Note: Google Test filter = GraphiteStaleUniformBufferUAF.PoC [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from GraphiteStaleUniformBufferUAF [ RUN ] GraphiteStaleUniformBufferUAF.PoC [POC] ---- probe snap ---- [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #1 type=4 size=2048 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #2 type=0 size=16384 label=VertexBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #3 type=4 size=4096 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #4 type=4 size=8192 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #5 type=4 size=16384 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #6 type=4 size=32768 label=UniformBuffer [POC] allocs before snap: 0, during snap: 6 [POC] ---- failed snap ---- [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #1 type=4 size=2048 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #2 type=0 size=16384 label=VertexBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #3 type=4 size=4096 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #4 type=4 size=8192 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #5 type=4 size=16384 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:347] [POC] findOrCreateBuffer #6 type=4 size=32768 label=UniformBuffer [2675:2675:INFO:third_party/skia/src/gpu/graphite/BufferManager.cpp:351] [POC] *** Simulating buffer-alloc failure (GPU OOM) at #6 type=4 *** [2675:2675:INFO:third_party/skia/src/gpu/graphite/DrawList.cpp:224] [skia] [graphite] Failed to write necessary vertex/instance data for DrawPass, dropping! [POC] snap() returned nullptr; DrawList::reset() was SKIPPED. fUniformDataCache now holds stale raw Buffer* entries. [POC] freeGpuResources() purged the returned uniform Buffer. [POC] ---- second snap (re-iterates stale SortKeys) ---- [POC] insertRecording: DawnCommandBuffer will now dereference the freed Buffer* (expect ASAN heap-use-after-free) ================================================================= ==2675==ERROR: AddressSanitizer: heap-use-after-free on address 0x6eaf3cff0b60 at pc 0x633c00c605c8 bp 0x7ffd006a4550 sp 0x7ffd006a4548 READ of size 4 at 0x6eaf3cff0b60 thread T0 #0 0x633c00c605c7 in skgpu::graphite::DawnResourceProvider::findOrCreateUniformBuffersBindGroup(std::__Cr::array, 3ul> const&) third_party/skia/src/gpu/graphite/Resource.h:263:40 #1 0x633c00c439d1 in skgpu::graphite::DawnCommandBuffer::syncUniformBuffers() third_party/skia/src/gpu/graphite/dawn/DawnCommandBuffer.cpp:984:36 #2 0x633c00c3e6b4 in skgpu::graphite::DawnCommandBuffer::addDrawPass(skgpu::graphite::DrawPass*) third_party/skia/src/gpu/graphite/dawn/DawnCommandBuffer.cpp:1070:11 #3 0x633c00c3ca83 in skgpu::graphite::DawnCommandBuffer::onAddRenderPass(skgpu::graphite::RenderPassDesc const&, skgpu::graphite::Texture const*, skgpu::graphite::Texture const*, skgpu::graphite::Texture const*, SkIPoint, SkIRect, skia_private::TArray>, true> const&) third_party/skia/src/gpu/graphite/dawn/DawnCommandBuffer.cpp:290:20 #4 0x633c00a626d7 in skgpu::graphite::CommandBuffer::addRenderPass(skgpu::graphite::RenderPassDesc const&, sk_sp, sk_sp, sk_sp, skgpu::graphite::Texture const*, SkIRect, SkIPoint, SkISize, skia_private::TArray>, true> const&) third_party/skia/src/gpu/graphite/CommandBuffer.cpp:161:16 #5 0x633c00bf9ab6 in skgpu::graphite::RenderPassTask::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/RenderPassTask.cpp:255:24 #6 0x633c00bfbbf0 in skgpu::graphite::TaskList::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/TaskList.cpp:57:22 #7 0x633c00bf809f in skgpu::graphite::DrawTask::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/DrawTask.cpp:69:24 #8 0x633c00bfbbf0 in skgpu::graphite::TaskList::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/TaskList.cpp:57:22 #9 0x633c00b45693 in skgpu::graphite::RecordingPriv::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Texture const*, SkIPoint, SkIRect) third_party/skia/src/gpu/graphite/Recording.cpp:235:36 #10 0x633c00b2aa58 in skgpu::graphite::QueueManager::addRecording(skgpu::graphite::InsertRecordingInfo const&, skgpu::graphite::Context*) third_party/skia/src/gpu/graphite/QueueManager.cpp:191:34 #11 0x633c00a68021 in skgpu::graphite::Context::insertRecording(skgpu::graphite::InsertRecordingInfo const&) third_party/skia/src/gpu/graphite/Context.cpp:245:27 #12 0x633bff9f877e in gpu::(anonymous namespace)::GraphiteStaleUniformBufferUAF_PoC_Test::TestBody() gpu/command_buffer/service/graphite_uaf_poc_unittest.cc:206:8 #13 0x633c0256503b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #14 0x633c02567ba7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #15 0x633c02569c23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #16 0x633c02598674 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #17 0x633c025971ea in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x633c04f62320 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #19 0x633bfef7d481 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #20 0x633c04f6d76b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #21 0x633c04f6d08b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #22 0x633bfef7d177 in main gpu/command_buffer/common/unittest_main.cc:38:10 #23 0x718f3e645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x6eaf3cff0b60 is located 32 bytes inside of 288-byte region [0x6eaf3cff0b40,0x6eaf3cff0c60) freed by thread T0 here: #0 0x633bfea3c722 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4d77722) (BuildId: e3667425e1bf5083) #1 0x633c00b576c7 in skgpu::graphite::ResourceCache::purgeResource(skgpu::graphite::Resource*) third_party/skia/src/gpu/graphite/Resource.h:600:30 #2 0x633c00b5832b in skgpu::graphite::ResourceCache::purgeResources(std::__Cr::chrono::time_point>> const*, std::__Cr::optional>>>) third_party/skia/src/gpu/graphite/ResourceCache.cpp:667:15 #3 0x633c00b39d0e in skgpu::graphite::Recorder::freeGpuResources() third_party/skia/src/gpu/graphite/Recorder.cpp:528:24 #4 0x633bff9f848f in gpu::(anonymous namespace)::GraphiteStaleUniformBufferUAF_PoC_Test::TestBody() gpu/command_buffer/service/graphite_uaf_poc_unittest.cc:182:13 #5 0x633c0256503b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x633c02567ba7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #7 0x633c02569c23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #8 0x633c02598674 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #9 0x633c025971ea in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #10 0x633c04f62320 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #11 0x633bfef7d481 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #12 0x633c04f6d76b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #13 0x633c04f6d08b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #14 0x633bfef7d177 in main gpu/command_buffer/common/unittest_main.cc:38:10 #15 0x718f3e645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x633bfea3bb1d in operator new(unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4d76b1d) (BuildId: e3667425e1bf5083) #1 0x633c00c32658 in skgpu::graphite::DawnBuffer::Make(skgpu::graphite::DawnSharedContext const*, unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>) third_party/skia/src/gpu/graphite/dawn/DawnBuffer.cpp:176:13 #2 0x633c00b5e55a in skgpu::graphite::ResourceProvider::findOrCreateBuffer(unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>, skgpu::graphite::Shareable, skia_private::THashSet const*) third_party/skia/src/gpu/graphite/ResourceProvider.cpp:248:29 #3 0x633c00b5e332 in skgpu::graphite::ResourceProvider::findOrCreateNonShareableBuffer(unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>) third_party/skia/src/gpu/graphite/ResourceProvider.cpp:192:18 #4 0x633c00a373e9 in skgpu::graphite::DrawBufferManager::BufferState::findOrCreateBuffer(skgpu::graphite::ResourceProvider*, skgpu::graphite::Shareable, unsigned int) third_party/skia/src/gpu/graphite/BufferManager.cpp:362:26 #5 0x633c00a3bc81 in skgpu::graphite::DrawBufferManager::getBuffer(int, unsigned long, unsigned long, unsigned long, unsigned long, skgpu::graphite::ClearBuffer, skgpu::graphite::Shareable) third_party/skia/src/gpu/graphite/BufferManager.cpp:551:34 #6 0x633c00ac065f in skgpu::graphite::DrawBufferManager::getMappedUniformBuffer(unsigned long, unsigned long) third_party/skia/src/gpu/graphite/BufferManager.h:295:43 #7 0x633c00aaf959 in skgpu::graphite::DrawListBase::UniformTracker::writeUniforms(skgpu::graphite::UniformDataCache&, skgpu::graphite::DrawBufferManager*, unsigned int) third_party/skia/src/gpu/graphite/DrawListBase.h:175:50 #8 0x633c00aadaf8 in skgpu::graphite::DrawList::snapDrawPass(skgpu::graphite::Recorder*, sk_sp, SkImageInfo const&, skgpu::graphite::DstReadStrategy) third_party/skia/src/gpu/graphite/DrawList.cpp:161:58 #9 0x633c00aa2a75 in skgpu::graphite::DrawContext::flush(skgpu::graphite::Recorder*) third_party/skia/src/gpu/graphite/DrawContext.cpp:261:53 #10 0x633c00a7da4d in skgpu::graphite::Device::internalFlush() third_party/skia/src/gpu/graphite/Device.cpp:2158:10 #11 0x633c00a7b576 in skgpu::graphite::Device::flushPendingWork(skgpu::graphite::DrawContext*) third_party/skia/src/gpu/graphite/Device.cpp:2115:11 #12 0x633c00b35194 in skgpu::graphite::Recorder::snap() third_party/skia/src/gpu/graphite/Recorder.cpp:644:21 #13 0x633bff9f7cbf in gpu::(anonymous namespace)::GraphiteStaleUniformBufferUAF_PoC_Test::TestBody() gpu/command_buffer/service/graphite_uaf_poc_unittest.cc:133:26 #14 0x633c0256503b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x633c02567ba7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #16 0x633c02569c23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #17 0x633c02598674 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #18 0x633c025971ea in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #19 0x633c04f62320 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #20 0x633bfef7d481 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #21 0x633c04f6d76b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #22 0x633c04f6d08b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #23 0x633bfef7d177 in main gpu/command_buffer/common/unittest_main.cc:38:10 #24 0x718f3e645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/skia/src/gpu/graphite/Resource.h:263:40 in skgpu::graphite::DawnResourceProvider::findOrCreateUniformBuffersBindGroup(std::__Cr::array, 3ul> const&) Shadow bytes around the buggy address: 0x6eaf3cff0880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6eaf3cff0900: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x6eaf3cff0980: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x6eaf3cff0a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6eaf3cff0a80: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa =>0x6eaf3cff0b00: fa fa fa fa fa fa fa fa fd fd fd fd[fd]fd fd fd 0x6eaf3cff0b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6eaf3cff0c00: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x6eaf3cff0c80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x6eaf3cff0d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6eaf3cff0d80: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2675==ADDITIONAL INFO ==2675==Note: Please include this section with the ASan report. Task trace: ==2675==END OF ADDITIONAL INFO ==2675==ABORTING