1371714 - Immediately killing content process after GetProcessBaseAddress returns nullptr

Status: RESOLVED DUPLICATE of bug 1368600

(Core :: Security: Process Sandboxing, defect)

Description

[Mike Conley (:mconley) (:⚙️)]

milan has been hitting this about 20% of the time after applying Nightly updates since upgrading to the Creators Edition of Windows 10 64-bit.

The behaviour seems to be that any content process that he attempts to start is immediately killed shortly after launching. After some debugging, we found out that this is roughly where the problem is:

http://searchfox.org/mozilla-central/rev/a798ee4fc323f9387b7576dbed177859d29d09b7/security/sandbox/chromium/sandbox/win/src/win_utils.cc#475-505

GetProcessBaseAddress is returning nullptr anytime he tries to launch a subprocess.

This seems to be because we (at least) never seem to get MEM_IMAGE as the Type in mem_info after calling VirtualQueryEx.

When milan gets into this state, it seems that the only way to resolve it is to restart the operating system. Otherwise, he gets this failure any time he tries to launch a content process.

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

(In reply to Mike Conley (:mconley) from comment #0)
> ...
> 
> This seems to be because we (at least) never seem to get MEM_IMAGE as the
> Type in mem_info after calling VirtualQueryEx.

I lied about this one; I had the breakpoint with the wrong value (0x100000 instead of 0x1000000).  So, we could be hitting the right type, but failing in GetImageFilePath or EqualPath calls.  Given that it's a "restart Firefox" situation, that seems more likely a scenario - that we're somehow getting the wrong path, and that it requires larger changes to get it going again.


> When milan gets into this state, it seems that the only way to resolve it is
> to restart the operating system. Otherwise, he gets this failure any time he
> tries to launch a content process.

And I just realized that I didn't try just logging out and logging back in.

Given the frequency of failures, I expect to hit this soon enough, I'll verify the two things I got wrong above.

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Child process dump file

Comment 3

[Bob Owen (:bobowen)]

This is sounding very much like bug 1368600.

Can you check to see if process_path and image_path differ in the same way next time?

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Will do, and yes, it does sound like bug 1368600.