ASAN on AOSP build for emulator #1402
Comments
|
Asan seems to be working (test via asan_test on Emulator) But somehow sometimes asan_test and stagefright with ASAN shows this error: So the issues are:
|
|
Sorry for the slow response.
ASan does not detect the memory corruption because, most likely, the bug is
optimized out by the compiler - it is undefined behavior to write out of
bounds, after all, so not doing that is a valid compiler choice. You can
suppress it by compiling with -O0, or adding some volatile qualifiers to
suppress the optimizations, ex.
char buf[10];
char * volatile p = &buf;
memcpy(p,"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",100000000000000);
ASan tends to miss "trivial" errors like this because of that.
DEADLYSIGNAL with nested bug in the same thread is quite interesting.
Would it be possible to run it under debugger and get a stack trace?
Or, maybe, run with ASAN_OPTIONS=handle_segv=0 and check if there is a
stack trace in logcat or under /data/tombstones.
…On Sun, May 2, 2021 at 11:30 AM Marcin Kozlowski ***@***.***> wrote:
Asan seems to be working (test via asan_test on Emulator)
generic_x86_64:/data/local/tmp # ./asan_test
Running main() from external/googletest/googletest/src/gtest_main.cc
[==========] Running 43 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 43 tests from AddressSanitizer
[ RUN ] AddressSanitizer.HasFeatureAddressSanitizerTest
[ OK ] AddressSanitizer.HasFeatureAddressSanitizerTest (0 ms)
[ RUN ] AddressSanitizer.SimpleDeathTest
[ OK ] AddressSanitizer.SimpleDeathTest (4 ms)
[ RUN ] AddressSanitizer.VariousMallocsTest
[ OK ] AddressSanitizer.VariousMallocsTest (0 ms)
[ RUN ] AddressSanitizer.CallocTest
[ OK ] AddressSanitizer.CallocTest (0 ms)
[ RUN ] AddressSanitizer.CallocReturnsZeroMem
[ OK ] AddressSanitizer.CallocReturnsZeroMem (636 ms)
[ RUN ] AddressSanitizer.UAF_char
external/compiler-rt/lib/asan/tests/asan_test.cc:180: Failure
Death test: uaf_test<U1>(kLargeMalloc, 0)
Result: died but not with expected error.
Expected: contains regular expression "AddressSanitizer:.*heap-use-after-free"
Actual msg:
[ DEATH ] writing 1 byte(s) at 0x70815d5ff800 with offset 0
[ DEATH ] AddressSanitizer:DEADLYSIGNAL
[ DEATH ] =================================================================
[ DEATH ] ==25236==ERROR: AddressSanitizer: SEGV on unknown address 0x70815d5ff800 (pc 0x64b4a3f51145 bp 0x7ffdf9a53fb0 sp 0x7ffdf9a53fb0 T0)
[ DEATH ] ==25236==The signal is caused by a WRITE memory access.
[ DEATH ] #0 0x64b4a3f51144 (/data/local/tmp/asan_test+0x61144)
[ DEATH ] #1 0x64b4a3f12853 (/data/local/tmp/asan_test+0x22853)
[ DEATH ] #2 0x64b4a3f758de (/data/local/tmp/asan_test+0x858de)
[ DEATH ] #3 0x64b4a3f77db9 (/data/local/tmp/asan_test+0x87db9)
[ DEATH ] #4 0x64b4a3f79176 (/data/local/tmp/asan_test+0x89176)
[ DEATH ] #5 0x64b4a3fa3db6 (/data/local/tmp/asan_test+0xb3db6)
[ DEATH ] #6 0x64b4a3fa2eb0 (/data/local/tmp/asan_test+0xb2eb0)
[ DEATH ] #7 0x64b4a3f5fab7 (/data/local/tmp/asan_test+0x6fab7)
[ DEATH ] #8 0x708161b0f985 (/apex/com.android.runtime/lib64/bionic/libc.so+0x8a985)
[ DEATH ]
[ DEATH ] AddressSanitizer can not provide additional info.
[ DEATH ] SUMMARY: AddressSanitizer: SEGV (/data/local/tmp/asan_test+0x61144)
[ DEATH ] ==25236==ABORTING
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:181: Failure
Death test: uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2)
Result: died but not with expected error.
Expected: contains regular expression "AddressSanitizer:.*heap-use-after-free"
Actual msg:
[ DEATH ] writing 1 byte(s) at 0x70815d5ff800 with offset 8388608
[ DEATH ] AddressSanitizer:DEADLYSIGNAL
[ DEATH ] =================================================================
[ DEATH ] ==25247==ERROR: AddressSanitizer: SEGV on unknown address 0x70815ddff800 (pc 0x64b4a3f51145 bp 0x7ffdf9a53fb0 sp 0x7ffdf9a53fb0 T0)
[ DEATH ] ==25247==The signal is caused by a WRITE memory access.
[ DEATH ] #0 0x64b4a3f51144 (/data/local/tmp/asan_test+0x61144)
[ DEATH ] #1 0x64b4a3f12c4a (/data/local/tmp/asan_test+0x22c4a)
[ DEATH ] #2 0x64b4a3f758de (/data/local/tmp/asan_test+0x858de)
[ DEATH ] #3 0x64b4a3f77db9 (/data/local/tmp/asan_test+0x87db9)
[ DEATH ] #4 0x64b4a3f79176 (/data/local/tmp/asan_test+0x89176)
[ DEATH ] #5 0x64b4a3fa3db6 (/data/local/tmp/asan_test+0xb3db6)
[ DEATH ] #6 0x64b4a3fa2eb0 (/data/local/tmp/asan_test+0xb2eb0)
[ DEATH ] #7 0x64b4a3f5fab7 (/data/local/tmp/asan_test+0x6fab7)
[ DEATH ] #8 0x708161b0f985 (/apex/com.android.runtime/lib64/bionic/libc.so+0x8a985)
[ DEATH ]
[ DEATH ] AddressSanitizer can not provide additional info.
[ DEATH ] SUMMARY: AddressSanitizer: SEGV (/data/local/tmp/asan_test+0x61144)
[ DEATH ] ==25247==ABORTING
[ DEATH ]
[ FAILED ] AddressSanitizer.UAF_char (779 ms)
[ RUN ] AddressSanitizer.UAF_long_double
[ OK ] AddressSanitizer.UAF_long_double (372 ms)
[ RUN ] AddressSanitizer.UAF_Packed5
[ OK ] AddressSanitizer.UAF_Packed5 (330 ms)
[ RUN ] AddressSanitizer.IgnoreTest
[ OK ] AddressSanitizer.IgnoreTest (0 ms)
[ RUN ] AddressSanitizer.BitFieldPositiveTest
[ OK ] AddressSanitizer.BitFieldPositiveTest (678 ms)
[ RUN ] AddressSanitizer.BitFieldNegativeTest
[ OK ] AddressSanitizer.BitFieldNegativeTest (0 ms)
[ RUN ] AddressSanitizer.LargeMallocTest
[ OK ] AddressSanitizer.LargeMallocTest (2790 ms)
[ RUN ] AddressSanitizer.HugeMallocTest
[ OK ] AddressSanitizer.HugeMallocTest (497 ms)
[ RUN ] AddressSanitizer.ManyThreadsTest
[ OK ] AddressSanitizer.ManyThreadsTest (2127 ms)
[ RUN ] AddressSanitizer.ReallocTest
[ OK ] AddressSanitizer.ReallocTest (27 ms)
[ RUN ] AddressSanitizer.ReallocFreedPointerTest
[ OK ] AddressSanitizer.ReallocFreedPointerTest (194 ms)
[ RUN ] AddressSanitizer.ReallocInvalidPointerTest
[ OK ] AddressSanitizer.ReallocInvalidPointerTest (179 ms)
[ RUN ] AddressSanitizer.ZeroSizeMallocTest
[ OK ] AddressSanitizer.ZeroSizeMallocTest (0 ms)
[ RUN ] AddressSanitizer.WrongFreeTest
[ OK ] AddressSanitizer.WrongFreeTest (210 ms)
[ RUN ] AddressSanitizer.DoubleFreeTest
[ OK ] AddressSanitizer.DoubleFreeTest (242 ms)
[ RUN ] AddressSanitizer.SimpleStackTest
[ OK ] AddressSanitizer.SimpleStackTest (16030 ms)
[ RUN ] AddressSanitizer.ManyStackObjectsTest
[ OK ] AddressSanitizer.ManyStackObjectsTest (194 ms)
[ RUN ] AddressSanitizer.LongJmpTest
[ OK ] AddressSanitizer.LongJmpTest (0 ms)
[ RUN ] AddressSanitizer.UnderscopeLongJmpTest
[ OK ] AddressSanitizer.UnderscopeLongJmpTest (0 ms)
[ RUN ] AddressSanitizer.SigLongJmpTest
[ OK ] AddressSanitizer.SigLongJmpTest (0 ms)
[ RUN ] AddressSanitizer.ThreadStackReuseTest
[ OK ] AddressSanitizer.ThreadStackReuseTest (16 ms)
[ RUN ] AddressSanitizer.Store128Test
[ OK ] AddressSanitizer.Store128Test (541 ms)
[ RUN ] AddressSanitizer.ThreadedTest
[ OK ] AddressSanitizer.ThreadedTest (188 ms)
[ RUN ] AddressSanitizer.ThreadNamesTest
[WARNING] external/googletest/googletest/src/gtest-death-test.cc:1108:: Death tests use fork(), which is unsafe particularly in a threaded context. For this test, Google Test detected 2 threads. See https://github.com/google/googletest/blob/master/googletest/docs/advanced.md#death-tests-and-threads for more explanation and suggested solutions, especially if this is the last message you see before your test times out.
external/compiler-rt/lib/asan/tests/asan_test.cc:923: Failure
Death test: ThreadedTestSpawn()
Result: died but not with expected error.
Expected: contains regular expression "WRITE .*thread T. .UseThr..*freed by thread T. .FreeThr. here:.*previously allocated by thread T. .AllocThr. here:.*Thread T. .UseThr. created by T.*TestFunc.*Thread T. .FreeThr. created by T.*Thread T. .AllocThr. created by T"
Actual msg:
[ DEATH ] =================================================================
[ DEATH ] ==27674==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000001bf0 at pc 0x64b4a3f3cfda bp 0x70815e3fbbf0 sp 0x70815e3fbbe8
[ DEATH ] WRITE of size 4 at 0x602000001bf0 thread T1006 (UseThr)
[ DEATH ] #0 0x64b4a3f3cfd9 (/data/local/tmp/asan_test+0x4cfd9)
[ DEATH ] #1 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ] #2 0x708161b1dfe7 (/apex/com.android.runtime/lib64/bionic/libc.so+0x98fe7)
[ DEATH ]
[ DEATH ] 0x602000001bf0 is located 0 bytes inside of 4-byte region [0x602000001bf0,0x602000001bf4)
[ DEATH ] freed by thread T1005 (FreeThr) here:
[ DEATH ] #0 0x7081618ac4a2 (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xdf4a2)
[ DEATH ] #1 0x64b4a3f3ca98 (/data/local/tmp/asan_test+0x4ca98)
[ DEATH ] #2 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ]
[ DEATH ] previously allocated by thread T1004 (AllocThr) here:
[ DEATH ] #0 0x7081618ab862 (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xde862)
[ DEATH ] #1 0x64b4a3f3c611 (/data/local/tmp/asan_test+0x4c611)
[ DEATH ] #2 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ]
[ DEATH ] Thread T1006 (UseThr) created by T1003 (TestFunc) here:
[ DEATH ] #0 0x70816188eced (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xc1ced)
[ DEATH ] #1 0x64b4a3f3d6d1 (/data/local/tmp/asan_test+0x4d6d1)
[ DEATH ] #2 0x64b4a3f3f318 (/data/local/tmp/asan_test+0x4f318)
[ DEATH ] #3 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ]
[ DEATH ] Thread T1003 (TestFunc) created by T0 here:
[ DEATH ] #0 0x70816188eced (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xc1ced)
[ DEATH ] #1 0x64b4a3f3f652 (/data/local/tmp/asan_test+0x4f652)
[ DEATH ] #2 0x64b4a3f758de (/data/local/tmp/asan_test+0x858de)
[ DEATH ] #3 0x64b4a3f77db9 (/data/local/tmp/asan_test+0x87db9)
[ DEATH ] #4 0x64b4a3f79176 (/data/local/tmp/asan_test+0x89176)
[ DEATH ] #5 0x64b4a3fa3db6 (/data/local/tmp/asan_test+0xb3db6)
[ DEATH ] #6 0x64b4a3fa2eb0 (/data/local/tmp/asan_test+0xb2eb0)
[ DEATH ] #7 0x64b4a3f5fab7 (/data/local/tmp/asan_test+0x6fab7)
[ DEATH ] #8 0x708161b0f985 (/apex/com.android.runtime/lib64/bionic/libc.so+0x8a985)
[ DEATH ]
[ DEATH ] Thread T1005 (FreeThr) created by T1003 (TestFunc) here:
[ DEATH ] #0 0x70816188eced (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xc1ced)
[ DEATH ] #1 0x64b4a3f3d452 (/data/local/tmp/asan_test+0x4d452)
[ DEATH ] #2 0x64b4a3f3f318 (/data/local/tmp/asan_test+0x4f318)
[ DEATH ] #3 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ]
[ DEATH ] Thread T1004 (AllocThr) created by T1003 (TestFunc) here:
[ DEATH ] #0 0x70816188eced (/data/asan/system/lib64/libclang_rt.asan-x86_64-android.so+0xc1ced)
[ DEATH ] #1 0x64b4a3f3d1cb (/data/local/tmp/asan_test+0x4d1cb)
[ DEATH ] #2 0x64b4a3f3f318 (/data/local/tmp/asan_test+0x4f318)
[ DEATH ] #3 0x708161b85fce (/apex/com.android.runtime/lib64/bionic/libc.so+0x100fce)
[ DEATH ]
[ DEATH ] SUMMARY: AddressSanitizer: heap-use-after-free (/data/local/tmp/asan_test+0x4cfd9)
[ DEATH ] Shadow bytes around the buggy address:
[ DEATH ] 0x0c047fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] =>0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fd]fa
[ DEATH ] 0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] 0x0c047fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[ DEATH ] Shadow byte legend (one shadow byte represents 8 application bytes):
[ DEATH ] Addressable: 00
[ DEATH ] Partially addressable: 01 02 03 04 05 06 07
[ DEATH ] Heap left redzone: fa
[ DEATH ] Freed heap region: fd
[ DEATH ] Stack left redzone: f1
[ DEATH ] Stack mid redzone: f2
[ DEATH ] Stack right redzone: f3
[ DEATH ] Stack after return: f5
[ DEATH ] Stack use after scope: f8
[ DEATH ] Global redzone: f9
[ DEATH ] Global init order: f6
[ DEATH ] Poisoned by user: f7
[ DEATH ] Container overflow: fc
[ DEATH ] Array cookie: ac
[ DEATH ] Intra object redzone: bb
[ DEATH ] ASan internal: fe
[ DEATH ] Left alloca redzone: ca
[ DEATH ] Right alloca redzone: cb
[ DEATH ] Shadow gap: cc
[ DEATH ] ==27674==ABORTING
[ DEATH ]
[ FAILED ] AddressSanitizer.ThreadNamesTest (171 ms)
[ RUN ] AddressSanitizer.UseThenFreeThenUseTest
[ OK ] AddressSanitizer.UseThenFreeThenUseTest (143 ms)
[ RUN ] AddressSanitizer.StrDupTest
[ OK ] AddressSanitizer.StrDupTest (0 ms)
[ RUN ] AddressSanitizer.GlobalTest
external/compiler-rt/lib/asan/tests/asan_test.cc:988: Failure
Death test: glob5[Ident(5)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:990: Failure
Death test: glob5[Ident(5+6)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:995: Failure
Death test: static110[Ident(110)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:997: Failure
Death test: static110[Ident(110+7)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:1002: Failure
Death test: func_static15[Ident(15)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:1004: Failure
Death test: func_static15[Ident(15 + 9)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:1012: Failure
Death test: fs2[Ident(-1)] = 0
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:1015: Failure
Death test: Ident(Ident(ConstGlob)[8])
Result: failed to die.
Error msg:
[ DEATH ]
external/compiler-rt/lib/asan/tests/asan_test.cc:1017: Failure
Death test: Ident(Ident(StaticConstGlob)[5])
Result: failed to die.
Error msg:
[ DEATH ]
[ FAILED ] AddressSanitizer.GlobalTest (76 ms)
[ RUN ] AddressSanitizer.GlobalStringConstTest
external/compiler-rt/lib/asan/tests/asan_test.cc:1026: Failure
Death test: Ident(p[15])
Result: failed to die.
Error msg:
[ DEATH ]
[ FAILED ] AddressSanitizer.GlobalStringConstTest (9 ms)
[ RUN ] AddressSanitizer.FileNameInGlobalReportTest
external/compiler-rt/lib/asan/tests/asan_test.cc:1033: Failure
Death test: Ident(p[15])
Result: failed to die.
Error msg:
[ DEATH ]
[ FAILED ] AddressSanitizer.FileNameInGlobalReportTest (7 ms)
[ RUN ] AddressSanitizer.StressStackReuseTest
[ OK ] AddressSanitizer.StressStackReuseTest (25 ms)
[ RUN ] AddressSanitizer.ThreadedStressStackReuseTest
[ OK ] AddressSanitizer.ThreadedStressStackReuseTest (224 ms)
[ RUN ] AddressSanitizer.PthreadExitTest
[ OK ] AddressSanitizer.PthreadExitTest (769 ms)
[ RUN ] AddressSanitizer.MlockTest
[ OK ] AddressSanitizer.MlockTest (0 ms)
[ RUN ] AddressSanitizer.LargeStructCopyTest
[ OK ] AddressSanitizer.LargeStructCopyTest (0 ms)
[ RUN ] AddressSanitizer.AttributeNoSanitizeAddressTest
[ OK ] AddressSanitizer.AttributeNoSanitizeAddressTest (0 ms)
[ RUN ] AddressSanitizer.BufferOverflowAfterManyFrees
[ OK ] AddressSanitizer.BufferOverflowAfterManyFrees (1475 ms)
[ RUN ] AddressSanitizer.LongDoubleNegativeTest
[ OK ] AddressSanitizer.LongDoubleNegativeTest (0 ms)
[ RUN ] AddressSanitizer.pthread_getschedparam
[ OK ] AddressSanitizer.pthread_getschedparam (366 ms)
[----------] 43 tests from AddressSanitizer (29303 ms total)
[----------] Global test environment tear-down
[==========] 43 tests from 1 test suite ran. (29303 ms total)
[ PASSED ] 38 tests.
[ FAILED ] 5 tests, listed below:
[ FAILED ] AddressSanitizer.UAF_char
[ FAILED ] AddressSanitizer.ThreadNamesTest
[ FAILED ] AddressSanitizer.GlobalTest
[ FAILED ] AddressSanitizer.GlobalStringConstTest
[ FAILED ] AddressSanitizer.FileNameInGlobalReportTest
5 FAILED TESTS
YOU HAVE 16 DISABLED TESTS
But somehow sometimes asan_test and stagefright with ASAN shows this error:
1|generic_x86_64:/data/local/tmp # ./asan_test
AddressSanitizer:DEADLYSIGNAL
=================================================================
==28776==ERROR: AddressSanitizer: SEGV on unknown address 0x634ad7e39a70 (pc 0x7ced101c32fd bp 0x000082f34aae sp 0x7ffedb6467f0 T0)
==28776==The signal is caused by a READ memory access.
AddressSanitizer:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
So the issues are:
1. Why ASAN does not detect simple memory corruption in stagefright
(when it is there). Seems like everything is compiled in.
2. Why sometimes it receives DEADLYSIGNAL in asan_test and stagefright
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#1402 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AADG4SWOZ2YR54PMR7Q3FKLTLWK3ZANCNFSM436WOYLA>
.
|
|
Hi @eugenis You're right, ASAN is working in my binary (was able to detect "planted" Heap Buffer Overflow) Attaching both Stacktrace and Tombstone for "asan_test" binary. DEADLYSIGNAL happens once in a while. Affect also other binaries. I am running this on Emulator. Let me know if you need more info. Thanks, Stacktrace: Tombstone: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I am building a executable binary stagefright (from frameworks/av/cmds/stagefright)
I built it with ASAN
I also put a buffer overflow code and also Heap Overflow in main() but it never gets caught.
i.e
Why ASAN is not catching it?
I copied appropriate files from aosp/out/target/product/generic_x86_64/symbols/data/asan/system/lib64 to /data/asan/system/lib64/ (on Emulator)
Any ideas?
Thanks,
The text was updated successfully, but these errors were encountered: