsp && {
readelf -d lib/libchromeos-ui-395517.so | grep SONAME ; nm -gD -f p
lib/libchromeos-ui-395517.so | cut -f1-2 -d' '; } >
lib/libchromeos-ui-395517.so.TOC; else x86_64-cros-linux-gnu-clang++ -shared
-Wl,-O1 -Wl,-O2 -Wl,--as-needed -fsanitize=address -fsanitize=alignment
-fsanitize=shift -Wl,-z,relro -Wl,-z,noexecstack -Wl,-z,now -Wl,--as-needed
--sysroot=/build/betty -o lib/libchromeos-ui-395517.so
-Wl,-soname=libchromeos-ui-395517.so @lib/libchromeos-ui-395517.so.rsp && {
readelf -d lib/libchromeos-ui-395517.so | grep SONAME ; nm -gD -f p
lib/libchromeos-ui-395517.so | cut -f1-2 -d' '; } >
lib/libchromeos-ui-395517.so.tmp && if ! cmp -s lib/libchromeos-ui-395517.so.tmp
lib/libchromeos-ui-395517.so.TOC; then mv lib/libchromeos-ui-395517.so.tmp
lib/libchromeos-ui-395517.so.TOC ; fi; fi
Project Member

Comment 23 by bugdroid1@chromium.org, Sep 18

Hmm. Ok. It turned out to be the matter of library ordering.

On compiling libchromeos-ui-test, if -lgtest is before -lbase-395517 (gyp case), heap buffer overflow doesn't happen. However, if -lgtest is after -lbase-395517 (gn case), it does happen.

So if I make sure -lgtest comes first tweaking BUILD.gn, the issue is actually gone, though it doesn't seem a correct solution.

Interesting, seems like some symbols in libbase are being exported when they shouldn't be since gtest and libbase symbol set should be exclusive. 

Let's fix the library ordering so that this issue doesn't block GN migration.
Components: -OS>Systems
Status: Fixed (was: Assigned)
Filed crbug.com/887845 to fix the root cause.
Project Member

Comment 28 by bugdroid1@chromium.org, Sep 24

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/b9d7e317d1cbeba858ecce0a9f47eab6a6c00260

commit b9d7e317d1cbeba858ecce0a9f47eab6a6c00260
Author: Keigo Oka <oka@chromium.org>
Date: Mon Sep 24 13:49:58 2018

libchromeos-ui: reland GN migration fixing ASAN failure

Fixed the issue moving //common-mk:test at the top of configs.

BUG= chromium:883512 
BUG=chromium:767517
TEST=Following commands doesn't produce ASAN error. Though the test itself
fails samely as GYP build on the same assert.
    % cros_sdk BOARD=betty
    $ ./setup_board --board=$BOARD --profile=asan
    $ ./build_packages --board=$BOARD libchromeos-ui
    $ VERBOSE=1 FEATURES=test emerge-$BOARD libchromeos-ui

Change-Id: I94cecf3e086eb26a6bd276de0381e23a85606c41
Reviewed-on: https://chromium-review.googlesource.com/1234094
Commit-Ready: Keigo Oka <oka@chromium.org>
Tested-by: Keigo Oka <oka@chromium.org>
Reviewed-by: Keigo Oka <oka@chromium.org>
Reviewed-by: Shuhei Takahashi <nya@chromium.org>

[delete] https://crrev.com/338cca8ec776ca69c51294b45af8cf99c416497e/libchromeos-ui/libchromeos-ui.gyp
[add] https://crrev.com/b9d7e317d1cbeba858ecce0a9f47eab6a6c00260/libchromeos-ui/BUILD.gn

Project Member

Comment 29 by bugdroid1@chromium.org, Sep 24

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/65a255d1ec9dbfde65adb8b3c6a200c2ff1a6ecd

commit 65a255d1ec9dbfde65adb8b3c6a200c2ff1a6ecd
Author: Keigo Oka <oka@chromium.org>
Date: Mon Sep 24 13:49:55 2018

vpn: reland GN migration with fixing ASAN failure

Fixed the issue moving //common-mk:test at the top of configs.

BUG= chromium:883512 
BUG=chromium:767517
TEST=% cros_sdk BOARD=betty
    $ ./setup_board --board=$BOARD --profile=asan
    $ ./build_packages --board=$BOARD vpn-manager
    $ VERBOSE=1 FEATURES=test emerge-$BOARD vpn-manager

Change-Id: I65f500746e87e37d69ce98b0505860dd80be8de7
Reviewed-on: https://chromium-review.googlesource.com/1234095
Commit-Ready: Keigo Oka <oka@chromium.org>
Tested-by: Keigo Oka <oka@chromium.org>
Reviewed-by: Keigo Oka <oka@chromium.org>
Reviewed-by: Shuhei Takahashi <nya@chromium.org>

[delete] https://crrev.com/690b750f755f7282ec37daa993e894d08d656b6d/vpn-manager/vpn-manager.gyp
[add] https://crrev.com/65a255d1ec9dbfde65adb8b3c6a200c2ff1a6ecd/vpn-manager/BUILD.gn

Sign in to add a comment