Bugfix: packet buffer counter going negative and triggering UBSan Issue #35708
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…mLayer_NumPacketBufs]) in SystemStats is going negative and underflowing, triggering a UBSan issue during fuzzing
|
Review changes with SemanticDiff. |
|
PR #35708: Size comparison from 84ee115 to 0325e57 Full report (82 builds for bl602, bl702, bl702l, cyw30739, efr32, esp32, linux, nrfconnect, nxp, psoc6, qpg, stm32, telink, tizen)
|
pullapprove
bot
requested review from
andyg-apple,
anush-apple,
arkq,
axelnxp,
bauerschwan,
bzbarsky-apple,
carol-apple,
cecille,
chapongatien,
chrisdecenzo,
chshu,
chulspro,
cliffamzn,
Damian-Nordic,
dhrishi,
doru91,
fessehaeve,
harsha-rajendran,
hawk248,
hicklin,
jepenven-silabs,
jmartinez-silabs,
jmeg-sfy,
joonhaengHeo and
jtov-sfy
pullapprove
bot
requested review from
robszewczyk,
saurabhst,
selissia,
sharadb-amazon,
tcarmelveilleux,
tecimovic,
tehampson,
tima-q,
tobiasgraf,
turon,
vivien-apple,
wiba-nordic,
woody-apple,
younghak-hwang,
yufengwangca and
yunhanw-google
andy31415
reviewed
Sep 21, 2024
Alami-Amine
force-pushed
the
AA/SystemStat
branch
from
b47b807 to
b1f8bee
Compare
|
PR #35708: Size comparison from 84ee115 to b1f8bee Full report (82 builds for bl602, bl702, bl702l, cyw30739, efr32, esp32, linux, nrfconnect, nxp, psoc6, qpg, stm32, telink, tizen)
|
andy31415
approved these changes
Sep 23, 2024
Alami-Amine
changed the title
cecille
approved these changes
Sep 23, 2024
kiel-apple
approved these changes
Sep 23, 2024
yyzhong-g
pushed a commit
to yyzhong-g/connectedhomeip
that referenced
this pull request
Dec 12, 2024
…ue (project-chip#35708) * Fix for issue where the packet buffer counter (sResourcesInUse[kSystemLayer_NumPacketBufs]) in SystemStats is going negative and underflowing, triggering a UBSan issue during fuzzing * Integrating comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
sResourcesInUse[kSystemLayer_NumPacketBufs]inSystemStatsgoes negative.Cause
The counter
sResourcesInUse[0]is incremented and decremented using the macrosSYSTEM_STATS_INCREMENT(kSystemLayer_NumPacketBufs)andSYSTEM_STATS_DECREMENT(kSystemLayer_NumPacketBufs).these Macros are being called in
PacketBufferHandle::NewandPacketBuffer::Freerespectively.However, when
CHIP_SYSTEM_PACKETBUFFER_FROM_CHIP_HEAPandPacketBufferHandle::InternalRightSize()is called, we Allocate Memory without usingPacketBufferHandle::Newbut when freeing the memory,PacketBuffer::Freeis still used.so we end up decrementing sResourcesInUse[0] without a corresponding Increment, and when fuzzing we keep going negative until it underflows (sResourcesInUse was defined as a signed int).
Possible Follow-up
Log of UBSan Error that uncovered issue