1406730 - Crash in WinSqmSetIfMaxDWORD NOT called from sowakeup

Status: RESOLVED DUPLICATE of bug 1400563

(Core :: Networking, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-0ab18326-da6d-4b97-90c1-559df0171008.
=============================================================
Crashing Thread (31)
Frame 	Module 	Signature 	Source
0 	ntdll.dll 	WinSqmSetIfMaxDWORD 	
1 	xul.dll 	sowakeup 	netwerk/sctp/src/user_socket.c:1479
2 	xul.dll 	socantrcvmore_locked 	netwerk/sctp/src/user_socket.c:99
3 	xul.dll 	sctp_notify_assoc_change 	netwerk/sctp/src/netinet/sctputil.c:2853
4 	xul.dll 	sctp_ulp_notify 	netwerk/sctp/src/netinet/sctputil.c:3809
5 	xul.dll 	sctp_abort_notification 	netwerk/sctp/src/netinet/sctputil.c:4046
6 	xul.dll 	sctp_abort_an_association 	netwerk/sctp/src/netinet/sctputil.c:4215
7 	xul.dll 	sctp_threshold_management 	netwerk/sctp/src/netinet/sctp_timer.c:167
8 	xul.dll 	sctp_heartbeat_timer 	netwerk/sctp/src/netinet/sctp_timer.c:1405
9 	xul.dll 	sctp_timeout_handler 	netwerk/sctp/src/netinet/sctputil.c:1777
10 	xul.dll 	sctp_handle_tick 	netwerk/sctp/src/netinet/sctp_callout.c:155
11 	xul.dll 	user_sctp_timer_iterate 	netwerk/sctp/src/netinet/sctp_callout.c:194
12 	kernel32.dll 	BaseThreadInitThunk 	
13 	mozglue.dll 	patched_BaseThreadInitThunk 	mozglue/build/WindowsDllBlocklist.cpp:824
14 	ntdll.dll 	__RtlUserThreadStart 	
15 	ntdll.dll 	_RtlUserThreadStart

this crash signature is on the rise since firefox 54 on 32bit browser versions on win7.
the crash address indicates a UAF situation.

Comment 1

[Daniel Veditz [:dveditz]]

98% of crashes are on UAF-poisoned addresses.

Comment 2

[Julien Cristau [:jcristau]]

Is this different from bug 1400563?

Comment 3

[Panos Astithas (he/him) [:past] (please ni?)]

(In reply to Julien Cristau [:jcristau] from comment #2)
> Is this different from bug 1400563?

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

Yes - that's just the sowakeup calls leading to this signature.  this is everything else:

https://crash-stats.mozilla.com/signature/?proto_signature=%21~sowakeup&signature=WinSqmSetIfMaxDWORD&date=%3E%3D2017-07-11T16%3A38%3A12.000Z&date=%3C2017-10-11T16%3A38%3A12.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

Rethinking this: the volume on beta is low to begin with, and non-existent in Nightly, so waiting on nightly info won't be helpful.  

Given we aren't seeing any new crashes in Nightly, I think we should consider uplifting to beta.  I'll make the decision in the next day or two.

Comment 6

[Daniel Veditz [:dveditz]]

Assigning to Randell since he seems to be on the hook for the next step. (trying to eliminate unowned high/crit security bugs)

Comment 7

[Honza Bambas (:mayhemer)]

Assigned, but no activity.  Randell, are you working on this?

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

I am, but am looking for new ideas to attack it.  Also I badly want to import the latest SCTP upstream library if/when it's in a state to be imported (was blocked on that).

Comment 9

[Frederik Braun [:freddy]]

(In reply to Randell Jesup [:jesup] from comment #8)
> I am, but am looking for new ideas to attack it.  Also I badly want to
> import the latest SCTP upstream library if/when it's in a state to be
> imported (was blocked on that).

When _is it_ in a state to be imported? Is there a bug?

Comment 10

[Randell Jesup [:jesup] (needinfo me)]

It has been imported.  This really is a dup

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Setting the flags to match bug 1400563.