1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "ash/system/diagnostics/async_log.h"
#include <memory>
#include "ash/system/diagnostics/log_test_helpers.h"
#include "base/files/file_path.h"
#include "base/files/file_util.h"
#include "base/files/scoped_temp_dir.h"
#include "base/run_loop.h"
#include "base/strings/string_number_conversions.h"
#include "base/test/task_environment.h"
#include "base/test/test_simple_task_runner.h"
#include "testing/gtest/include/gtest/gtest.h"
namespace ash {
namespace diagnostics {
namespace {
const char kLogFileName[] = "test_async_log";
} // namespace
class AsyncLogTest : public testing::Test {
public:
AsyncLogTest() : task_runner_(new base::TestSimpleTaskRunner) {
EXPECT_TRUE(temp_dir_.CreateUniqueTempDir());
log_path_ = temp_dir_.GetPath().AppendASCII(kLogFileName);
}
~AsyncLogTest() override { base::RunLoop().RunUntilIdle(); }
protected:
base::test::TaskEnvironment task_environment_{
base::test::TaskEnvironment::TimeSource::MOCK_TIME};
scoped_refptr<base::TestSimpleTaskRunner> task_runner_;
base::ScopedTempDir temp_dir_;
base::FilePath log_path_;
};
TEST_F(AsyncLogTest, NoWriteEmpty) {
AsyncLog log(log_path_);
log.SetTaskRunnerForTesting(task_runner_);
// The file won't until it is written to.
EXPECT_FALSE(base::PathExists(log_path_));
// The log is empty.
EXPECT_TRUE(log.GetContents().empty());
}
TEST_F(AsyncLogTest, WriteEmpty) {
AsyncLog log(log_path_);
log.SetTaskRunnerForTesting(task_runner_);
// Append empty string to the log.
log.Append("");
EXPECT_TRUE(task_runner_->HasPendingTask());
// Ensure pending tasks complete.
task_runner_->RunUntilIdle();
EXPECT_FALSE(task_runner_->HasPendingTask());
// The file exists.
EXPECT_TRUE(base::PathExists(log_path_));
// But log is still empty.
EXPECT_TRUE(log.GetContents().empty());
}
TEST_F(AsyncLogTest, WriteOneLine) {
AsyncLog log(log_path_);
log.SetTaskRunnerForTesting(task_runner_);
const std::string line = "Hello";
// Append `line` to the log.
log.Append(line);
// Ensure pending tasks complete.
task_runner_->RunUntilIdle();
// Log contains `line`.
EXPECT_EQ(line, log.GetContents());
}
TEST_F(AsyncLogTest, WriteMultipleLines) {
AsyncLog log(log_path_);
log.SetTaskRunnerForTesting(task_runner_);
const std::vector<std::string> lines = {
"Line 1",
"Line 2",
"Line 3",
};
// Append all the `lines` with a new line to the log.
for (auto line : lines) {
log.Append(line + "\n");
}
// Ensure pending tasks complete.
task_runner_->RunUntilIdle();
// Read back the log and split the lines.
EXPECT_EQ(lines, GetLogLines(log.GetContents()));
}
// This case is to test against a UAF security issue,
// https://crbug.com/286210532. If it has to be disabled, for example for
// flakiness reasons, please be sure to leave a comment in
// https://crbug.com/286210532 to alert the test owners.
//
// More on the UAF, before CL https://crrev.com/c/4583920, AsyncLog::Append()
// would post a task that binds the WeakPtr to an AsyncLog object and its
// AsyncLog::AppendImpl() member function to call. In certain situations, as is
// documented in https://crbug.com/286210532, the task would have started
// running, while the AsyncLog object is destroyed mid-execution. This would
// lead to UAF as operations to access member variables of AsyncLog used to be
// performed inside AsyncLog::AppendImpl(), before CL
// https://crrev.com/c/4583920 was landed.
//
// CL https://crrev.com/c/4583920 fixed this issue by changing AppendImpl() and
// CreateFile() to free functions in an anonymous namespace, which prevented
// access to member variables from an async task.
//
// This test was once disabled by chromium gardeners due to flakiness caused by
// a minor flaw. It used to be that all 10 AsyncLog objects inside the for loop
// was trying to write to the same file path asynchronously all at once. A
// DCHECK() failure would quickly emerge inside AsyncLog::CreateFile(), as
// AsyncLog was designed in a way that a unique file path was supposed to be
// handled by a unique AsyncLog object. Multiple AsyncLog objects handling the
// same file path was not expected. A follow-up CL fixed this flakiness,
// https://crrev.com/c/6550156.
TEST_F(AsyncLogTest, NoUseAfterFreeCrash) {
const std::string new_line = "Line\n";
// Simulate race conditions between the destruction of AsyncLog and the
// execution of AppendImpl.
for (size_t i = 0; i < 10; ++i) {
auto unique_file_path = temp_dir_.GetPath().AppendASCII(
std::string(kLogFileName) + "_" + base::NumberToString(i));
auto log = std::make_unique<AsyncLog>(unique_file_path);
log->Append(new_line);
}
// This should finish without crash.
task_environment_.RunUntilIdle();
}
} // namespace diagnostics
} // namespace ash
|
