Re: Issue 379218 in chromium: Chrome: `anonymous namespace'::GetGranularAlignedRandomOffset

csh...@chromium.org

unread,

Jun 9, 2014, 10:21:51 AM6/9/14

to chrome-blackli...@chromium.org

Comment #9 on issue 379218 by csh...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
http://code.google.com/p/chromium/issues/detail?id=379218

I looked at some of the crash numbers and they don't all seem that bad,
I'll follow up offline.

--
You received this message because you were CC'd on the issue.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

Reply to this email to add a comment.

w...@chromium.org

unread,

Jun 11, 2014, 9:22:55 PM6/11/14

to chrome-blackli...@chromium.org

Comment #15 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
http://code.google.com/p/chromium/issues/detail?id=379218

This didn't completely prevent the crashes.

Upon further investigation, the One Key Theater software hooks LoadLibrary:

0:006> p
KERNELBASE!LoadLibraryExW:
000007fe`fd1c8ef0 e9c371e7ff jmp 000007fe`fd0400b8
0:006> p
000007fe`fd0400b8 48b8702d008001000000 mov rax,offset
ActiveDetect64!RemoveR3APIHook64+0xc0 (00000001`80002d70)

and this is causing a suspected race condition in rand_s when it tries to
load ADVAPI32.dll to call RtlGenRandom(), returning NULL and causing rand_s
to throw an invalid parameter.

There isn't much we can do about this, unfortunately. Perhaps adding a
delay before calling rand_s would work, but this would negatively impact
the performance of everyone else.

I think the best option is to try and fix their incompatability, or that
affected users simply uninstall One Key Theater - since this software seems
to cause general system instability -
https://www.google.com/search?q=one%20key%20theater%20crash

w...@chromium.org

unread,

Jul 9, 2014, 12:49:28 PM7/9/14

to chrome-blackli...@chromium.org

Comment #16 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
http://code.google.com/p/chromium/issues/detail?id=379218

Issue 387634 has been merged into this issue.

ami...@chromium.org

unread,

Jul 21, 2014, 4:25:58 PM7/21/14

to chrome-blackli...@chromium.org

Updates:
Labels: -M-37 -ReleaseBlock-Stable M-38

Comment #17 on issue 379218 by amin...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
http://code.google.com/p/chromium/issues/detail?id=379218

Crash levels are at an acceptable level for M37. If we want to clean up
the rest, we can do that in a subsequent release. Removing release block,
punting full resolution to M38.

w...@chromium.org

unread,

Oct 13, 2014, 2:45:00 PM10/13/14

to chrome-blackli...@chromium.org

Comment #19 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Taking version with most samples (40.0.2182.3) this is causing 106 browser
crashes out of 55921 which is 0.18% of crashes. This is still caused by
3rd party software putting hooks into LoadLibraryExW and there still isn't
much we can do about this, unfortunately. See comment #15.

ashe...@chromium.org

unread,

Oct 15, 2014, 11:01:21 AM10/15/14

to chrome-blackli...@chromium.org

Comment #18 on issue 379218 by ashej...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Crash is still observed on latest M40 version i.e 40.0.2183.0"

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%60anonymous%20namespace\%27%3A%3AGetGranularAlignedRandomOffset%27.

Thank you!

mfo...@chromium.org

unread,

Jan 6, 2015, 6:55:47 PM1/6/15

to chrome-blackli...@chromium.org

Comment #20 on issue 379218 by mfo...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Issue 446675 has been merged into this issue.

jsc...@chromium.org

unread,

Feb 26, 2015, 11:32:37 AM2/26/15

to chrome-blackli...@chromium.org

Comment #21 on issue 379218 by jsc...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Issue 462120 has been merged into this issue.

mbo...@chromium.org

unread,

Apr 14, 2015, 6:07:29 PM4/14/15

to chrome-blackli...@chromium.org

Comment #22 on issue 379218 by mbo...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

This is #1 crash in Dev build# 43.0.2357.18

The crash percentage(32.14% as of now) with 9 instances:
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20product.version%3D%2743.0.2357.18%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27

The crashes continue to happen in M42, M43 & M44 builds:
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%60anonymous%20namespace%5C%27%3A%3AGetGranularAlignedRandomOffset%27

ami...@chromium.org

unread,

Apr 15, 2015, 1:27:44 PM4/15/15

to chrome-blackli...@chromium.org

Comment #23 on issue 379218 by amin...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

This is still a malware crash:

1 %ProgramFiles%\lenovo\energy management\batterytestdll.dll 100.00% 17
2 %ProgramFiles%\lenovo\onekey theater\activedetect64.dll 100.00% 17
3 %ProgramFiles%\lenovo\onekey theater\windowsapihookdll64.dll 100.00% 17

wfh@, we already have a blacklist entry for this; per c#15, is there
anything further we can do with the blacklist to prevent this? If so,
let's do it; if not, let's close WontFix

w...@chromium.org

unread,

Apr 15, 2015, 1:34:31 PM4/15/15

to chrome-blackli...@chromium.org

Updates:
Status: ExternalDependency

Comment #24 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Nothing more we can do on the blacklist, they are already on there but
still loading. I think the only thing remaining is to reach out to Lenovo
and see if they can fix the issue. I can do this.

pbom...@chromium.org

unread,

Jun 18, 2015, 3:45:31 PM6/18/15

to chrome-blackli...@chromium.org

Comment #26 on issue 379218 by pbom...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Issue 501813 has been merged into this issue.

mman...@chromium.org

unread,

Jul 6, 2015, 3:19:02 PM7/6/15

to chrome-blackli...@chromium.org

Comment #27 on issue 379218 by mman...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Any updates on this one? It is still one of the canary top crashers today:
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20product.version%3D%2745.0.2449.0%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27#-signatures-header,-component

bugd...@chromium.org

unread,

Sep 18, 2015, 4:04:37 PM9/18/15

to chrome-blackli...@chromium.org

w...@chromium.org

unread,

Sep 21, 2015, 1:02:13 PM9/21/15

to chrome-blackli...@chromium.org

Comment #29 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

Issue 534449 has been merged into this issue.

w...@chromium.org

unread,

Sep 22, 2015, 1:23:59 PM9/22/15

to chrome-blackli...@chromium.org

Updates:
Cc: so...@chromium.org

Comment #30 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

The core issue here is that rand_s.c source changed between VS2010 and
VS2012, this when the crashes started. We saw similar crashes in omaha as
well (+sorin).

In VS2010 it was a LoadLibary and in VS2012/VS2013 this became a
LoadLibaryExW with LOAD_LIBRARY_SEARCH_SYSTEM32. This broke the 3rd party
software hooking LoadLibary and started causing the crashes. See screenshot
for the diff.

base::RandBytes implementation on Windows works around this by using the
technique in
https://msdn.microsoft.com/en-us/library/windows/desktop/aa387694.aspx to
use the export from advapi32.

Attachments:
rand_s_diff.png 73.7 KB

jsc...@chromium.org

unread,

Sep 22, 2015, 1:33:31 PM9/22/15

to chrome-blackli...@chromium.org

Comment #31 on issue 379218 by jsc...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

To be even clearer, the core issue is that third-party code was injecting
hooks relying on the old implementation. So yes, wfh@'s change should
reduce the rate of crashes from broken (or malicious) third-party code,
because it simplifies the code path.

bugd...@chromium.org

unread,

Sep 22, 2015, 2:45:00 PM9/22/15

to chrome-blackli...@chromium.org

Comment #32 on issue 379218 by bugd...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218#c32

The following revision refers to this bug:

https://chromium.googlesource.com/chromium/src.git/+/cb35f4e7250d6f4ee65e283bd2d13dc7c231c921

commit cb35f4e7250d6f4ee65e283bd2d13dc7c231c921
Author: wfh <w...@chromium.org>
Date: Tue Sep 22 18:10:11 2015

Use RandBytes instead of rand_s for pipe names.

BUG=534449,379218

Review URL: https://codereview.chromium.org/1357023005

Cr-Commit-Position: refs/heads/master@{#350193}

[modify]
http://crrev.com/cb35f4e7250d6f4ee65e283bd2d13dc7c231c921/base/sync_socket_win.cc

bugd...@chromium.org

unread,

Sep 23, 2015, 8:08:47 AM9/23/15

to chrome-blackli...@chromium.org

Comment #33 on issue 379218 by bugd...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218#c33

The following revision refers to this bug:

w...@chromium.org

unread,

Sep 23, 2015, 11:04:45 AM9/23/15

to chrome-blackli...@chromium.org

Updates:
Status: Fixed
Labels: -M-38

Comment #35 on issue 379218 by w...@chromium.org: Chrome: `anonymous
namespace'::GetGranularAlignedRandomOffset
https://code.google.com/p/chromium/issues/detail?id=379218

I think all the rand_s crashes should be gone now.

Reply all

Reply to author

Forward