-
-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix for heap-use-after-free in GPUService.cpp
This adds a unit test and fix for the bug reported by libfuzzer. Changes made: * Expose GPUService as testable code. * Update main_gpuservice.cpp to use the new GpuService now located at gpuservice/GpuService.h * Make initializer threads members of GpuService * Join the threads in destructor to prevent heap-use-after-free. * Add unit test that waits 3 seconds after deallocation to ensure no wrong access is made. Bug: 282919145 Test: Added unit test and ran on device with ASAN (cherry picked from commit 3c00cbc) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7fb707802ee4c667d1ee6065ae2845d835b47aeb) Merged-In: I4d1d2d4658b575bf2c8f425f91f68f03114ad029 Change-Id: I4d1d2d4658b575bf2c8f425f91f68f03114ad029
- Loading branch information
1 parent
def9966
commit 507304e
Showing
6 changed files
with
69 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
#undef LOG_TAG | ||
#define LOG_TAG "gpuservice_unittest" | ||
|
||
#include "gpuservice/GpuService.h" | ||
|
||
#include <gtest/gtest.h> | ||
#include <log/log_main.h> | ||
|
||
#include <chrono> | ||
#include <thread> | ||
|
||
namespace android { | ||
namespace { | ||
|
||
class GpuServiceTest : public testing::Test { | ||
public: | ||
GpuServiceTest() { | ||
const ::testing::TestInfo* const test_info = | ||
::testing::UnitTest::GetInstance()->current_test_info(); | ||
ALOGD("**** Setting up for %s.%s\n", test_info->test_case_name(), test_info->name()); | ||
} | ||
|
||
~GpuServiceTest() { | ||
const ::testing::TestInfo* const test_info = | ||
::testing::UnitTest::GetInstance()->current_test_info(); | ||
ALOGD("**** Tearing down after %s.%s\n", test_info->test_case_name(), test_info->name()); | ||
} | ||
|
||
}; | ||
|
||
|
||
/* | ||
* The behaviour before this test + fixes was UB caused by threads accessing deallocated memory. | ||
* | ||
* This test creates the service (which initializes the culprit threads), | ||
* deallocates it immediately and sleeps. | ||
* | ||
* GpuService's destructor gets called and joins the threads. | ||
* If we haven't crashed by the time the sleep time has elapsed, we're good | ||
* Let the test pass. | ||
*/ | ||
TEST_F(GpuServiceTest, onInitializeShouldNotCauseUseAfterFree) { | ||
sp<GpuService> service = new GpuService(); | ||
service.clear(); | ||
std::this_thread::sleep_for(std::chrono::seconds(3)); | ||
|
||
// If we haven't crashed yet due to threads accessing freed up memory, let the test pass | ||
EXPECT_TRUE(true); | ||
} | ||
|
||
} // namespace | ||
} // namespace android |