Deadlock after tab switch during verification process

RESOLVED FIXED in Firefox 57

Status

()

defect
P2
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: mwobensmith, Assigned: ttaubert)

Tracking

(Blocks 1 bug)

57 Branch
mozilla57
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox57 fixed)

Details

(Whiteboard: [webauthn] [webauthn-test], )

Attachments

(1 attachment)

On Ubuntu 16.04 with USB token inserted:

1. Go to WebAuthN test site [1].
2. Click "Create Credentials" but don't perform USB verification.
3. Create new tab.
4. Return to original tab. 
5. Confirm abort message.
6. Return to new tab and try to navigate to a new URL.

Result:
Browser is unresponsive.

7. Close new tab.

Result:
Eventually you will get a crash [2].


[1]
https://webauthn.bin.coffee/
[2]
https://crash-stats.mozilla.com/report/index/0908f79a-c425-4829-af50-7b3060170918
Ok so what's happening here is that U2FTokenManager::Cancel() sends a Cancel request and then destroys the U2FHIDTokenManager. rust_u2f_mgr_free() waits for the work queue thread in manager.rs to be joined. While waiting it holds the gInstanceMutex. Now the runloop in PlatformManager::sign() will terminate and call the callback, that however will acquire gInstanceMutex again and we have a deadlock.
OS: Linux → All
Hardware: x86_64 → All
Stealing :)
Assignee: jjones → ttaubert
Status: NEW → ASSIGNED
Summary: Linux: Crash after tab switch during verification process → Deadlock after tab switch during verification process
Priority: -- → P2
Whiteboard: [webauthn] [webauthn-test]
Duplicate of this bug: 1401033
Pushed by ttaubert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/efa6750d4e13
Fix WebAuthn deadlock when cancelling a request on tab switch r=jcj
https://hg.mozilla.org/mozilla-central/rev/efa6750d4e13
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Comment on attachment 8909442 [details]
Bug 1400940 - Fix WebAuthn deadlock when cancelling a request on tab switch r=jcj

J.C. Jones [:jcj] has approved the revision.

https://phabricator.services.mozilla.com/D67
Attachment #8909442 - Flags: review+
You need to log in before you can comment on or make changes to this bug.