[POC] Ganesh-Vulkan GrDirectContext ready; driving GrStagingBufferManager underflow
[POC] slice1: buffer=0x7cb4921e8440 size=65536 fOffset=0 mapPtr=0x7ea492258900
[POC] slice2: buffer=0x7cb4921e8440 size=65536 fOffset=65544 (delta from mapBase=65544) mapPtr=0x7ea492268908
[POC] UNDERFLOW CONFIRMED: slice2.fOffset=65544 > buffer size=65536. Writing 3145728 attacker-controlled bytes to OOB pointer (this is the SkRectMemcpy at GrVkGpu.cpp:996).
=================================================================
==3626==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ea492268917 at pc 0x55f507ef12a5 bp 0x7ffc33e75f50 sp 0x7ffc33e75720
WRITE of size 3145728 at 0x7ea492268917 thread T0 (chrome)
    #0 0x55f507ef12a4 in __asan_memset (/chromium/chromium/src/out/asan/chrome+0x10dcd2a4) (BuildId: bffec8338cb584dd)
    #1 0x55f52b775b21 in GrDirectContexts::MakeVulkan(skgpu::VulkanBackendContext const&, GrContextOptions const&) third_party/skia/src/gpu/ganesh/vk/GrVkDirectContext.cpp:95:13
    #2 0x55f52b774852 in viz::VulkanInProcessContextProvider::InitializeGrContext(GrContextOptions const&) components/viz/common/gpu/vulkan_in_process_context_provider.cc:186:17
    #3 0x55f52997aba4 in gpu::SharedContextState::InitializeGanesh(gpu::GpuPreferences const&, gpu::GpuDriverBugWorkarounds const&, gpu::raster::GrShaderCache*, scoped_refptr<gpu::GpuPersistentCache>, gpu::GpuProcessShmCount*, gl::ProgressReporter*) gpu/command_buffer/service/shared_context_state.cc:557:34
    #4 0x55f52997909d in gpu::SharedContextState::InitializeSkia(gpu::GpuPreferences const&, gpu::GpuDriverBugWorkarounds const&, gpu::raster::GrShaderCache*, scoped_refptr<gpu::GpuPersistentCache>, gpu::GpuProcessShmCount*, gl::ProgressReporter*) gpu/command_buffer/service/shared_context_state.cc:461:10
    #6 0x55f529c64723 in gpu::SharedImageStub::Initialize() gpu/ipc/service/shared_image_stub.cc:597:39
    #7 0x55f529c64398 in gpu::SharedImageStub::Create(gpu::GpuChannel*, int) gpu/ipc/service/shared_image_stub.cc:85:32
    #8 0x55f5293dc8fe in gpu::GpuChannel::Create(gpu::GpuChannelManager*, base::UnguessableToken const&, gpu::Scheduler*, gpu::SyncPointManager*, scoped_refptr<gl::GLShareGroup>, scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>, int, unsigned long, bool, bool, gfx::GpuExtraInfo const&) gpu/ipc/service/gpu_channel.cc:898:24
    #10 0x55f52bb5f910 in viz::GpuServiceImpl::EstablishGpuChannel(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>) components/viz/service/gl/gpu_service_impl.cc:897:56
    #11 0x55f52bb69d43 in void base::internal::Invoker<base::internal::FunctorTraits<void (viz::GpuServiceImpl::*&&)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), base::WeakPtr<viz::GpuServiceImpl>&&, int&&, unsigned long&&, bool&&, bool&&, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>&&>, base::internal::BindState<true, true, false, void (viz::GpuServiceImpl::*)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>, void ()>::RunImpl<void (viz::GpuServiceImpl::*)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), std::__Cr::tuple<base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>(void (viz::GpuServiceImpl::*&&)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), std::__Cr::tuple<base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>) base/functional/bind_internal.h:740:12
    #12 0x55f51fee2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x55f51ff599c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x55f51ff5883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #15 0x55f51fda0927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #16 0x55f51ff5b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #17 0x55f51fe5cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #18 0x55f52b74c247 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:484:14
    #19 0x55f51b9fb875 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14
    #20 0x55f51b9fe728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #21 0x55f51b9f8101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #22 0x55f51b9f86fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #23 0x55f507f2db39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #24 0x7f949402b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7ea492268917 is located 0 bytes after 65815-byte region [0x7ea492258800,0x7ea492268917)
allocated by thread T0 (chrome) here:
    #0 0x55f507ef3324 in malloc (/chromium/chromium/src/out/asan/chrome+0x10dcf324) (BuildId: bffec8338cb584dd)
    #1 0x7b948716bf1d in sw::allocateZeroOrPoison(unsigned long, unsigned long) third_party/swiftshader/src/System/Memory.cpp:81:42
    #2 0x7b9486c7f3c4 in vk::DeviceMemory::allocateBuffer() third_party/swiftshader/src/Vulkan/VkDeviceMemory.cpp:342:11
    #3 0x7b9486c7e024 in vk::DeviceMemory::Allocate(VkAllocationCallbacks const*, VkMemoryAllocateInfo const*, VkNonDispatchableHandle<VkDeviceMemory_T*>*, vk::Device*) third_party/swiftshader/src/Vulkan/VkDeviceMemory.cpp:275:12
    #4 0x7b9486cd36a7 in vkAllocateMemory third_party/swiftshader/src/Vulkan/libVulkan.cpp:1421:20
    #5 0x55f509a22ef3 in VmaAllocator_T::AllocateVulkanMemory(VkMemoryAllocateInfo const*, VkDeviceMemory_T**) third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:15484:20
    #6 0x55f509a272da in VmaAllocator_T::AllocateDedicatedMemoryPage(VmaPool_T*, unsigned long, VmaSuballocationType, unsigned int, VkMemoryAllocateInfo const&, bool, bool, bool, void*, VmaAllocation_T**) third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:14790:20
    #7 0x55f509a26727 in VmaAllocator_T::AllocateDedicatedMemory(VmaPool_T*, unsigned long, VmaSuballocationType, VmaDedicatedAllocationList&, unsigned int, bool, bool, bool, bool, void*, float, VkBuffer_T*, VkImage_T*, unsigned int, unsigned long, VmaAllocation_T**, void const*) third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:14723:15
    #8 0x55f509a26022 in VmaAllocator_T::AllocateMemoryOfType(VmaPool_T*, unsigned long, unsigned long, bool, VkBuffer_T*, VkImage_T*, unsigned int, VmaAllocationCreateInfo const&, unsigned int, VmaSuballocationType, VmaDedicatedAllocationList&, VmaBlockVector&, unsigned long, VmaAllocation_T**) third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:14557:23
    #9 0x55f509a28688 in VmaAllocator_T::AllocateMemory(VkMemoryRequirements const&, bool, bool, VkBuffer_T*, VkImage_T*, unsigned int, VmaAllocationCreateInfo const&, VmaSuballocationType, unsigned long, VmaAllocation_T**) third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:15104:19
    #10 0x55f509a2aae9 in vmaAllocateMemoryForBuffer third_party/vulkan_memory_allocator/include/vk_mem_alloc.h:16663:34
    #11 0x55f523e21889 in gpu::SkiaVulkanMemoryAllocator::allocateBufferMemory(VkBuffer_T*, skgpu::VulkanMemoryAllocator::BufferUsage, unsigned int, long*) gpu/vulkan/skia_vk_memory_allocator_impl.cc:124:21
    #12 0x55f52b83b263 in skgpu::VulkanMemory::AllocBufferMemory(skgpu::VulkanMemoryAllocator*, VkBuffer_T*, skgpu::Protected, skgpu::VulkanMemoryAllocator::BufferUsage, bool, std::__Cr::function<bool (VkResult)> const&, skgpu::VulkanAlloc*) third_party/skia/src/gpu/vk/VulkanMemory.cpp:43:34
    #13 0x55f52b838e56 in GrVkBuffer::Make(GrVkGpu*, unsigned long, GrGpuBufferType, GrAccessPattern) third_party/skia/src/gpu/ganesh/vk/GrVkBuffer.cpp:168:10
    #14 0x55f522251678 in GrGpu::createBuffer(unsigned long, GrGpuBufferType, GrAccessPattern) third_party/skia/src/gpu/ganesh/GrGpu.cpp:403:39
    #15 0x55f5222a9e6a in GrResourceProvider::createBuffer(unsigned long, GrGpuBufferType, GrAccessPattern, GrResourceProvider::ZeroInit) third_party/skia/src/gpu/ganesh/GrResourceProvider.cpp:632:31
    #16 0x55f5222b05dc in GrStagingBufferManager::allocateStagingBufferSlice(unsigned long, unsigned long) third_party/skia/src/gpu/ganesh/GrStagingBufferManager.cpp:37:58
    #17 0x55f52b77594c in GrDirectContexts::MakeVulkan(skgpu::VulkanBackendContext const&, GrContextOptions const&) third_party/skia/src/gpu/ganesh/vk/GrVkDirectContext.cpp:59:22
    #18 0x55f52b774852 in viz::VulkanInProcessContextProvider::InitializeGrContext(GrContextOptions const&) components/viz/common/gpu/vulkan_in_process_context_provider.cc:186:17
    #19 0x55f52997aba4 in gpu::SharedContextState::InitializeGanesh(gpu::GpuPreferences const&, gpu::GpuDriverBugWorkarounds const&, gpu::raster::GrShaderCache*, scoped_refptr<gpu::GpuPersistentCache>, gpu::GpuProcessShmCount*, gl::ProgressReporter*) gpu/command_buffer/service/shared_context_state.cc:557:34
    #20 0x55f52997909d in gpu::SharedContextState::InitializeSkia(gpu::GpuPreferences const&, gpu::GpuDriverBugWorkarounds const&, gpu::raster::GrShaderCache*, scoped_refptr<gpu::GpuPersistentCache>, gpu::GpuProcessShmCount*, gl::ProgressReporter*) gpu/command_buffer/service/shared_context_state.cc:461:10
    #22 0x55f529c64723 in gpu::SharedImageStub::Initialize() gpu/ipc/service/shared_image_stub.cc:597:39
    #23 0x55f529c64398 in gpu::SharedImageStub::Create(gpu::GpuChannel*, int) gpu/ipc/service/shared_image_stub.cc:85:32
    #24 0x55f5293dc8fe in gpu::GpuChannel::Create(gpu::GpuChannelManager*, base::UnguessableToken const&, gpu::Scheduler*, gpu::SyncPointManager*, scoped_refptr<gl::GLShareGroup>, scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>, int, unsigned long, bool, bool, gfx::GpuExtraInfo const&) gpu/ipc/service/gpu_channel.cc:898:24
    #26 0x55f52bb5f910 in viz::GpuServiceImpl::EstablishGpuChannel(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>) components/viz/service/gl/gpu_service_impl.cc:897:56
    #27 0x55f52bb69d43 in void base::internal::Invoker<base::internal::FunctorTraits<void (viz::GpuServiceImpl::*&&)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), base::WeakPtr<viz::GpuServiceImpl>&&, int&&, unsigned long&&, bool&&, bool&&, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>&&>, base::internal::BindState<true, true, false, void (viz::GpuServiceImpl::*)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>, void ()>::RunImpl<void (viz::GpuServiceImpl::*)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), std::__Cr::tuple<base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>(void (viz::GpuServiceImpl::*&&)(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>), std::__Cr::tuple<base::WeakPtr<viz::GpuServiceImpl>, int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul>) base/functional/bind_internal.h:740:12
    #28 0x55f51fee2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #29 0x55f51ff599c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5

SUMMARY: AddressSanitizer: heap-buffer-overflow (/chromium/chromium/src/out/asan/chrome+0x10dcd2a4) (BuildId: bffec8338cb584dd) in __asan_memset
Shadow bytes around the buggy address:
  0x7ea492268680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ea492268700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ea492268780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ea492268800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ea492268880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7ea492268900: 00 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7ea492268980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7ea492268a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7ea492268a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7ea492268b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7ea492268b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3626==ADDITIONAL INFO

==3626==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55f52bb60161 in viz::GpuServiceImpl::EstablishGpuChannel(int, unsigned long, bool, bool, base::OnceCallback<void (mojo::ScopedHandleBase<mojo::MessagePipeHandle>, gpu::GPUInfo const&, gpu::GpuFeatureInfo const&, gpu::SharedImageCapabilities const&)>) components/viz/service/gl/gpu_service_impl.cc:889:9
    #1 0x55f520b31437 in mojo::SimpleWatcher::ArmOrNotify() mojo/public/cpp/system/simple_watcher.cc:245:28
    #2 0x55f52bb59c73 in viz::GpuServiceImpl::Bind(mojo::PendingReceiver<viz::mojom::GpuService>) components/viz/service/gl/gpu_service_impl.cc:530:27
    #3 0x55f520b31437 in mojo::SimpleWatcher::ArmOrNotify() mojo/public/cpp/system/simple_watcher.cc:245:28


Command line: `/proc/self/exe --type=gpu-process --disable-gpu-sandbox --no-sandbox --headless=new --ozone-platform=headless --use-angle=swiftshader --crashpad-handler-pid=3594 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --disable-breakpad --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAABMAAAAAAAAAAAAAMAAAgAAAAMAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --shared-files --field-trial-handle=3,i,1730967153728597522,9787517967920575778,262144 --enable-features=Vulkan --disable-features=DefaultANGLEVulkan,PaintHolding,SkiaGraphite --variations-seed-version --pseudonymization-salt-handle=7,i,14410489670187612161,11186615424165721688,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --no-first-run --ozone-platform=headless --ozone-override-screen-size=800,600`


==3626==END OF ADDITIONAL INFO

==3626==ABORTING