Note: Google Test filter = StorageMonitorLinuxTest.EjectDeviceDesyncEndIteratorDeref [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from StorageMonitorLinuxTest [ RUN ] StorageMonitorLinuxTest.EjectDeviceDesyncEndIteratorDeref ================================================================= ==5808==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c811d3e3070 at pc 0x556a94a4c0f4 bp 0x7ffe525e12b0 sp 0x7ffe525e12a8 READ of size 8 at 0x7c811d3e3070 thread T0 umount: /tmp/org.chromium.Chromium.scoped_dir.n6CsWX/mnt_a: not mounted. #0 0x556a94a4c0f3 in storage_monitor::StorageMonitorLinux::HandleDeviceMountedMultipleTimes(base::FilePath const&, base::FilePath const&) components/storage_monitor/storage_info.h:18:41 #1 0x556a94a4ac9e in storage_monitor::StorageMonitorLinux::UpdateMtab(std::__Cr::map, std::__Cr::allocator>> const&) components/storage_monitor/storage_monitor_linux.cc:383:9 #2 0x556a8645a123 in storage_monitor::(anonymous namespace)::TestStorageMonitorLinux::UpdateMtab(std::__Cr::map, std::__Cr::allocator>> const&) components/storage_monitor/storage_monitor_linux_unittest.cc:134:26 #3 0x556a94a4e986 in base::internal::Invoker, std::__Cr::allocator>> const&), base::WeakPtr const&>, base::internal::BindState, std::__Cr::allocator>> const&), base::WeakPtr>, void (std::__Cr::map, std::__Cr::allocator>> const&)>::Run(base::internal::BindStateBase*, std::__Cr::map, std::__Cr::allocator>> const&) base/functional/bind_internal.h:740:12 #4 0x556a94a4dca6 in base::internal::Invoker, std::__Cr::allocator>> const&)>&&, std::__Cr::map, std::__Cr::allocator>>&&>, base::internal::BindState, std::__Cr::allocator>> const&)>, std::__Cr::map, std::__Cr::allocator>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:363:12 #5 0x556a94b976d6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #6 0x556a94c0d679 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #7 0x556a94c0c4ea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #8 0x556a94ab8627 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #9 0x556a94c0ed87 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #10 0x556a94b31cc0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #11 0x556a8645c24d in storage_monitor::(anonymous namespace)::StorageMonitorLinuxTest::WaitForMtabUpdate() components/storage_monitor/storage_monitor_linux_unittest.cc:259:14 #12 0x556a8647b75d in storage_monitor::(anonymous namespace)::StorageMonitorLinuxTest_EjectDeviceDesyncEndIteratorDeref_Test::TestBody() components/storage_monitor/storage_monitor_linux_unittest.cc:206:5 #13 0x556a948d94cb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #14 0x556a948db6c7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #15 0x556a948dd7d3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #16 0x556a9490d62a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #17 0x556a9490c08e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x556a94e23d6c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #19 0x556a94e148e1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #20 0x556a94e3042b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #21 0x556a94e2fd4b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #22 0x556a94e145d0 in main base/test/run_all_unittests.cc:79:10 #23 0x7f411eace249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c811d3e3070 is located 120 bytes after 248-byte region [0x7c811d3e2f00,0x7c811d3e2ff8) allocated by thread T0 here: #0 0x556a864523fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/storage_monitor_linux_poc_test+0x7bcf3fd) (BuildId: e7da2297f6553610) #1 0x556a86454f1f in storage_monitor::(anonymous namespace)::StorageMonitorLinuxTest::SetUp() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x556a948d9361 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x556a948db6c7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x556a948dd7d3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x556a9490d62a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x556a9490c08e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x556a94e23d6c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x556a94e148e1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x556a94e3042b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x556a94e2fd4b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x556a94e145d0 in main base/test/run_all_unittests.cc:79:10 #12 0x7f411eace249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-buffer-overflow components/storage_monitor/storage_info.h:18:41 in storage_monitor::StorageMonitorLinux::HandleDeviceMountedMultipleTimes(base::FilePath const&, base::FilePath const&) Shadow bytes around the buggy address: 0x7c811d3e2d80: fc 00 00 00 00 01 fc 00 00 fa fa fa fa fa fa fa 0x7c811d3e2e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c811d3e2e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c811d3e2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c811d3e2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa =>0x7c811d3e3000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa 0x7c811d3e3080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c811d3e3100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c811d3e3180: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa 0x7c811d3e3200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c811d3e3280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==5808==ADDITIONAL INFO ==5808==Note: Please include this section with the ASan report. Task trace: #0 0x556a94a4d25f in storage_monitor::(anonymous namespace)::BounceMtabUpdateToStorageMonitorTaskRunner(scoped_refptr, base::RepeatingCallback, std::__Cr::allocator>> const&)> const&, std::__Cr::map, std::__Cr::allocator>> const&) components/storage_monitor/storage_monitor_linux.cc:165:41 #1 0x556a94d283d7 in base::(anonymous namespace)::InotifyReaderThreadDelegate::ThreadMain() base/files/file_path_watcher_inotify.cc:435:9 ==5808==END OF ADDITIONAL INFO ==5808==ABORTING