================================================================= ==1107565==ERROR: AddressSanitizer: heap-use-after-free on address 0x7da147715900 at pc 0x55baa6985542 bp 0x7ffe146adfd0 sp 0x7ffe146adfc8 READ of size 1 at 0x7da147715900 thread T0 (chrome) ==1107565==WARNING: invalid path to external symbolizer! ==1107565==WARNING: Failed to use and restart external symbolizer! #0 0x55baa6985541 (/home/zzy/linux-chrome-asan/chrome+0x24bad541) (BuildId: cfa1e308aad33263) #1 0x55baa69850c5 (/home/zzy/linux-chrome-asan/chrome+0x24bad0c5) (BuildId: cfa1e308aad33263) #2 0x55baa5d90feb (/home/zzy/linux-chrome-asan/chrome+0x23fb8feb) (BuildId: cfa1e308aad33263) #3 0x55baa5d8df42 (/home/zzy/linux-chrome-asan/chrome+0x23fb5f42) (BuildId: cfa1e308aad33263) #4 0x55baa5d924c1 (/home/zzy/linux-chrome-asan/chrome+0x23fba4c1) (BuildId: cfa1e308aad33263) #5 0x55baa5d92284 (/home/zzy/linux-chrome-asan/chrome+0x23fba284) (BuildId: cfa1e308aad33263) #6 0x55ba9f684cf1 (/home/zzy/linux-chrome-asan/chrome+0x1d8accf1) (BuildId: cfa1e308aad33263) #7 0x55ba9f684a98 (/home/zzy/linux-chrome-asan/chrome+0x1d8aca98) (BuildId: cfa1e308aad33263) #8 0x55baa6ac0486 (/home/zzy/linux-chrome-asan/chrome+0x24ce8486) (BuildId: cfa1e308aad33263) #9 0x55baa6b31e48 (/home/zzy/linux-chrome-asan/chrome+0x24d59e48) (BuildId: cfa1e308aad33263) #10 0x55baa6b30d2c (/home/zzy/linux-chrome-asan/chrome+0x24d58d2c) (BuildId: cfa1e308aad33263) #11 0x55baa6b32b7a (/home/zzy/linux-chrome-asan/chrome+0x24d5ab7a) (BuildId: cfa1e308aad33263) #12 0x55baa6cb3182 (/home/zzy/linux-chrome-asan/chrome+0x24edb182) (BuildId: cfa1e308aad33263) #13 0x55baa6b3372b (/home/zzy/linux-chrome-asan/chrome+0x24d5b72b) (BuildId: cfa1e308aad33263) #14 0x55baa6a4712f (/home/zzy/linux-chrome-asan/chrome+0x24c6f12f) (BuildId: cfa1e308aad33263) #15 0x55ba9c497978 (/home/zzy/linux-chrome-asan/chrome+0x1a6bf978) (BuildId: cfa1e308aad33263) #16 0x55ba9c49fecc (/home/zzy/linux-chrome-asan/chrome+0x1a6c7ecc) (BuildId: cfa1e308aad33263) #17 0x55ba9c48e6db (/home/zzy/linux-chrome-asan/chrome+0x1a6b66db) (BuildId: cfa1e308aad33263) #18 0x55baa3890c3c (/home/zzy/linux-chrome-asan/chrome+0x21ab8c3c) (BuildId: cfa1e308aad33263) #19 0x55baa38943cf (/home/zzy/linux-chrome-asan/chrome+0x21abc3cf) (BuildId: cfa1e308aad33263) #20 0x55baa3893ab6 (/home/zzy/linux-chrome-asan/chrome+0x21abbab6) (BuildId: cfa1e308aad33263) #21 0x55baa388e04b (/home/zzy/linux-chrome-asan/chrome+0x21ab604b) (BuildId: cfa1e308aad33263) #22 0x55baa388e56b (/home/zzy/linux-chrome-asan/chrome+0x21ab656b) (BuildId: cfa1e308aad33263) #23 0x55ba9149c79f (/home/zzy/linux-chrome-asan/chrome+0xf6c479f) (BuildId: cfa1e308aad33263) #24 0x7f8148c29d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: cd410b710f0f094c6832edd95931006d883af48e) 0x7da147715900 is located 0 bytes inside of 5832-byte region [0x7da147715900,0x7da147716fc8) freed by thread T0 (chrome) here: #0 0x55ba9149b6ed (/home/zzy/linux-chrome-asan/chrome+0xf6c36ed) (BuildId: cfa1e308aad33263) #1 0x55ba9d9c6fb4 (/home/zzy/linux-chrome-asan/chrome+0x1bbeefb4) (BuildId: cfa1e308aad33263) #2 0x55ba9d555d1e (/home/zzy/linux-chrome-asan/chrome+0x1b77dd1e) (BuildId: cfa1e308aad33263) #3 0x55ba9d53bcef (/home/zzy/linux-chrome-asan/chrome+0x1b763cef) (BuildId: cfa1e308aad33263) #4 0x55ba9e11a95b (/home/zzy/linux-chrome-asan/chrome+0x1c34295b) (BuildId: cfa1e308aad33263) #5 0x55ba9e11deb3 (/home/zzy/linux-chrome-asan/chrome+0x1c345eb3) (BuildId: cfa1e308aad33263) #6 0x55baa3a9cff8 (/home/zzy/linux-chrome-asan/chrome+0x21cc4ff8) (BuildId: cfa1e308aad33263) #7 0x55baa3aba0b0 (/home/zzy/linux-chrome-asan/chrome+0x21ce20b0) (BuildId: cfa1e308aad33263) #8 0x55baa3ac85be (/home/zzy/linux-chrome-asan/chrome+0x21cf05be) (BuildId: cfa1e308aad33263) #9 0x55baa3ac9e52 (/home/zzy/linux-chrome-asan/chrome+0x21cf1e52) (BuildId: cfa1e308aad33263) #10 0x55babd4dbe7d (/home/zzy/linux-chrome-asan/chrome+0x3b703e7d) (BuildId: cfa1e308aad33263) #11 0x55babd59e49f (/home/zzy/linux-chrome-asan/chrome+0x3b7c649f) (BuildId: cfa1e308aad33263) #12 0x55babd5b98f7 (/home/zzy/linux-chrome-asan/chrome+0x3b7e18f7) (BuildId: cfa1e308aad33263) #13 0x55babd4db7b8 (/home/zzy/linux-chrome-asan/chrome+0x3b7037b8) (BuildId: cfa1e308aad33263) #14 0x55babd59de6f (/home/zzy/linux-chrome-asan/chrome+0x3b7c5e6f) (BuildId: cfa1e308aad33263) #15 0x55babd543a15 (/home/zzy/linux-chrome-asan/chrome+0x3b76ba15) (BuildId: cfa1e308aad33263) #16 0x55babd54e7cf (/home/zzy/linux-chrome-asan/chrome+0x3b7767cf) (BuildId: cfa1e308aad33263) #17 0x55baa9318d2f (/home/zzy/linux-chrome-asan/chrome+0x27540d2f) (BuildId: cfa1e308aad33263) #18 0x55baae4cb211 (/home/zzy/linux-chrome-asan/chrome+0x2c6f3211) (BuildId: cfa1e308aad33263) #19 0x55baae4d2c7b (/home/zzy/linux-chrome-asan/chrome+0x2c6fac7b) (BuildId: cfa1e308aad33263) #20 0x55baae459c82 (/home/zzy/linux-chrome-asan/chrome+0x2c681c82) (BuildId: cfa1e308aad33263) #21 0x55baa98bb4fe (/home/zzy/linux-chrome-asan/chrome+0x27ae34fe) (BuildId: cfa1e308aad33263) #22 0x55baa98b9f87 (/home/zzy/linux-chrome-asan/chrome+0x27ae1f87) (BuildId: cfa1e308aad33263) #23 0x55baa98b957a (/home/zzy/linux-chrome-asan/chrome+0x27ae157a) (BuildId: cfa1e308aad33263) #24 0x55baa98b90b3 (/home/zzy/linux-chrome-asan/chrome+0x27ae10b3) (BuildId: cfa1e308aad33263) #25 0x55baae747460 (/home/zzy/linux-chrome-asan/chrome+0x2c96f460) (BuildId: cfa1e308aad33263) #26 0x55baae773656 (/home/zzy/linux-chrome-asan/chrome+0x2c99b656) (BuildId: cfa1e308aad33263) #27 0x55baae82b16a (/home/zzy/linux-chrome-asan/chrome+0x2ca5316a) (BuildId: cfa1e308aad33263) #28 0x55baa98bb4fe (/home/zzy/linux-chrome-asan/chrome+0x27ae34fe) (BuildId: cfa1e308aad33263) #29 0x55baa98b9f87 (/home/zzy/linux-chrome-asan/chrome+0x27ae1f87) (BuildId: cfa1e308aad33263) previously allocated by thread T0 (chrome) here: #0 0x55ba9149ae8d (/home/zzy/linux-chrome-asan/chrome+0xf6c2e8d) (BuildId: cfa1e308aad33263) #1 0x55ba9d88964c (/home/zzy/linux-chrome-asan/chrome+0x1bab164c) (BuildId: cfa1e308aad33263) #2 0x55ba9d9c9cf8 (/home/zzy/linux-chrome-asan/chrome+0x1bbf1cf8) (BuildId: cfa1e308aad33263) #3 0x55ba9d9c8e10 (/home/zzy/linux-chrome-asan/chrome+0x1bbf0e10) (BuildId: cfa1e308aad33263) #4 0x55ba9d5462e8 (/home/zzy/linux-chrome-asan/chrome+0x1b76e2e8) (BuildId: cfa1e308aad33263) #5 0x55ba9d3a8240 (/home/zzy/linux-chrome-asan/chrome+0x1b5d0240) (BuildId: cfa1e308aad33263) #6 0x55ba9d3d0331 (/home/zzy/linux-chrome-asan/chrome+0x1b5f8331) (BuildId: cfa1e308aad33263) #7 0x55ba9d3cd4aa (/home/zzy/linux-chrome-asan/chrome+0x1b5f54aa) (BuildId: cfa1e308aad33263) #8 0x55ba9e1f44ab (/home/zzy/linux-chrome-asan/chrome+0x1c41c4ab) (BuildId: cfa1e308aad33263) #9 0x55baa5bbb50f (/home/zzy/linux-chrome-asan/chrome+0x23de350f) (BuildId: cfa1e308aad33263) #10 0x55baa5ad789c (/home/zzy/linux-chrome-asan/chrome+0x23cff89c) (BuildId: cfa1e308aad33263) #11 0x55baa3613d5c (/home/zzy/linux-chrome-asan/chrome+0x2183bd5c) (BuildId: cfa1e308aad33263) #12 0x55bab1f6dbf3 (/home/zzy/linux-chrome-asan/chrome+0x30195bf3) (BuildId: cfa1e308aad33263) #13 0x55bab1f816a9 (/home/zzy/linux-chrome-asan/chrome+0x301a96a9) (BuildId: cfa1e308aad33263) #14 0x55bab1f83ff2 (/home/zzy/linux-chrome-asan/chrome+0x301abff2) (BuildId: cfa1e308aad33263) #15 0x55bab1f6794b (/home/zzy/linux-chrome-asan/chrome+0x3018f94b) (BuildId: cfa1e308aad33263) #16 0x55bab1e32305 (/home/zzy/linux-chrome-asan/chrome+0x3005a305) (BuildId: cfa1e308aad33263) #17 0x55bab1e38163 (/home/zzy/linux-chrome-asan/chrome+0x30060163) (BuildId: cfa1e308aad33263) #18 0x55bab1e7d823 (/home/zzy/linux-chrome-asan/chrome+0x300a5823) (BuildId: cfa1e308aad33263) #19 0x55bab1e7db33 (/home/zzy/linux-chrome-asan/chrome+0x300a5b33) (BuildId: cfa1e308aad33263) #20 0x55baa6bd03cb (/home/zzy/linux-chrome-asan/chrome+0x24df83cb) (BuildId: cfa1e308aad33263) #21 0x55bab1e1f2a2 (/home/zzy/linux-chrome-asan/chrome+0x300472a2) (BuildId: cfa1e308aad33263) #22 0x55bab1e1e67f (/home/zzy/linux-chrome-asan/chrome+0x3004667f) (BuildId: cfa1e308aad33263) #23 0x55bab1e1cdc7 (/home/zzy/linux-chrome-asan/chrome+0x30044dc7) (BuildId: cfa1e308aad33263) #24 0x55bab1f66713 (/home/zzy/linux-chrome-asan/chrome+0x3018e713) (BuildId: cfa1e308aad33263) #25 0x55bab1f719a0 (/home/zzy/linux-chrome-asan/chrome+0x301999a0) (BuildId: cfa1e308aad33263) #26 0x55bab1f6fbb1 (/home/zzy/linux-chrome-asan/chrome+0x30197bb1) (BuildId: cfa1e308aad33263) #27 0x55bab1f82659 (/home/zzy/linux-chrome-asan/chrome+0x301aa659) (BuildId: cfa1e308aad33263) #28 0x55babcfb912f (/home/zzy/linux-chrome-asan/chrome+0x3b1e112f) (BuildId: cfa1e308aad33263) #29 0x55baae6349eb (/home/zzy/linux-chrome-asan/chrome+0x2c85c9eb) (BuildId: cfa1e308aad33263) SUMMARY: AddressSanitizer: heap-use-after-free (/home/zzy/linux-chrome-asan/chrome+0x24bad541) (BuildId: cfa1e308aad33263) Shadow bytes around the buggy address: 0x7da147715680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7da147715700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7da147715780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7da147715800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7da147715880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x7da147715900:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7da147715980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7da147715a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7da147715a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7da147715b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7da147715b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1107565==ADDITIONAL INFO ==1107565==Note: Please include this section with the ASan report. Task trace: #0 0x55baa5d86cd3 (/home/zzy/linux-chrome-asan/chrome+0x23faecd3) (BuildId: cfa1e308aad33263) #1 0x55baa6893a47 (/home/zzy/linux-chrome-asan/chrome+0x24abba47) (BuildId: cfa1e308aad33263) #2 0x55baa75f8a0c (/home/zzy/linux-chrome-asan/chrome+0x25820a0c) (BuildId: cfa1e308aad33263) Command line: `./chrome --flag-switches-begin --flag-switches-end --ozone-platform-hint=auto --ozone-platform=x11 --file-url-path-alias=/gen=/home/zzy/linux-chrome-asan/gen` MiraclePtr Status: MANUAL ANALYSIS REQUIRED This crash occurred inside a callback where a raw_ptr pointing to the same region was bound to one of the arguments. The "use" and "free" threads don't match. This crash is likely to have been caused by a race condition that is mislabeled as a use-after-free. Make sure that the "free" is sequenced after the "use" (e.g. both are on the same sequence, or the "free" is in a task posted after the "use"). Otherwise, the crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1107565==END OF ADDITIONAL INFO ==1107565==ABORTING