1590495 - Crash in [@ PK11_MakeCertFromHandle]

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-a82744f7-8030-45ef-892b-fc9d80191022.

Small volume Linux and macOS crash which started in 20190919094654: https://bit.ly/2MAPwGX

Comments:

• Crashes when restarting :(
• I'm trying to access a corp site, which uses certificates to authenticate me.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a15ba287ac6fd84643d248ace00bf18c18382ada&tochange=014c61389f0bd8982f45be269a761fb0d027a6d2

Bug 1580315 landed in that timeframe. ni on assignee in case it is related

Top 10 frames of crashing thread:

0 libnss3.so PK11_MakeCertFromHandle security/nss/lib/pk11wrap/pk11cert.c:310
1 libnss3.so PK11_GetCertsMatchingPrivateKey security/nss/lib/pk11wrap/pk11cert.c:482
2 libxul.so mozilla::psm::FindNonCACertificatesWithPrivateKeys security/manager/ssl/nsNSSComponent.cpp:2214
3 libxul.so ClientAuthDataRunnable::RunOnTargetThread security/manager/ssl/nsNSSIOLayer.cpp:1796
4 libxul.so mozilla::psm::SyncRunnableBase::Run security/manager/ssl/PSMRunnable.cpp:31
5 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
6 libxul.so <name omitted> xpcom/threads/nsThreadUtils.cpp:486
7 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
8 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Bug 1581962 probably introduced this - it added that code path. This may be an issue with the way Firefox is using NSS, but it's more likely that there's an underlying flaw in NSS.

Comment 2

[J.C. Jones [:jcj] (he/they)]

Marcus, can you take a look at triaging this?

Comment 3

[Marcus Burghardt]

Sure.

Comment 4

[Pascal Chevrel:pascalc]

Marcus, can you please triage this bug? Thanks

Comment 5

[Marcus Burghardt]

Attachment: Bug 1590495 - Crash in PK11_MakeCertFromHandle->pk11_fastCert. r=jcj

Comment 6

[Marcus Burghardt]

I don't have an environment where I can try to reproduce that, but I investigated the involved flow and couldn't find any clear problem.
However, I inserted an extra control to validate the slot and handle in that function that may be useful for troubleshooting.

Marcia, could you try to test again with this patch, please?
Set to P2 for now.

Comment 7

[Marcia Knous [:marcia]]

(In reply to Marcus Burghardt from comment #6)

I don't have an environment where I can try to reproduce that, but I investigated the involved flow and couldn't find any clear problem.
However, I inserted an extra control to validate the slot and handle in that function that may be useful for troubleshooting.

Marcia, could you try to test again with this patch, please?
Set to P2 for now.

Hello Marcus - I filed it from crash stats - I wasn't ever able to reproduce the crash on my machine.

Comment 8

[Marcus Burghardt]

Hi Marcia,

I updated the patch some hours ago to solve this problem.

Thanks

Comment 9

[jeremysalwen]

I am consistently hitting this bug on startup (tab restore). Is there a way I could test this patch?

Comment 10

[J.C. Jones [:jcj] (he/they)]

We'll want to take this in NSS 3.47.1 for Firefox 71 (currently Beta).

Comment 11

[J.C. Jones [:jcj] (he/they)]

https://hg.mozilla.org/projects/nss/rev/dc9552c2aa7779601bfa232ab0764a9c4ad17535

Comment 12

[J.C. Jones [:jcj] (he/they)]

(In reply to jeremysalwen from comment #9)

I am consistently hitting this bug on startup (tab restore). Is there a way I could test this patch?

It's probably easiest for me to just get this into Nightly as soon as possible. Are you currently using Beta or Nightly?

Comment 13

[jeremysalwen]

Currently using Beta.

Comment 14

[J.C. Jones [:jcj] (he/they)]

Mmm. I should have it in tomorrow's Nightly, but currently not looking to have it in Beta until approximately the 21st due to our NSS uplift schedule.

Would it be possible for you to verify the fix in Nightly for us when it's ready?

Comment 15

[jeremysalwen]

Sure, I can try using nightly until then.

Comment 16

[jeremysalwen]

I just downloaded nightly and tried it, still encountering the same crash.

Comment 17

[J.C. Jones [:jcj] (he/they)]

Unfortunately, our uplift failed, so it didn't get into Nightly. We're working on it...

Comment 18

[jeremysalwen]

Tried nightly again just now, no dice.

Comment 19

[jeremysalwen]

Again tried the nightly, it's still crashing. Should this bug be reopened?

Comment 20

[jeremysalwen]

Still crashing from nightly.

Comment 21

[J.C. Jones [:jcj] (he/they)]

Firefox hasn't received the fix yet. Please check https://phabricator.services.mozilla.com/D51858 for the "uplift" that will land this fix into Firefox, which is blocked on a separate commit https://phabricator.services.mozilla.com/D52212 - I've added two more potential reviewers to the latter today to hopefully find someone soon with bandwidth to approve it.

I am sorry for the inconvenience. It's also a hassle to me that we can't test any of the last two weeks of updates of NSS in Firefox yet, but I can't unilaterally edit the Firefox testing infrastructure.

If you like, I can email you when it's ready for testing, or needinfo you here.

Comment 22

[Marcus Burghardt]

Thanks for this update J.C.

Comment 23

[jeremysalwen]

Great! Nightly isn't crashing for me any more. Where should I check to see when this fix gets into Beta?

Comment 24

[J.C. Jones [:jcj] (he/they)]

Awesome, glad to hear it!

So this will now be pulled into Firefox 71 as part of Bug 1588559. I'll go ahead and land into the suitable NSS branch right now.

Comment 25

[J.C. Jones [:jcj] (he/they)]

Currently aiming to have this in the current beta, Firefox 71 Beta, approximately Friday next week (22 Nov), in 71.0b12.

Comment 26

[J.C. Jones [:jcj] (he/they)]

NSS_3_47_BRANCH https://hg.mozilla.org/projects/nss/rev/54ce0e2caeb8e7ce8ce93f89cdc0bb2bc7305783

Comment 27

[Pascal Chevrel:pascalc]

71 fixed by the uplift in bug 1588559

Comment 28

[jeremysalwen]

Can confirm Beta isn't crashing for me any more.