alemart/opensurge

Crash when Memory Tagging is enabled

Closed this issue · 23 comments

When installing the app in an Android device which supports Memory Tagging and selecting Start game from the menu, the app crashes. Note that few devices support memory tagging (currently only Pixels 8+)

type: crash
osVersion: google/shiba/shiba:14/AP1A.240505.005/2024051500:user/release-keys
uid: 10142 (u:r:untrusted_app_32:s0:c142,c256,c512,c768)
cmdline: org.opensurge2d.surgeengine
processUptime: 16s

signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr 900ca8d22c48930
threadName: trampoline
MTE: enabled

backtrace:
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (entitymanager_remove_entity_info+104, pc c7fdc)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (fun_awake_main+216, pc c57a0)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (run_cprogram+176, pc 11ff80)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_program_call+60, pc 12049c)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_update+132, pc 11d0a4)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+24, pc 11d144)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72, pc 11d174)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (fun_main+1028, pc cc598)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (run_cprogram+176, pc 11ff80)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_program_call+60, pc 12049c)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_update+132, pc 11d0a4)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+24, pc 11d144)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72, pc 11d174)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72, pc 11d174)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72, pc 11d174)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72, pc 11d174)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (surgescript_vm_update_ex+260, pc 12907c)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (level_update+2628, pc af824)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (a5_handle_timer_event+116, pc 8c910)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (engine_mainloop+724, pc 8c668)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/libopensurge.so (main+104, pc 1126f4)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/liballegro.so (android_app_trampoline+216, pc 98dd8)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/liballegro.so (thread_func_trampoline+152, pc 60410)
    /data/app/~~5O267lP3rmJAxHKB-486NQ==/org.opensurge2d.surgeengine-Kzh3igIoy0Xziv-iz7quZw==/lib/arm64/liballegro.so (thread_proc_trampoline+28, pc 91120)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc d5e6c)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 69a64)

I am unable to test it in such a device. Can you compile the app? I can check with Valgrind.

Sure, I can compile it. Should I do it on this Android device or can I do it on my pc? Also, when I do it, what's the next thing I've got to do?

Hi @k2helix,

Compile it on a Linux PC with the Android SDK. Test it on your Android device, preferably via USB.

Before we proceed, can you successfully generate an .apk with my build scripts located at src/misc/android ? Use Java 11.

I was able to pull everything but I'm unable to build with the build scripts in that folder. Here's what the build error is in every command:

-- [Allegro] Allegro Version: [5.2.10]
-- The C compiler identification is Clang 18.0.1
-- The CXX compiler identification is Clang 18.0.1
CMake Warning (dev) at /home/kevcor/Android/Sdk/ndk/27.0.11718014/build/cmake/flags.cmake:46 (if):
  Policy CMP0057 is not set: Support new IN_LIST if() operator.  Run "cmake
  --help-policy CMP0057" for policy details.  Use the cmake_policy command to
  set the policy and suppress this warning.

  IN_LIST will be interpreted as an operator when the policy is set to NEW.
  Since the policy is not set the OLD behavior will be used.
Call Stack (most recent call first):
  /usr/share/cmake/Modules/Platform/Android-Clang.cmake:23 (include)
  /usr/share/cmake/Modules/Platform/Android-Clang-C.cmake:1 (include)
  /usr/share/cmake/Modules/CMakeCInformation.cmake:48 (include)
  CMakeLists.txt:55 (project)
This warning is for project developers.  Use -Wno-dev to suppress it.

CMake Error at /home/kevcor/Android/Sdk/ndk/27.0.11718014/build/cmake/flags.cmake:46 (if):
  if given arguments:

    "hwaddress" "IN_LIST" "ANDROID_SANITIZE"

  Unknown arguments specified
Call Stack (most recent call first):
  /usr/share/cmake/Modules/Platform/Android-Clang.cmake:23 (include)
  /usr/share/cmake/Modules/Platform/Android-Clang-C.cmake:1 (include)
  /usr/share/cmake/Modules/CMakeCInformation.cmake:48 (include)
  CMakeLists.txt:55 (project)

I installed ndk with Android Studio, and if I remember correctly I'm using the SDK version 34.

Hi @k2helix,

Try again with SDK 33 and NDK r25c.

Run make clean before trying again.

@k2helix Any news?

Sorry I had some exams and wasn't able to do it. I will try to do it today and let you know.

I've been able to build deps and surgescript with Sdk 33 and NDK r25c. However I'm not able to build allegro.

At first, I was receiving the error Error: Could not initialize class org.codehaus.groovy.runtime.InvokerHelper. I googled it and it seemed to be the gradle version being used, which I changed in src/misc/android/scripts/build/parts/allegro/build/arm64-v8a/android/gradle_project/gradle/wrapper/gradle-wrapper.properties from 5.0 to 6.3. Then, I got another error: Unsupported class file major version 61, which seems to be related to the java (I tried 11, 17 and 21) and gradle versions in use. So I change the gradle version in the same file to 7.3. (Java to 17)

With that version set, the gradle daemon starts successfully. However, it fails to build with the following reason:

> Task :allegro:compileReleaseRenderscript FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Some problems were found with the configuration of task ':allegro:compileReleaseRenderscript' (type 'RenderscriptCompile').
  - In plugin 'com.android.build.gradle.api.AndroidBasePlugin' type 'com.android.build.gradle.tasks.RenderscriptCompile' method 'useAndroidX()' should not be annotated with: @Input.
    
    Reason: Input/Output annotations are ignored if they are placed on something else than a getter.
    
    Possible solutions:
      1. Remove the annotations.
      2. Rename the method.
    
    Please refer to https://docs.gradle.org/7.3/userguide/validation_problems.html#ignored_annotations_on_method for more details about this problem.
  - In plugin 'com.android.build.gradle.api.AndroidBasePlugin' type 'com.android.build.gradle.tasks.RenderscriptCompile' property 'ndkConfig' is missing an input or output annotation.
    
    Reason: A property without annotation isn't considered during up-to-date checking.
    
    Possible solutions:
      1. Add an input or output annotation.
      2. Mark it as @Internal.
    
    Please refer to https://docs.gradle.org/7.3/userguide/validation_problems.html#missing_annotation for more details about this problem.

Thank you for your patience.

Hi @k2helix,

Don't change the gradle version. Use Allegro as is. Using Java 11 will work, unless it's not properly configured.

Hi again, @alemart

I successfully built allegro and then opensurge. The problem was that I was changing the Java version globally using sudo alternatives --config java, but I had to change JAVA_HOME.

Here's what I did if it matters (It would've been nice to have an instructions file or something)

  1. Run init.sh
  2. Pull everything with the corresponding script
  3. build_deps, then build_allegro.sh, then build_java.sh, then build_surgescript.sh
  4. stage_allegro.sh then stage_deps.sh then stage_surgescript.sh then stage_java.sh
  5. build_opensurge.sh
  6. stage_opensurge.sh

All this with the abi arm64-v8a. I had to change some environment variables in ~/.bashrc, notably JAVA_HOME, ANDROID_SDK_ROOT, ANDROID_NDK_ROOT and ANDROID_HOME

I guess I have to build the apk now?

I've just built the apk using assemble_prepare.sh and assemble_package.sh ./assemble_package.sh -b 33.0.1 -c 33, and then signed it with sign_apk.sh

I'm able to install it via adb, but what should I do after it's installed?

Nice, @k2helix !

It would've been nice to have an instructions file or something

There is a Makefile in the base folder. Just call make, and it does everything for you in a right order.

I'm able to install it via adb, but what should I do after it's installed?

Are you able now to load the game on your phone?

In addition, make clean clears the current build artifacts. Use it before invoking make.

There is a Makefile in the base folder. Just call make, and it does everything for you in a right order.

Didn't know that... Would've been much easier. Just tried again with make and it did it perfectly.

Are you able now to load the game on your phone?

Yes, I can load it and make it crash the same way I do in the official app

Awesome. Now I ask you to edit scripts build_opensurge.sh, build_surgescript.sh and build_allegro.sh as follows:

Replace

-DCMAKE_BUILD_TYPE=RelWithDebInfo

by

-DCMAKE_BUILD_TYPE=Debug

Call make clean, recompile the game and test it again. Please send me the details of the crash with as much detail as possible.

Sure, I'll do it tomorrow. When you say details of the crash do you mean any specific logs or just what I do to make the app crash?

When I make with the changes you told me to do, I get this error:

ERROR: Allegro AAR not found at build/parts/allegro/build/armeabi-v7a/lib/allegro-release.aar
make: *** [Makefile:112: .stage_allegro] Error 1

Which is because the file is now named allegro-debug.aar. However, if I replace it in stage_allegro, then it says it cannot find liballegro.so, which again is because the file is liballegro-debug.so. Finally, if I also change that for every file that stage_allegro validates, it won't build because it expects the files to be named as usual.

I see. In this case, restore RelWithDebInfo in build_allegro.sh and try again.

I'm looking for crash data with as much detail as possible.

I've built and installed the debug version. I don't know exactly what information you need, but here's the crash log:

type: crash
osVersion: google/shiba/shiba:14/AP1A.240505.005/2024052100:user/release-keys
package: org.opensurge2d.surgeengine.unofficial:30550
process: org.opensurge2d.surgeengine.unofficial
processUptime: 0 + 0 ms

signal 11 (SIGSEGV), code 9 (SEGV_MTESERR), fault addr 0x0100c9ccd337a000

backtrace:
      #00 pc 00000000000c819c  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (entitymanager_remove_entity_info+104) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #01 pc 00000000000c5960  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (fun_awake_main+216) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #02 pc 0000000000120140  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (run_cprogram+176) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #03 pc 000000000012065c  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_program_call+60) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #04 pc 000000000011d264  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_update+132) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #05 pc 000000000011d304  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+24) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #06 pc 000000000011d334  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #07 pc 00000000000cc758  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (fun_main+1028) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #08 pc 0000000000120140  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (run_cprogram+176) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #09 pc 000000000012065c  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_program_call+60) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #10 pc 000000000011d264  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_update+132) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #11 pc 000000000011d304  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+24) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #12 pc 000000000011d334  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #13 pc 000000000011d334  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #14 pc 000000000011d334  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #15 pc 000000000011d334  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_object_traverse_tree+72) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #16 pc 000000000012923c  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (surgescript_vm_update_ex+260) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #17 pc 00000000000afa14  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (level_update+2628) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #18 pc 000000000008cae0  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (a5_handle_timer_event+116) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #19 pc 000000000008c838  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (engine_mainloop+724) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #20 pc 00000000001128b4  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/libopensurge.so (main+104) (BuildId: e32785dcddfe2277869e6f482ce8b60b57cada00)
      #21 pc 0000000000099108  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/liballegro.so (android_app_trampoline+216) (BuildId: 5cc7c90a1211d266fea6369fdc99c165d69a7103)
      #22 pc 0000000000060740  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/liballegro.so (thread_func_trampoline+152) (BuildId: 5cc7c90a1211d266fea6369fdc99c165d69a7103)
      #23 pc 0000000000091450  /data/app/~~UhYgChlguKh25aYHtAsDZg==/org.opensurge2d.surgeengine.unofficial-oS1rF75ewhL3P_a9ajk2_A==/lib/arm64/liballegro.so (thread_proc_trampoline+28) (BuildId: 5cc7c90a1211d266fea6369fdc99c165d69a7103)
      #24 pc 00000000000d5e6c  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204) (BuildId: ed92f960e1dd1590bc7d2b8573224779)
      #25 pc 0000000000069a64  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: ed92f960e1dd1590bc7d2b8573224779)
Learn more about MTE reports: https://source.android.com/docs/security/test/memory-safety/mte-reports

It seems exactly the same as the one I posted in the original issue.

Thank you for the logs. Now I ask you to make a change to scripts/pull_opensurge.sh: you will pull commit 9ff8d26.

Replace

"$git_pull" \
    --repository https://github.com/alemart/opensurge.git \
    --tag v0.6.1 \
;

by

"$git_pull" \
    --repository https://github.com/alemart/opensurge.git \
    --commit 9ff8d26813d9b680a1367ab5c763a6228b1d0b2c \
;

Next, call make clean, recompile and try again. Let me know how it goes!

Alternatively, you may call make .clean_pull_opensurge to save some time.

aaaand now it works! was it a pointer pointing to somewhere that shouldn't be pointed to? How did you find out? I'll delete the logs now that it's fixed in case I missed any sensitive information when I verified it.

Thanks for your work! Feel free to close the issue.

How did you find out?

I wrote the code, so I have insight into it.

Thanks for reporting!