[Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)

flawedworld — Mon, 26 Feb 2024 15:26:19 GMT

When running the Spotify application with ARMv8.5 memory tagging enabled, it will open, begin playing and then within 1-3 seconds, crash, with the below error. You will only be able to reproduce this currently on a Google Pixel 8 or Google Pixel 8 Pro device, running GrapheneOS with memory tagging enabled for Spotify.

NOTICE: This is NOT a bug with GrapheneOS, it is a memory corruption bug which is exposed by GrapheneOS, which is in the Spotify app. Android will be eventually deploying memory tagging by default, so this needs to be resolved, it cannot be ignored. This issue only began to appear in the last ~24 hours as of posting this. An engineer with good understanding of debugging native code need to deal with this.

```
type: crash
osVersion: google/husky/husky:14/UQ1A.240205.004/2024022400:user/release-keys
uid: 10178 (u:r:untrusted_app:s0:c178,c256,c512,c768)
cmdline: com.spotify.music
processUptime: 7s

signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr 200c0ce174d80e0
threadName: Core Thread
MTE: enabled

backtrace:
/apex/com.android.runtime/lib64/bionic/libc.so (__strlen_aarch64_mte+8, pc 5bf08)
/apex/com.android.runtime/lib64/bionic/libc.so (__strlen_chk+16, pc 91c60)
/apex/com.android.runtime/lib64/bionic/libc.so (__vfprintf+6084, pc abf64)
/apex/com.android.runtime/lib64/bionic/libc.so (vsnprintf+192, pc ca3f0)
/apex/com.android.runtime/lib64/bionic/libc.so (__vsnprintf_chk+60, pc 91f9c)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc fe5208)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc fe540c)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc fe1950)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc e8b88c)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc e86b20)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 831c78)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 85f5b8)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc eea504)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 831c78)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 831c78)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc a46b70)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc d1e280)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc d369c8)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 8d4dc8)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc eea4f4)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 831c78)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc d37a3c)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc d364e8)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/oat/arm64/base.odex (art_jni_trampoline+116, pc 3953f84)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/oat/arm64/base.odex (com.spotify.cosmos.cosmosimpl.NativeRunnable.run+36, pc 5770364)
/apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612, pc 2109a4)
/apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+172, pc 253b3c)
/apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+460, pc 64417c)
/apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+92, pc 64440c)
/apex/com.android.art/lib64/libart.so (art::JNI<false>::CallVoidMethodV(_JNIEnv*, _jobject*, _jmethodID*, std::__va_list)+660, pc 484e14)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 8d25f4)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc ccbec4)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 8d4dc8)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc ed40b0)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc ed5844)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc ed5bfc)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc 8063e0)
/data/app/~~TOws-Wy_DU1F-S974F3_SA==/com.spotify.music-IUUAhfAWB5-iAuvvUWKICw==/lib/arm64/liborbit-jni-spotify.so (pc ed5ac8)
/apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc d006c)
/apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 64db0)
```

Re: [Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)

flawedworld — Mon, 26 Feb 2024 17:33:21 GMT

Additional information:

Version 8.9.16.593

com.spotify.music
versionCode 111153207

targetSdk 34
minSdk 21

Updated: 25 Feb 2024

Re: [Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)

Joan — Mon, 04 Mar 2024 15:10:03 GMT

Hi there @flawedworld,

Thanks for all the info you've provided us. This is already being looked into on our end and we've forwarded this to the relevant teams. While we cannot give an ETA on this, we recommend keeping the app up-to-date for when this gets addressed.

If there's anything else we can do for you, let us know.

topic Re: [Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging) in Android

[Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)

Re: [Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)

Re: [Regression] Latest app version is broken when being run with ARMv8.5 MTE (Memory Tagging)