1402599 - AddressSanitizer: heap-use-after-free [@ mozilla::LinkedListElement<JS::PersistentRooted<JS::Value> >::remove] with WRITE of size 4 with EvalInCooperativeThread

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 2cd3752963fc (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --disable-debug --without-intl-api --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2 --target=i686-pc-linux-gnu, run with --fuzzing-safe --cpu-count=2 --disable-oom-functions --ion-aa=flow-sensitive --ion-offthread-compile=off):

evalInCooperativeThread(`
Object.defineProperty(this, "fuzzutils", {
    value:{
        newGlobal: newGlobal,
    }
});
newGlobal = function(o) {
  let g = fuzzutils.newGlobal(o);
  return g;
}
g = newGlobal();
dbg = Debugger(g);
`);
evalInCooperativeThread(`
`);


Backtrace:

==28516==ERROR: AddressSanitizer: heap-use-after-free on address 0xf551c480 at pc 0x082642be bp 0xe3bfeee8 sp 0xe3bfeedc
WRITE of size 4 at 0xf551c480 thread T39
    #0 0x82642bd in mozilla::LinkedListElement<JS::PersistentRooted<JS::Value> >::remove() dist/include/mozilla/LinkedList.h:245:18
    #1 0x82642bd in mozilla::LinkedListElement<JS::PersistentRooted<JS::Value> >::~LinkedListElement() dist/include/mozilla/LinkedList.h:198
    #2 0x82642bd in js::shell::ShellContext::~ShellContext() js/src/shell/jsshell.h:171
    #3 0x8239af1 in void js_delete<js::shell::ShellContext>(js::shell::ShellContext const*) dist/include/js/Utility.h:454:9
    #4 0x8239af1 in JS::DeletePolicy<js::shell::ShellContext>::operator()(js::shell::ShellContext const*) dist/include/js/Utility.h:556
    #5 0x8239af1 in mozilla::UniquePtr<js::shell::ShellContext, JS::DeletePolicy<js::shell::ShellContext> >::reset(js::shell::ShellContext*) dist/include/mozilla/UniquePtr.h:343
    #6 0x8239af1 in mozilla::UniquePtr<js::shell::ShellContext, JS::DeletePolicy<js::shell::ShellContext> >::~UniquePtr() dist/include/mozilla/UniquePtr.h:288
    #7 0x8239af1 in WorkerMain(void*) js/src/shell/js.cpp:3539
    #8 0x8258d12 in void js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::callMain<0u>(mozilla::IndexSequence<0u>) js/src/threading/Thread.h:234:5
    #9 0x8258d12 in js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::Start(void*) js/src/threading/Thread.h:227
    #10 0x81a1caa in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:183
    #11 0x80de5a2 in asan_thread_start(void*) /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:229
    #12 0xf76d1289 in start_thread /build/glibc-GKVZIf/glibc-2.23/nptl/pthread_create.c:333
    #13 0xf73e24cd in clone (/lib32/libc.so.6+0xe54cd)

0xf551c480 is located 64 bytes inside of 400-byte region [0xf551c440,0xf551c5d0)
freed by thread T38 here:
    #0 0x8191924 in __interceptor_free /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38
    #1 0x8239afd in js_free(void*) dist/include/js/Utility.h:328:5
    #2 0x8239afd in void js_delete<js::shell::ShellContext>(js::shell::ShellContext const*) dist/include/js/Utility.h:455
    #3 0x8239afd in JS::DeletePolicy<js::shell::ShellContext>::operator()(js::shell::ShellContext const*) dist/include/js/Utility.h:556
    #4 0x8239afd in mozilla::UniquePtr<js::shell::ShellContext, JS::DeletePolicy<js::shell::ShellContext> >::reset(js::shell::ShellContext*) dist/include/mozilla/UniquePtr.h:343
    #5 0x8239afd in mozilla::UniquePtr<js::shell::ShellContext, JS::DeletePolicy<js::shell::ShellContext> >::~UniquePtr() dist/include/mozilla/UniquePtr.h:288
    #6 0x8239afd in WorkerMain(void*) js/src/shell/js.cpp:3539
    #7 0x8258d12 in void js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::callMain<0u>(mozilla::IndexSequence<0u>) js/src/threading/Thread.h:234:5
    #8 0x8258d12 in js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::Start(void*) js/src/threading/Thread.h:227
    #9 0x81a1caa in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:183

previously allocated by thread T38 here:
    #0 0x8191cc4 in __interceptor_malloc /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52
    #1 0x8238969 in js_malloc(unsigned int) dist/include/js/Utility.h:300:12
    #2 0x8238969 in js::shell::ShellContext* js_new<js::shell::ShellContext, JSContext*&>(JSContext*&) dist/include/js/Utility.h:417
    #3 0x8238969 in js::detail::UniqueSelector<js::shell::ShellContext>::SingleObject js::MakeUnique<js::shell::ShellContext, JSContext*&>(JSContext*&) dist/include/js/UniquePtr.h:48
    #4 0x8238969 in WorkerMain(void*) js/src/shell/js.cpp:3470
    #5 0x8258d12 in void js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::callMain<0u>(mozilla::IndexSequence<0u>) js/src/threading/Thread.h:234:5
    #6 0x8258d12 in js::detail::ThreadTrampoline<void (&)(void*), WorkerInput*&>::Start(void*) js/src/threading/Thread.h:227
    #7 0x81a1caa in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:183

Thread T39 created by T0 here:
    #0 0x8177900 in __interceptor_pthread_create /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:239
    #1 0x9af0889 in js::Thread::create(void* (*)(void*), void*) js/src/threading/posix/Thread.cpp:104:7
    #2 0x8258b2b in bool js::Thread::init<void (&)(void*), WorkerInput*&>(void (&)(void*), WorkerInput*&) js/src/threading/Thread.h:117:12
    #3 0x8237f7f in EvalInThread(JSContext*, unsigned int, JS::Value*, bool) js/src/shell/js.cpp:3632:21
    #4 0x8216b5b in EvalInCooperativeThread(JSContext*, unsigned int, JS::Value*) js/src/shell/js.cpp:3666:12
    #5 0x52270f02  (<unknown module>)
    #6 0xf05cf20f  (<unknown module>)
    #7 0x522ddd8d  (<unknown module>)

Thread T38 created by T0 here:
    #0 0x8177900 in __interceptor_pthread_create /srv/repos/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:239
    #1 0x9af0889 in js::Thread::create(void* (*)(void*), void*) js/src/threading/posix/Thread.cpp:104:7
    #2 0x8258b2b in bool js::Thread::init<void (&)(void*), WorkerInput*&>(void (&)(void*), WorkerInput*&) js/src/threading/Thread.h:117:12
    #3 0x8237f7f in EvalInThread(JSContext*, unsigned int, JS::Value*, bool) js/src/shell/js.cpp:3632:21
    #4 0x8216b5b in EvalInCooperativeThread(JSContext*, unsigned int, JS::Value*) js/src/shell/js.cpp:3666:12
    #5 0x52270f02  (<unknown module>)
    #6 0xf05cf20f  (<unknown module>)
    #7 0x522ddd8d  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free dist/include/mozilla/LinkedList.h:245:18 in mozilla::LinkedListElement<JS::PersistentRooted<JS::Value> >::remove()
Shadow bytes around the buggy address:
  0x3eaa3880: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x3eaa3890:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x3eaa38a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Heap left redzone:       fa
  Freed heap region:       fd
==28516==ABORTING

Comment 1

[Christian Holler (:decoder)]

Shell-only, not a security bug.

Comment 2

[Naveed Ihsanullah [:naveed]]

Nicolas can you please take a look?

Comment 3

[Nicolas B. Pierron [:nbp] {away}]

(In reply to Naveed Ihsanullah [:naveed] from comment #2)
> Nicolas can you please take a look?

This one sounds really weird, the UniquePtr of the ShellContext should prevent us from having this issue, and the fact that it is aliased with a different type sounds really weird.

I will analyze this issue later.

Comment 4

[Jan de Mooij [:jandem]]

Does this still repro? This might be a duplicate of a patch I reviewed a while ago.

Comment 5

[Christian Holler (:decoder)]

Just manually confirmed that this is fixed.