829897 - HANG - When security module beid_ff_pkcs11.dll is loaded (Belgium eID PKCS#11 Module)

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Thomas Bertels]

Attachment: WinDbg log

Steps to reproduce:
- Start Firefox 18.0
- Install the "eID Belgique" extension with Firefox version 1.0.18 (https://addons.mozilla.org/fr/firefox/addon/belgium-eid/versions/?page=1#version-1.0.18)
- Restart Firefox
- Close Firefox

Results:
Firefox hangs

Reproduced with 21.0a1 (2013-01-11)

I created a debug log and a dump with WinDbg (attached to this bug).
Here's the most relevant part:

>ModLoad: 05100000 0515d000   C:\Program Files\Mozilla Firefox\nssckbi.dll
>Belgium eID: Failed to load module beid_ff_pkcs11.dll with the name Belgium >eID PKCS#11 Module - beid_ff_pkcs11.dll: Error NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIPKCS11.addModule]

Comment 1

[Thomas Bertels]

The debug log is attached to this bug.
I keep the (28 MB zipped) memory dump in case it would be useful.

Comment 2

[Benoit]

Ziggy, have you seen support requests about this by chance?

Comment 3

[Benoit]

I see someone complaining about this issue on the extension page (in Dutch), so it may be quite common. https://addons.mozilla.org/fr/firefox/addon/belgium-eid/reviews/413068/

This extension is needed by all Belgian citizens to access their Identity Card reader from Firefox. They have to install it in order to report their taxes to the tax office website ("taxonweb.be") at least once a year.

Comment 4

[Thomas Bertels]

Attachment: WinDbg log pk11slot

This one was created on a different computer, after uninstalling the eID program (and removing the associated Firefox extension and browser security module) and then installing the latest version.

This eID program actually needs to be installed (no reader needed) to have a chance to reproduce. You can find it at http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/

The WinDbg log seems to point to http://mxr.mozilla.org/mozilla-release/source/security/nss/lib/pk11wrap/pk11slot.c#423

Comment 5

[Ziggy Maes]

I have not encountered such behavior but in a single case where a user could not get Firefox to start with their preferred add-ons (including the EID add-on) enabled. Consequently, Firefox was able to start in safe mode and with everything disabled. However, we did not conclude that the problem was solely related to EID, so I don't know if this is relevant.

I also don't seem to be able to reproduce this in Firefox 18 using Windows 7 x64.

Comment 6

[Thomas Bertels]

I couldn't reproduce it on a third computer with Windows 7 x86 either, so it seems to be limited to Windows XP.

Comment 7

[frederik]

Hi Thomas, thank you for reporting, I'll try to reproduce it.

Do you have both the beidpkcs11.dll and the beid_ff_pkcs11.dll modules attached in Firefox when you see this error?

Comment 8

[Thomas Bertels]

Attachment: WinDbg log pk11slot middleware 4.0.4

Actually, the "Failed to load module beid_ff_pkcs11.dll" error isn't returned anymore with the version 4.0.4 of the middleware.
The second stack trace and this one have both been retrieved with that version.
But there's still a hang, and the stack trace seems to point at beid_ff_pkcs11.dll.
There's no more hang if I remove the beid security module.
To be reproduced, the hang needs a few seconds or minutes of usage.

Comment 9

[Thomas Bertels]

You're welcome.
The beidpkcs11.dll module isn't currently loaded. I can't tell if it was when the first stack trace was retrieved however.

Comment 10

[frederik]

Hello Thomas,

I was able to reproduce the issue.
Following beid_ff_pkcs11.dll fixed it for me:
http://code.google.com/p/eid-mw/downloads/detail?name=beid_ff_pkcs11_4017356.dll&can=2&q=#makechanges

Might I ask you to check if this fixes your issue too?
(could you place the above dll in windows/system32? you'll have to rename it to beid_ff_pkcs11.dll though (google code doesn't like same name uploaded twice))
If you prefer an installer, just let me know, happy to build one.

Comment 11

[Thomas Bertels]

I can't reproduce it anymore with that version.

Thank you for the very fast fix Frederik!