Out of bounds write in TauNNId::compute

[Dr15Jones]

When doing a pull request fixing another ASAN problem (#32442), we found that TauNNId::compute is writing to memory beyond its end.

[cmsbuild]

A new Issue was created by @Dr15Jones Chris Jones.

@Dr15Jones, @dpiparo, @silviodonato, @smuzaffar, @makortel, @qliphy can you please review it and eventually sign/assign? Thanks.

cms-bot commands are listed here

[Dr15Jones]

The full report from ASAN is

=================================================================
==21490==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000c89078 at pc 0x2b33f19ca4e1 bp 0x7fff4ac5ddf0 sp 0x7fff4ac5dde8
WRITE of size 4 at 0x604000c89078 thread T0
    #0 0x2b33f19ca4e0 in TauNNId::compute(l1t::PFCandidate const&, std::vector<l1t::PFCandidate, std::allocator<l1t::PFCandidate> >&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libL1TriggerPhase2L1ParticleFlow.so+0xd14e0)
    #1 0x2b33f17b070b in L1NNTauProducer::addTau(l1t::PFCandidate const&, std::vector<l1t::PFCandidate, std::allocator<l1t::PFCandidate> > const&, std::unique_ptr<std::vector<l1t::PFTau, std::allocator<l1t::PFTau> >, std::default_delete<std::vector<l1t::PFTau, std::allocator<l1t::PFTau> > > >&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/pluginL1TriggerPhase2L1ParticleFlowAuto.so+0x8a70b)
    #2 0x2b33f17b32e9 in L1NNTauProducer::produce(edm::Event&, edm::EventSetup const&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/pluginL1TriggerPhase2L1ParticleFlowAuto.so+0x8d2e9)
    #3 0x2b33a9e21e9f in edm::stream::EDProducerAdaptorBase::doEvent(edm::EventTransitionInfo const&, edm::ActivityRegistry*, edm::ModuleCallingContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x885e9f)
    #4 0x2b33a9d79c52 in edm::WorkerT<edm::stream::EDProducerAdaptorBase>::implDo(edm::EventTransitionInfo const&, edm::ModuleCallingContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x7ddc52)
    #5 0x2b33a9a927c4 in decltype ({parm#1}()) edm::convertException::wrap<edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::TransitionInfoType const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*)::{lambda()#1}>(edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::TransitionInfoType const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*)::{lambda()#1}) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x4f67c4)
    #6 0x2b33a9a92c5b in bool edm::Worker::runModule<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::TransitionInfoType const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x4f6c5b)
    #7 0x2b33a9a9359f in std::__exception_ptr::exception_ptr edm::Worker::runModuleAfterAsyncPrefetch<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >(std::__exception_ptr::exception_ptr const*, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::TransitionInfoType const&, edm::StreamID, edm::ParentContext const&, edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1>::Context const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x4f759f)
    #8 0x2b33a9a9a587 in edm::Worker::RunModuleTask<edm::OccurrenceTraits<edm::EventPrincipal, (edm::BranchActionType)1> >::execute() (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x4fe587)
    #9 0x2b33abe2e0f4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) ../../src/tbb/custom_scheduler.h:474
    #10 0x2b33abe2e3aa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) ../../src/tbb/custom_scheduler.h:636
    #11 0x2b33a982cb03 in edm::EventProcessor::processLumis(std::shared_ptr<void> const&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x290b03)
    #12 0x2b33a9851719 in edm::EventProcessor::runToCompletion() (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x2b5719)
    #13 0x4133b6 in tbb::interface7::internal::delegated_function<main::{lambda()#1}::operator()() const::{lambda()#1} const, void>::operator()() const (/cvmfs/cms-ib.cern.ch/nweek-02658/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/bin/slc7_amd64_gcc900/cmsRun+0x4133b6)
    #14 0x2b33abe28c41 in tbb::interface7::internal::task_arena_base::internal_execute(tbb::interface7::internal::delegate_base&) const ../../src/tbb/arena.cpp:1105
    #15 0x416fd0 in main::{lambda()#1}::operator()() const (/cvmfs/cms-ib.cern.ch/nweek-02658/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/bin/slc7_amd64_gcc900/cmsRun+0x416fd0)
    #16 0x4123ab in main (/cvmfs/cms-ib.cern.ch/nweek-02658/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/bin/slc7_amd64_gcc900/cmsRun+0x4123ab)
    #17 0x2b33ace6c554 in __libc_start_main (/lib64/libc.so.6+0x22554)
    #18 0x412778  (/cvmfs/cms-ib.cern.ch/nweek-02658/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/bin/slc7_amd64_gcc900/cmsRun+0x412778)

0x604000c89078 is located 0 bytes to the right of 40-byte region [0x604000c89050,0x604000c89078)
allocated by thread T0 here:
    #0 0x2b33a8c7d37f in operator new[](unsigned long) ../../../../libsanitizer/asan/asan_new_delete.cc:107
    #1 0x2b33f19c6c07 in TauNNId::TauNNId(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TauNNTFCache const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libL1TriggerPhase2L1ParticleFlow.so+0xcdc07)
    #2 0x2b33f17999b3 in L1NNTauProducer::L1NNTauProducer(edm::ParameterSet const&, TauNNTFCache const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/pluginL1TriggerPhase2L1ParticleFlowAuto.so+0x739b3)
    #3 0x2b33f17ca9e3 in edm::stream::ProducingModuleAdaptor<L1NNTauProducer, edm::stream::EDProducerBase, edm::stream::EDProducerAdaptorBase>::setupStreamModules() (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/pluginL1TriggerPhase2L1ParticleFlowAuto.so+0xa49e3)
    #4 0x2b33a9e2716d in edm::stream::ProducingModuleAdaptorBase<edm::stream::EDProducerBase>::doPreallocate(edm::PreallocationConfiguration const&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x88b16d)
    #5 0x2b33a9d4381e in edm::Maker::makeModule(edm::MakeModuleParams const&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&) const (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x7a781e)
    #6 0x2b33a99f0eb6 in edm::Factory::makeModule(edm::MakeModuleParams const&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&) const (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x454eb6)
    #7 0x2b33a9a3dce8 in edm::ModuleRegistry::getModule(edm::MakeModuleParams const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&, edm::signalslot::Signal<void (edm::ModuleDescription const&)>&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x4a1ce8)
    #8 0x2b33a9d5064a in edm::WorkerRegistry::getWorker(edm::WorkerParams const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x7b464a)
    #9 0x2b33a9d4554e in edm::WorkerManager::getWorker(edm::ParameterSet&, edm::ProductRegistry&, edm::PreallocationConfiguration const*, std::shared_ptr<edm::ProcessConfiguration const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x7a954e)
    #10 0x2b33a9d495e5 in edm::WorkerManager::addToUnscheduledWorkers(edm::ParameterSet&, edm::ProductRegistry&, edm::PreallocationConfiguration const*, std::shared_ptr<edm::ProcessConfiguration>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x7ad5e5)
    #11 0x2b33a9cb92ef in edm::StreamSchedule::StreamSchedule(std::shared_ptr<edm::TriggerResultInserter>, std::vector<edm::propagate_const<std::shared_ptr<edm::PathStatusInserter> >, std::allocator<edm::propagate_const<std::shared_ptr<edm::PathStatusInserter> > > >&, std::vector<edm::propagate_const<std::shared_ptr<edm::EndPathStatusInserter> >, std::allocator<edm::propagate_const<std::shared_ptr<edm::EndPathStatusInserter> > > >&, std::shared_ptr<edm::ModuleRegistry>, edm::ParameterSet&, edm::service::TriggerNamesService const&, edm::PreallocationConfiguration const&, edm::ProductRegistry&, edm::BranchIDListHelper&, edm::ExceptionToActionTable const&, std::shared_ptr<edm::ActivityRegistry>, std::shared_ptr<edm::ProcessConfiguration>, bool, edm::StreamID, edm::ProcessContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x71d2ef)
    #12 0x2b33a9c0a9d0 in edm::Schedule::Schedule(edm::ParameterSet&, edm::service::TriggerNamesService const&, edm::ProductRegistry&, edm::BranchIDListHelper&, edm::ThinnedAssociationsHelper&, edm::SubProcessParentageHelper const*, edm::ExceptionToActionTable const&, std::shared_ptr<edm::ActivityRegistry>, std::shared_ptr<edm::ProcessConfiguration>, bool, edm::PreallocationConfiguration const&, edm::ProcessContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x66e9d0)
    #13 0x2b33a9c74742 in edm::ScheduleItems::initSchedule(edm::ParameterSet&, bool, edm::PreallocationConfiguration const&, edm::ProcessContext const*) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x6d8742)
    #14 0x2b33a9845877 in edm::EventProcessor::init(std::shared_ptr<edm::ProcessDesc>&, edm::ServiceToken const&, edm::serviceregistry::ServiceLegacy) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x2a9877)
    #15 0x2b33a984d744 in edm::EventProcessor::EventProcessor(std::shared_ptr<edm::ProcessDesc>, edm::ServiceToken const&, edm::serviceregistry::ServiceLegacy) (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libFWCoreFramework.so+0x2b1744)
    #16 0x412ff2 in tbb::interface7::internal::delegated_function<main::{lambda()#1}::operator()() const::{lambda()#1} const, void>::operator()() const (/cvmfs/cms-ib.cern.ch/nweek-02658/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/bin/slc7_amd64_gcc900/cmsRun+0x412ff2)
    #17 0x2b33abe28c41 in tbb::interface7::internal::task_arena_base::internal_execute(tbb::interface7::internal::delegate_base&) const ../../src/tbb/arena.cpp:1105

SUMMARY: AddressSanitizer: heap-buffer-overflow (/cvmfs/cms-ib.cern.ch/week0/slc7_amd64_gcc900/cms/cmssw/CMSSW_11_3_ASAN_X_2020-12-09-2300/lib/slc7_amd64_gcc900/libL1TriggerPhase2L1ParticleFlow.so+0xd14e0) in TauNNId::compute(l1t::PFCandidate const&, std::vector<l1t::PFCandidate, std::allocator<l1t::PFCandidate> >&)
Shadow bytes around the buggy address:
  0x0c08801891b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c08801891c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c08801891d0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c08801891e0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c08801891f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
=>0x0c0880189200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00[fa]
  0x0c0880189210: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c0880189220: fa fa 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
  0x0c0880189230: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
  0x0c0880189240: fa fa 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c0880189250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==21490==ABORTING

[Dr15Jones]

I believe the problem is here:

cmssw/L1Trigger/Phase2L1ParticleFlow/src/TauNNId.cc

Line 60 in 0a262b4

if (i0 > n_particles_max)

the line should actually be

if (i0 >= fNParticles_)
      break;

[Dr15Jones]

assign l1

[cmsbuild]

New categories assigned: l1

@rekovic,@jmduarte you have been requested to review this Pull request/Issue and eventually sign? Thanks

[Dr15Jones]

assign upgrade

[cmsbuild]

New categories assigned: upgrade

@kpedro88 you have been requested to review this Pull request/Issue and eventually sign? Thanks

[rekovic]

#32460 (comment)

or probably

if (i0 > n_particles_max || i0 >= fNParticles_ )
       break;

Attn @violatingcp