runtime: "fatal error: unexpected signal" 0xC0000005 on Windows during string operations #46148

yusufozturk · 2021-05-13T07:03:15Z

What version of Go are you using (`go version`)?

$ go version
go version go1.16.4 windows/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\Administrator\AppData\Local\go-build
set GOENV=C:\Users\Administrator\AppData\Roaming\go\env
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\Administrator\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\Administrator\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.16.4
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\Repos\github.com\VirtualMetric\virtualmetric-go\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\ADMINI~1\AppData\Local\Temp\2\go-build2746031420=/tmp/go-build -gno-record-gcc-switches

What did you do?

Our app makes many syscalls to collect different data for forensic analysis. Everytime when we got panic, it always happens in string operations (usually strconv.Itoa()) and always in "Remote Connection" analysis to detect remote attackers to pc. So right now, we disabled the remote connection analysis and we will test it. This issue usually happens after 12-24 hours. If issue would not happen, we will activate the remote connection analysis and disable Windows Defender to find out if Defender somehow crashing the app. App uses around 30-50 mb memory and there is always around 6 gb of free memory on the machine. Machine is running in Hyper-V virtualization as a VM. There is no dynamic memory or ballooning. All resources are allocated just for this VM. Here is where the issue happens:

// Remote Connection
remoteConn := model.HostRemoteConnection{
	SessionName:   "console-" + strconv.Itoa(session.Session),
	SessionID:     session.Session,
	Type:          session.Type,
	RemoteAddress: session.RemoteAddress,
	LocalPort:     session.LocalPort,
	Username:      session.Username,
	State:         session.State,
	CreationTime:  session.LogonTime,
}

strconv.Itoa(session.Session) panics.

What did you expect to see?

I would expect not to see any issue during the string operation or get an error in return.

What did you see instead?

C:\VirtualMetric>VirtualMetric.exe
fatal error: unexpected signal during runtime execution
[signal 0xc0000005 code=0x1 addr=0xc00110b4d0 pc=0x103e77a]

goroutine 16 [running]:
runtime.throw(0x1a2250c, 0x2a)
        C:/Program Files/Go/src/runtime/panic.go:1117 +0x79 fp=0xc0002993c8 sp=0xc000299398 pc=0x106c3b9
runtime.sigpanic()
        C:/Program Files/Go/src/runtime/signal_windows.go:233 +0x317 fp=0xc000299420 sp=0xc0002993c8 pc=0x10823b7
runtime.mallocgc(0x9, 0x0, 0x2002d00, 0x1c1daaa0000)
        C:/Program Files/Go/src/runtime/malloc.go:1048 +0x33a fp=0xc0002994a8 sp=0xc000299420 pc=0x103e77a
runtime.rawstring(0x9, 0x0, 0x0, 0x0, 0x0, 0x0)
        C:/Program Files/Go/src/runtime/string.go:263 +0x56 fp=0xc0002994d8 sp=0xc0002994a8 pc=0x1087396
runtime.rawstringtmp(0x0, 0x9, 0x1082898, 0x0, 0x0, 0xc000299590, 0x10f4b38)
        C:/Program Files/Go/src/runtime/string.go:131 +0x7c fp=0xc000299518 sp=0xc0002994d8 pc=0x1086d3c
runtime.concatstrings(0x0, 0xc0002995f8, 0x2, 0x2, 0x1b2eec0, 0x2002de0)
        C:/Program Files/Go/src/runtime/string.go:50 +0xc5 fp=0xc0002995b0 sp=0xc000299518 pc=0x1086785
runtime.concatstring2(0x0, 0x1a02bc1, 0x8, 0x1a1d12a, 0x1, 0x0, 0x0)
        C:/Program Files/Go/src/runtime/string.go:59 +0x4e fp=0xc0002995f0 sp=0xc0002995b0 pc=0x1086a0e
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event.processUserRemoteConnection(0xc0000f6fd0, 0x1, 0x1, 0xc000299940, 0x0, 0x0, 0xc0002999c0)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event/remoteconnection.go:191 +0x13f fp=0xc000299848 sp=0xc0002995f0 pc=0x163b2ff
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event.remoteconnection.collect(0xc000029600, 0xc000366b40, 0xc000938060)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event/remoteconnection.go:86 +0xfcd fp=0xc000299d88 sp=0xc000299848 pc=0x163a48d
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event.(*remoteconnection).collect(0x208fd78, 0xc000029600, 0xc000366b40, 0xc000938060)
        :1 +0x57 fp=0xc000299db0 sp=0xc000299d88 pc=0x1651917
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event.Collect(0xc000029600, 0xc000366b40, 0x0, 0x0)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/event/event_controller.go:33 +0xf1 fp=0xc000299e20 sp=0xc000299db0 pc=0x1632d71
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host.IIntegration.CollectEvent(...)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host/main.go:28
github.com/VirtualMetric/virtualmetric-go/module/windows/integration/host.(*IIntegration).CollectEvent(0x208fd78, 0xc000029600, 0xc000366b40, 0xc000e84000, 0x18c2960)
        :1 +0x4d fp=0xc000299e50 sp=0xc000299e20 pc=0x16bcded
github.com/VirtualMetric/virtualmetric-go/module/windows/collector.event.processCollector(0xc000029600, 0xc000366b40)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/collector/event_controller.go:80 +0x92 fp=0xc000299ec0 sp=0xc000299e50 pc=0x1845412
github.com/VirtualMetric/virtualmetric-go/module/windows/collector.event.startCollector(0xc000029600, 0xc000366b40, 0xc00033d7a0, 0xc000302a80)
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/collector/event_controller.go:61 +0x2b4 fp=0xc000299f88 sp=0xc000299ec0 pc=0x18450d4
github.com/VirtualMetric/virtualmetric-go/module/windows/collector.(*event).startCollector(0x208fd78, 0xc000029600, 0xc000366b40, 0xc00033d7a0, 0xc000302a80)
        :1 +0x65 fp=0xc000299fb8 sp=0xc000299f88 pc=0x1849f05
runtime.goexit()
        C:/Program Files/Go/src/runtime/asm_amd64.s:1371 +0x1 fp=0xc000299fc0 sp=0xc000299fb8 pc=0x10a5361
created by github.com/VirtualMetric/virtualmetric-go/module/windows/collector.startSubCollectorTask
        C:/Repos/github.com/VirtualMetric/virtualmetric-go/module/windows/collector/collector_controller.go:82 +0x1a9

The text was updated successfully, but these errors were encountered:

davecheney · 2021-05-13T07:14:36Z

Thank you for raising this issue. You mentioned that this issue occurs using strconv but the stack trace you supplied does not appear to include strconv.

This may be memory corruption. Have you tried running your program under the race detector? See https://blog.golang.org/race-detector .

yusufozturk · 2021-05-13T11:45:41Z

Thank you so much for your reply @davecheney

We started the app with race detector and there are many issues and now we are solving them. I have one question about the race issues. Do you think memory corruption might happen after many data race issues? I see them in the race detector but app runs without issue. But I understand that, at some point, it will corrupt the memory?

App is still being in the test. If the panic happens, I will also share the latest data race issue.

heschi · 2021-05-13T17:05:43Z

Hi there,

Unlike many projects, the Go project does not use GitHub Issues for general discussion or asking questions. GitHub Issues are used for tracking bugs and proposals only.

For asking questions, see:

Stack Overflow with questions tagged "go"
The Go Forum, a web-based forum
Gophers Slack, use the invite app for access. The #general channel is a good starting point.
Go Community on Hashnode with questions and posts tagged with "go"
The golang-nuts mailing list
IRC channel #go-nuts on Freenode

Please ask the question on one of the above forums.

(Quoted from https://golang.org/wiki/Questions)

heschi closed this as completed May 13, 2021

golang locked and limited conversation to collaborators May 13, 2022

gopherbot added the FrozenDueToAge label May 13, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

runtime: "fatal error: unexpected signal" 0xC0000005 on Windows during string operations #46148

runtime: "fatal error: unexpected signal" 0xC0000005 on Windows during string operations #46148

yusufozturk commented May 13, 2021 •

edited

davecheney commented May 13, 2021

yusufozturk commented May 13, 2021

heschi commented May 13, 2021

runtime: "fatal error: unexpected signal" 0xC0000005 on Windows during string operations #46148

runtime: "fatal error: unexpected signal" 0xC0000005 on Windows during string operations #46148

Comments

yusufozturk commented May 13, 2021 • edited

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

davecheney commented May 13, 2021

yusufozturk commented May 13, 2021

heschi commented May 13, 2021

yusufozturk commented May 13, 2021 •

edited

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?