1075213 - Firefox 32 hangs periodically with Symantec PKI Client installed

Status: RESOLVED WORKSFORME

(NSS :: Libraries, defect, P3)

Description

[Michael Kraft [:morac]]

Attachment: firefox hang dump.txt

Recently I started getting periodic hanging of Firefox 32 where it would sit there using 13% of the CPU, but wouldn't responsd.  It wouldn't always hang. Sometimes it start processing input very slowly and stop updating the GUI.  Sometimes it would recover, other times not.  After doing some troubleshooting and still seeing the problem, I generated a memory dump and analyzed it and see that it's hanging in the Symantec PKI Client plugin (4.11.0.0) and extensions (0.1) which was recently added to my machine on September 15, 2014, which I think is around when I first saw the problem.

Apparently it's also causing crashes:
https://support.mozilla.org/en-US/questions/1016561

I'm attaching the stack trace with the hope that this issue can be fixed.

My machine is a Dell Latitude E6530 laptop with a quad core I-7 processor and 8 GM of ram running Windows 7 SP1 64-bit.

Comment 1

[Benjamin Smedberg]

Michael, did you (or a sysadmin) install PKI client plugin intentionally? Does it show up in the Firefox addon manager as an extension?

rbarnes, do you know if NSS loads PKI extensions from the system (automatically) without them being installed via the Firefox addon manager? And if so, how hard would it be to stop that behavior?

We technically can block this DLL using our DLL blocklist, especially if we can identify particular version ranges which exhibit the behavior (since this is presumably just broken, not malicious). But I'd like to also understand why it would happen at all.

Comment 2

[Michael Kraft [:morac]]

A system admin installed the Symantec PKI Client software which installs itself into Firefox.  I had tried disabling the plugin and addon that it added.  That didn't do anything.

I then noticed that a "Symantec Security Module" (C:\Program Files (x86)\Symantec\PKI Client\PKCS11.dll) was added to the Security Modules and Devices.  I unloaded that this morning and so far I haven't seen Firefox freeze today.  Also Firefox's memory is no longer ballooning out of control.  Previously it was growing to use nearly 1 GB of RAM and now it's staying below 500 MB.

So it looks like PKCS11.dll is buggy or something.  My IT department says it's used to manually load certificates, which we don't do, so I simply left it unloaded.

Comment 3

[Richard Barnes [:rbarnes]]

Benjamin: NSS should not load additional modules automatically.  You would need to install them via Preferences > Advanced > Certificates > Security Devices.    Which is where Michael found his module.

This is sounds likely to be a Symantec bug.

Comment 4

[Thomas Harning]

(In reply to Michael Kraft [:morac] from comment #0)
> Created attachment 8497830 [details]
> firefox hang dump.txt
I am one of the developers of Symantec PKI Client and can help assist in diagnosing this. Please reach out to me at [e-mail]. If you have a full stack trace available, I can link it up against Symantec PKI Client debugging symbols to best diagnose the issue.

Comment 5

[Michael Kraft [:morac]]

Unfortunately that's what WinDbg generated when I analyzed the dump I created using procexp when Firefox was "hung" (well being really really slow and unresponsive).  I don't have anything fuller than that.

Comment 6

[Thomas Harning]

I was meaning this file as mentioned in the textual dump: C:\Users\u6016752\Desktop\firefox.dmp, I realized my statement was wrong. With that .dmp file (if still around) I can convert the useless SAND_x86_1_0_0_0+0x8e90f references into a method reference and if lucky, a line number.

Comment 7

[Michael Kraft [:morac]]

I do still have the firefox.dmp file. It's 228 MB in size when compressed though, which is a bit too large to email or attach here. I'm going to upload it somewhere and share the link with you via email.