1586845 - DNS resolve callback removal outside lock

Status: RESOLVED FIXED

(Core :: Networking: DNS, defect, P1)

Description

[Honza Bambas (:mayhemer)]

[1] should probably be called under the lock. The callback list is normally manipulated only under nsHostResolver::mLock.

[1] https://searchfox.org/mozilla-central/rev/5cb522c7baba24e55874809e0e206b001494c1e9/netwerk/dns/nsHostResolver.cpp#1117-1119

Comment 1

[Honza Bambas (:mayhemer)]

Attachment: Bug 1586845, r=dragana

Comment 2

[Honza Bambas (:mayhemer)]

Daniel, I found this issue during code inspection related to bug 1513519. Not sure it will help with that bug, but I rather filed it as a sec bug anyway.

I'm not sure about sec rating and if this needs some kind of an approval (probably not?)

Thanks.

Comment 3

[Daniel Veditz [:dveditz]]

Better to leave the rating blank if you're unsure, or ask in #security. If you put something there it disappears from triage and can get lost.

You don't need sec-approval for the new rating of sec-moderate.

Comment 4

[Honza Bambas (:mayhemer)]

Thanks. I will land the patch directly.

Comment 5

[Honza Bambas (:mayhemer)]

Comment on attachment 9099312 [details]
Bug 1586845, r=dragana

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This may be related to high-rate sec bug 1513519 affecting fennec, hence it's worth landing this otherwise harmless patch to check if it fixes or progresses that bug.
• User impact if declined: UAFs - this is a race.
• Fix Landed on Version: 71
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This just locks removal of a smart-ptr from a structure, no foreign code calls made under the lock, hence no chance for new deadlocks.
• String or UUID changes made by this patch:

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 9099312 [details]
Bug 1586845, r=dragana

Beta/Release Uplift Approval Request

• User impact if declined: Possible race on a refptr.
• Is this code covered by automated tests?: Unknown
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: There is no STR to trigger the race.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): see previous comment
• String changes made/needed:

Comment 7

[Julien Cristau [:jcristau] (back August 18)]

https://hg.mozilla.org/integration/autoland/rev/4af47e25abad5f44640b453b30a78855dfe80874

Comment 8

[Liz Henry (:lizzard)]

Comment on attachment 9099312 [details]
Bug 1586845, r=dragana

Fix for a bug which may affect other security-sensitive issues, OK for uplift for beta 14.

Comment 9

[Liz Henry (:lizzard)]

Is there any verification we can do (for desktop and for fennec) here?

Comment 10

[Honza Bambas (:mayhemer)]

(In reply to Liz Henry (:lizzard) from comment #9)

Is there any verification we can do (for desktop and for fennec) here?

I'm afraid not :( If we could, bug 1513519 would be fixed or more understood now...

Comment 11

[Julien Cristau [:jcristau] (back August 18)]

https://hg.mozilla.org/releases/mozilla-beta/rev/2ce58a99cbfd

Comment 12

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/4af47e25abad5f44640b453b30a78855dfe80874

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9099312 [details]
Bug 1586845, r=dragana

Approved for Fennec 68.2b7. Fingers crossed that it helps with the crashes!

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/b07f17122272

Comment 15

[Honza Bambas (:mayhemer)]

Unfortunately but kinda expectedly, didn't help with bug 1513519: https://crash-stats.mozilla.org/report/index/99e1b206-47f4-402f-8168-00e2b0191021 :(