lowRISC / lowRISC/opentitan

[dif] UsbdevTest.NullArgsTest overflows stack when ASAN is enabled

Open
#19,013 3 comments 0 reactions 0 assignees View on GitHub
Earlgrey-PROD Candidate Priority:P2 SW:DIF Triage: deprioritize?
Dominant language
SystemVerilog
Stars
3.6k
Forks
1.1k
Avg merge
2d 22h
Merged PRs (30d)
141

Description

### Description

@a-will, do you think it's worth pursuing a fix during the quiet period?

To reproduce:
```
git checkout 5bdd9137e0da169a3886573820811bb79d6ed616
./bazelisk.sh test --config=asan //sw/device/lib/dif:usbdev_unittest
```

Full output: [test.log](https://github.com/lowRISC/opentitan/files/11824418/test.log)

```
[----------] 11 tests from UsbdevTest
[ RUN ] UsbdevTest.NullArgsTest
=================================================================
==12==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd2c25dea1 at pc 0x7f194b902b5a bp 0x7ffd2c25bb50 sp 0x7ffd2c25bb40
WRITE of size 1 at 0x7ffd2c25dea1 thread T0
#0 0x7f194b902b59 in buffer_pool_add sw/device/lib/dif/dif_usbdev.c:115
#1 0x7f194b904931 in dif_usbdev_buffer_read sw/device/lib/dif/dif_usbdev.c:491
#2 0x55ca69a8bc6a in TestBody sw/device/lib/dif/dif_usbdev_unittest.cc:77
#3 0x7f194abd6feb in void testing::internal::HandleSehExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) external/googletest/googletest/src/gtest.cc:2607
#4 0x7f194abca77d in void testing::internal::HandleExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) external/googletest/googletest/src/gtest.cc:2643
#5 0x7f194ab88ccb in testing::Test::Run() external/googletest/googletest/src/gtest.cc:2682
#6 0x7f194ab8a287 in testing::TestInfo::Run() external/googletest/googletest/src/gtest.cc:2861
#7 0x7f194ab8b3de in testing::TestSuite::Run() external/googletest/googletest/src/gtest.cc:3015
#8 0x7f194abb1370 in testing::internal::UnitTestImpl::RunAllTests() external/googletest/googletest/src/gtest.cc:5855
#9 0x7f194abda0a9 in bool testing::internal::HandleSehExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) external/googletest/googletest/src/gtest.cc:2607
#10 0x7f194abcd124 in bool testing::internal::HandleExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) external/googletest/googletest/src/gtest.cc:2643
#11 0x7f194abadec7 in testing::UnitTest::Run() external/googletest/googletest/src/gtest.cc:5438
#12 0x7f194b8c9c75 in RUN_ALL_TESTS() external/googletest/googletest/include/gtest/gtest.h:2490
#13 0x7f194b8c9b52 in main external/googletest/googlemock/src/gmock_main.cc:70
#14 0x7f194a229d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#15 0x7f194a229e3f in __libc_start_main_impl ../csu/libc-start.c:392
#16 0x55ca69a34d94 in _start (/home/dan_zerorisc_com/.cache/bazel/_bazel_dan/e8b9a1cec6d6126ab719828a176ad974/execroot/lowrisc_opentitan/bazel-out/k8-fastbuild/bin/sw/device/lib/dif/usbdev_unittest+0x6ad94)

Address 0x7ffd2c25dea1 is located in stack of thread T0 at offset 8897 in frame
#0 0x55ca69a876f5 in TestBody sw/device/lib/dif/dif_usbdev_unittest.cc:29

This frame has 349 object(s):
[48, 49) 'bool_arg' (line 32)
[64, 65) 'uint8_arg' (line 35)
[...]
```

Contributor guide

Open the contributing guide

Research direction

Start with sw/device/lib/dif/dif_usbdev.c:115 and trace the call from dif_usbdev_buffer_read into UsbdevTest.NullArgsTest in sw/device/lib/dif/dif_usbdev_unittest.cc:77. Reproduce with ./bazelisk.sh test --config=asan //sw/device/lib/dif:usbdev_unittest using the specified revision. Done means NullArgsTest no longer triggers the ASAN stack-buffer-overflow and the test passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.