Closed Bug 1931589 Opened 1 year ago Closed 1 year ago

AddressSanitizer: attempting free on address which was not malloc()-ed [@ free]

Categories

(Core :: Graphics: WebGPU, defect, P1)

Product:
Core
Component:
Graphics: WebGPU
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
135 Branch
Tracking Flags:
Tracking Status
firefox-esr128 --- unaffected
firefox132 --- unaffected
firefox133 --- unaffected
firefox134 --- disabled
firefox135 --- fixed

People

(Reporter: jkratzer, Assigned: ErichDonGubler)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files, 2 obsolete files)

Detailed Crash Information
10.17 KB, text/plain
Details
testcase.html
718 bytes, text/html
Details

Testcase found while fuzzing mozilla-central rev f918befd4231 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build f918befd4231 --asan --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

AddressSanitizer: attempting free on address which was not malloc()-ed [@ free]

    =================================================================
    ==169843==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x028000001102 in thread T100
        #0 0x5c446676f0e6 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
        #1 0x7a76f9a8ef72  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x6ff72) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #2 0x7a76f9a91f18  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x72f18) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #3 0x7a76f9a8229d  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x6329d) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #4 0x7a76f9b26bd8  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x107bd8) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #5 0x7a76f9b26e82  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x107e82) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #6 0x7a76f9b1880a  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0xf980a) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
        #7 0x5c446676b578 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
        #8 0x7a77773bbac2 in start_thread nptl/pthread_create.c:442:8
        #9 0x7a777744ca03 in __clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100
    
    Address 0x028000001102 is located in the high shadow area.
    SUMMARY: AddressSanitizer: bad-free (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0x6ff72) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1) 
    Thread T100 created by T51 here:
        #0 0x5c4466754f81 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x7a76f9b18a23  (/usr/lib/x86_64-linux-gnu/libvulkan_lvp.so+0xf9a23) (BuildId: 638a2bc959cbdb1a2f670c878df950dcd76eedf1)
    
    Thread T51 created by T0 here:
        #0 0x5c4466754f81 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x7a7776ddbfb8 in _PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10
        #2 0x7a7776dca12e in PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10
        #3 0x7a77559f80d1 in nsThread::Init(nsTSubstring<char> const&) /gecko/xpcom/threads/nsThread.cpp:615:20
        #4 0x7a7755a05b86 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /gecko/xpcom/threads/nsThreadManager.cpp:606:22
        #5 0x7a7755a106c9 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /gecko/xpcom/threads/nsThreadUtils.cpp:176:57
        #6 0x7a77589a3abd in NS_NewNamedThread<15UL> /gecko/xpcom/threads/nsThreadUtils.h:76:10
        #7 0x7a77589a3abd in mozilla::gfx::CanvasRenderThread::Start() /gecko/gfx/ipc/CanvasRenderThread.cpp:115:17
        #8 0x7a775879ba4d in gfxPlatform::Init() /gecko/gfx/thebes/gfxPlatform.cpp:969:3
        #9 0x7a775fef6ff4 in GetPlatform /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:182:7
        #10 0x7a775fef6ff4 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /gecko/widget/GfxInfoBase.cpp:1809:25
        #11 0x7a7755a4507d in NS_InvokeByIndex /gecko/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101
        #12 0x7a775729a96a in Invoke /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1620:10
        #13 0x7a775729a96a in Call /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1174:19
        #14 0x7a775729a96a in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1120:23
        #15 0x7a775729f60c in GetAttribute /gecko/js/xpconnect/src/xpcprivate.h:1451:12
        #16 0x7a775729f60c in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /gecko/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1006:10
        #17 0x7a776207b494 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:532:13
        #18 0x7a776207b494 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:628:12
        #19 0x7a776207d3cc in InternalCall /gecko/js/src/vm/Interpreter.cpp:695:10
        #20 0x7a776207d3cc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:727:8
        #21 0x7a776207f1ba in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:849:10
        #22 0x7a77623edb1a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2149:12
        #23 0x7a77623c4f87 in GetExistingProperty<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2177:12
        #24 0x7a77623c4f87 in NativeGetPropertyInline<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2330:14
        #25 0x7a77623c4f87 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2360:10
        #26 0x7a77630ff8da in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:117:10
        #27 0x7a77630ff8da in GetObjectElementOperation /gecko/js/src/vm/Interpreter-inl.h:394:10
        #28 0x7a77630ff8da in GetElementOperationWithStackIndex /gecko/js/src/vm/Interpreter-inl.h:491:10
        #29 0x7a77630ff8da in GetElementOperation /gecko/js/src/vm/Interpreter-inl.h:499:10
        #30 0x7a77630ff8da in js::jit::DoGetElemFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/jit/BaselineIC.cpp:727:8
        #31 0x1124f6b4cbf3  ([anon:js-executable-memory]+0x2bf3)
        #32 0x1124f6b535c5  ([anon:js-executable-memory]+0x95c5)
        #33 0x1124f6b4a4e5  ([anon:js-executable-memory]+0x4e5)
        #34 0x7a7763a61dd4 in EnterJit /gecko/js/src/jit/Jit.cpp:114:5
        #35 0x7a7763a61dd4 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /gecko/js/src/jit/Jit.cpp:260:10
        #36 0x7a776209d2ce in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3368:40
        #37 0x7a776207a38f in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:433:10
        #38 0x7a776207a38f in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:502:13
        #39 0x7a776207b60a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:660:13
        #40 0x7a776207d3cc in InternalCall /gecko/js/src/vm/Interpreter.cpp:695:10
        #41 0x7a776207d3cc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:727:8
        #42 0x7a776207f1ba in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:849:10
        #43 0x7a77623edb1a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2149:12
        #44 0x7a77623c4f87 in GetExistingProperty<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2177:12
        #45 0x7a77623c4f87 in NativeGetPropertyInline<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2330:14
        #46 0x7a77623c4f87 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2360:10
        #47 0x7a77620b4197 in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:117:10
        #48 0x7a77620b4197 in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:124:10
        #49 0x7a77620b4197 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:4765:10
        #50 0x7a77620917bc in GetPropertyOperation /gecko/js/src/vm/Interpreter.cpp:285:10
        #51 0x7a77620917bc in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:2984:12
        #52 0x7a776207a38f in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:433:10
        #53 0x7a776207a38f in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:502:13
        #54 0x7a776207b60a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:660:13
        #55 0x7a776207d3cc in InternalCall /gecko/js/src/vm/Interpreter.cpp:695:10
        #56 0x7a776207d3cc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:727:8
        #57 0x7a77621a8e06 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:55:10
        #58 0x7a775728e59f in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /gecko/js/xpconnect/src/XPCWrappedJSClass.cpp:918:17
        #59 0x7a7755a468f9 in PrepareAndDispatch /gecko/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37
        #60 0x7a7755a457ae in SharedStub xptcstubs_x86_64_linux.cpp
        #61 0x7a775599b161 in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /gecko/xpcom/components/nsCategoryManager.cpp:680:19
        #62 0x7a7761dbbd00 in nsXREDirProvider::DoStartup() /gecko/toolkit/xre/nsXREDirProvider.cpp:652:11
        #63 0x7a7761d9db60 in XREMain::XRE_mainRun() /gecko/toolkit/xre/nsAppRunner.cpp:5574:18
        #64 0x7a7761d9fa61 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:6031:8
        #65 0x7a7761da0b93 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:6104:21
        #66 0x5c44667aedcc in do_main /gecko/browser/app/nsBrowserApp.cpp:232:22
        #67 0x5c44667aedcc in main /gecko/browser/app/nsBrowserApp.cpp:464:16
        #68 0x7a7777350d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    
    ==169843==ABORTING
Group: core-security → gfx-core-security
Attached file testcase.html (obsolete) —
Attached file testcase.html (obsolete) —
Attachment #9438121 - Attachment is obsolete: true
status-firefox134: --- → affected
Flags: in-testsuite?
Keywords: crash

Verified bug as reproducible on mozilla-central 20241115210754-6c508a387477.
The bug appears to have been introduced in the following build range:

Start: e5583dbc586514f5b897220339e467a8f2630e44 (20241105232120)
End: 66c06d5d735b9b7d7ccb0e85f326c28f7d19dd7d (20241106063415)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e5583dbc586514f5b897220339e467a8f2630e44&tochange=66c06d5d735b9b7d7ccb0e85f326c28f7d19dd7d

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Set release status flags based on info from the regressing bug 1838729

:ErichDonGubler, since you are the author of the regressor, bug 1838729, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox132: --- → unaffected
status-firefox133: --- → unaffected
status-firefox-esr128: --- → unaffected
Flags: needinfo?(egubler)
Assignee: nobody → egubler
Status: NEW → ASSIGNED
Flags: needinfo?(egubler)
Priority: -- → P1

Flagging S3 despite being security-sensitive because WebGPU is not enabled in release. But this is a top priority for the WebGPU team.

Severity: -- → S3
See Also: → 1931929
Keywords: sec-high

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:ErichDonGubler, could you consider increasing the severity of this security bug?

For more information, please visit BugBot documentation.

Flags: needinfo?(egubler)
Flags: needinfo?(egubler)

Fixing upstream with this PR: wgpu#6578.

Upstream fix has been merged into mainline history. Awaiting bug 1930751—not sure if I can make a Depends on reference from a sec-high, though. 😖

It either hides the depends on if somebody doesn't have access or it does matter so let's just mark it. Especially in this case where it is Nightly-only so users will get a fix quickly.

Depends on: 1930751
Severity: S3 → S2
Attached file testcase.html —

Updated test case to properly request the "timestamp-query" feature, so it exposes the validation actually responsible for making sure this doesn't crash.

Attachment #9438122 - Attachment is obsolete: true

Unable to reproduce bug 1931589 using build mozilla-central 20241115093447-f918befd4231. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

This should be resolved now. :jkratzner, can you confirm?

There might be some complication with the original testcase.html becoming invalid for unrelated reasons. 😅 I can walk you through both the requiredFeatures change and the original root cause of the bug, if that's helpful.

Flags: needinfo?(jkratzer)

Erich, I see the following warnings in the console. I assume these are expected?

Uncaptured WebGPU error: A query of type Timestamp was started using a query set of type Occlusion
Uncaptured WebGPU error: Command encoder is locked by a previously created render/compute pass. Before recording any new commands, the pass must be ended.
Uncaptured WebGPU error: Command encoder is invalid

With that said, I can no longer reproduce this issue on 358b6a02a04 (20241126).

Flags: needinfo?(jkratzer)

Set release status flags based on info from the regressing bug 1838729

status-firefox135: --- → affected

:jkratzner: Yes, that's expected. There's another bit of validation that I'd forgotten about, ensuring that the query types need to match (and which just landed with patches for bug 1930751). The original testcase.html attempted to write a timestamp query into an occlusion query set, but that's invalid.

The crashing of this bug was the result of allowing an OOB index into the timestamp query set, which should have (and is now) validated out. We can test that this condition is correctly checked by changing the querySet variable to have 'type': 'timestamp':

const adapter = await navigator.gpu.requestAdapter({})
const device = await adapter.requestDevice({ requiredFeatures: ["timestamp-query"] })
const commandEncoder = device.createCommandEncoder({})
const querySet = device.createQuerySet({
  'type': 'timestamp',
  'count': 62,
})
const passEncoder = commandEncoder.beginComputePass({
  'timestampWrites': {
	'querySet': querySet,
	'beginningOfPassWriteIndex': 84,
  },
})a

passEncoder.end()
const commandBuffer = commandEncoder.finish({})
device.queue.submit([commandBuffer])

…and observe these errors instead:

Uncaptured WebGPU error: Query 84 is out of bounds for a query set of size 62
Uncaptured WebGPU error: Command encoder is locked by a previously created render/compute pass. Before recording any new commands, the pass must be ended.
Uncaptured WebGPU error: Command encoder is invalid

N.B. that only the first and third errors are expected. The second is extraneous, which we're hoping to fix with wgpu#6544.

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Group: gfx-core-security → core-security-release
Target Milestone: --- → 135 Branch
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify-
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: