Closed Bug 1649222 Opened 6 years ago Closed 6 years ago

TSan race in mozilla::NrIceResolver::AllocateResolver

Categories

(Core :: WebRTC: Networking, defect, P2)

Product:
Core
Component:
WebRTC: Networking
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1193437

People

(Reporter: bwc, Assigned: bwc)

References

Details

(Keywords: csectype-race, sec-high)

Looks like we need to be doing most of this init on STS. Marking this security since we're in r_free here.

0:27.54 GECKO(3067322) ==================
0:27.54 GECKO(3067322) WARNING: ThreadSanitizer: data race (pid=3067355)
0:27.54 GECKO(3067322) Write of size 4 at 0x7f553b125e30 by thread T3:
0:27.54 GECKO(3067322) #0 r_free /home/bcampen/checkouts/mozilla-central/media/mtransport/third_party/nrappkit/src/util/libekr/r_memory.c:118:14 (libxul.so+0xc7327f3)
0:27.54 GECKO(3067322) #1 nr_ice_peer_ctx_destroy_cb /home/bcampen/checkouts/mozilla-central/media/mtransport/third_party/nICEr/src/ice/ice_peer_ctx.c:481:5 (libxul.so+0xc713312)
0:27.54 GECKO(3067322) #2 mozilla::nrappkitScheduledCallback::Run() /home/bcampen/checkouts/mozilla-central/media/mtransport/nr_timer.cpp:142:7 (libxul.so+0x7255778)
0:27.54 GECKO(3067322) #3 __invoke_impl<void, void (mozilla::nrappkitScheduledCallback::const &)(), mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/bits/invoke.h:73:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #4 __invoke<void (mozilla::nrappkitScheduledCallback::const &)(), mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/bits/invoke.h:95:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #5 operator()<mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/functional:114:11 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #6 __invoke_impl<void, std::_Mem_fn<void (mozilla::nrappkitScheduledCallback::)()>, mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/bits/invoke.h:60:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #7 __invoke<std::_Mem_fn<void (mozilla::nrappkitScheduledCallback::)()>, mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/bits/invoke.h:95:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #8 __apply_impl<std::_Mem_fn<void (mozilla::nrappkitScheduledCallback::)()>, std::tuple<mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &>, 0> /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/tuple:1684:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #9 apply<std::_Mem_fn<void (mozilla::nrappkitScheduledCallback::)()>, std::tuple<mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> > &> > /usr/lib/gcc/x86_64-redhat-linux/9/../../../../include/c++/9/tuple:1694:14 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #10 mozilla::runnable_args_memfn<mozilla::UniquePtr<mozilla::nrappkitScheduledCallback, mozilla::DefaultDelete<mozilla::nrappkitScheduledCallback> >, void (mozilla::nrappkitScheduledCallback::)()>::RunInternal() /home/bcampen/checkouts/mozilla-central/media/mtransport/runnable_utils.h:121:5 (libxul.so+0x72559e5)
0:27.54 GECKO(3067322) #11 mozilla::detail::runnable_args_base<(mozilla::detail::RunnableResult)0>::Run() /home/bcampen/checkouts/mozilla-central/objdir-ff-tsan/dist/include/mtransport/runnable_utils.h:41:5 (libxul.so+0x67cafb2)
0:27.54 GECKO(3067322) #12 nsThread::ProcessNextEvent(bool, bool) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThread.cpp:1234:14 (libxul.so+0x5dbd280)
0:27.54 GECKO(3067322) #13 NS_ProcessNextEvent(nsIThread*, bool) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThreadUtils.cpp:504:10 (libxul.so+0x5dc1e35)
0:27.54 GECKO(3067322) #14 mozilla::net::nsSocketTransportService::Run() /home/bcampen/checkouts/mozilla-central/netwerk/base/nsSocketTransportService2.cpp:1177:11 (libxul.so+0x5f80771)
0:27.54 GECKO(3067322) #15 non-virtual thunk to mozilla::net::nsSocketTransportService::Run() /home/bcampen/checkouts/mozilla-central/netwerk/base/nsSocketTransportService2.cpp (libxul.so+0x5f81c2d)
0:27.54 GECKO(3067322) #16 nsThread::ProcessNextEvent(bool, bool*) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThread.cpp:1234:14 (libxul.so+0x5dbd280)
0:27.54 GECKO(3067322) #17 NS_ProcessNextEvent(nsIThread*, bool) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThreadUtils.cpp:504:10 (libxul.so+0x5dc1e35)
0:27.54 GECKO(3067322) #18 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /home/bcampen/checkouts/mozilla-central/ipc/glue/MessagePump.cpp:302:20 (libxul.so+0x68b0f2e)
0:27.54 GECKO(3067322) #19 RunInternal /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:316:10 (libxul.so+0x67e430c)
0:27.54 GECKO(3067322) #20 RunHandler /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:309:3 (libxul.so+0x67e430c)
0:27.54 GECKO(3067322) #21 MessageLoop::Run() /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:291:3 (libxul.so+0x67e430c)
0:27.54 GECKO(3067322) #22 nsThread::ThreadFunc(void*) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThread.cpp:447:10 (libxul.so+0x5db8ef8)
0:27.54 GECKO(3067322) #23 _pt_root /home/bcampen/checkouts/mozilla-central/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x50be0)
0:27.54 GECKO(3067322) Previous write of size 4 at 0x7f553b125e30 by main thread:
0:27.54 GECKO(3067322) #0 r_malloc /home/bcampen/checkouts/mozilla-central/media/mtransport/third_party/nrappkit/src/util/libekr/r_memory.c:82:14 (libxul.so+0xc734312)
0:27.54 GECKO(3067322) #1 r_calloc /home/bcampen/checkouts/mozilla-central/media/mtransport/third_party/nrappkit/src/util/libekr/r_memory.c:98:14 (libxul.so+0xc734312)
0:27.54 GECKO(3067322) #2 nr_resolver_create_int /home/bcampen/checkouts/mozilla-central/media/mtransport/third_party/nICEr/src/net/nr_resolver.c:44:18 (libxul.so+0xc716383)
0:27.54 GECKO(3067322) #3 mozilla::NrIceResolver::AllocateResolver() /home/bcampen/checkouts/mozilla-central/media/mtransport/nriceresolver.cpp:104:11 (libxul.so+0x7268142)
0:27.54 GECKO(3067322) #4 operator() /home/bcampen/checkouts/mozilla-central/media/webrtc/signaling/src/peerconnection/MediaTransportHandler.cpp:424:13 (libxul.so+0x7157a60)
0:27.54 GECKO(3067322) #5 mozilla::detail::ProxyFunctionRunnable<mozilla::MediaTransportHandlerSTS::CreateIceCtx(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, nsTArray<mozilla::dom::RTCIceServer> const&, mozilla::dom::RTCIceTransportPolicy)::$_23, mozilla::MozPromise<bool, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, false> >::Run() /home/bcampen/checkouts/mozilla-central/objdir-ff-tsan/dist/include/mozilla/MozPromise.h:1564:29 (libxul.so+0x7157a60)
0:27.54 GECKO(3067322) #6 nsThread::ProcessNextEvent(bool, bool*) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThread.cpp:1234:14 (libxul.so+0x5dbd280)
0:27.54 GECKO(3067322) #7 NS_ProcessNextEvent(nsIThread*, bool) /home/bcampen/checkouts/mozilla-central/xpcom/threads/nsThreadUtils.cpp:504:10 (libxul.so+0x5dc1e35)
0:27.54 GECKO(3067322) #8 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/bcampen/checkouts/mozilla-central/ipc/glue/MessagePump.cpp:87:21 (libxul.so+0x68b035a)
0:27.54 GECKO(3067322) #9 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /home/bcampen/checkouts/mozilla-central/ipc/glue/MessagePump.cpp:270:30 (libxul.so+0x68b0e3b)
0:27.54 GECKO(3067322) #10 RunInternal /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:316:10 (libxul.so+0x67e430c)
0:27.54 GECKO(3067322) #11 RunHandler /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:309:3 (libxul.so+0x67e430c)
0:27.55 GECKO(3067322) #12 MessageLoop::Run() /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:291:3 (libxul.so+0x67e430c)
0:27.55 GECKO(3067322) #13 nsBaseAppShell::Run() /home/bcampen/checkouts/mozilla-central/widget/nsBaseAppShell.cpp:137:27 (libxul.so+0xa2e1b65)
0:27.55 GECKO(3067322) #14 XRE_RunAppShell() /home/bcampen/checkouts/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:913:20 (libxul.so+0xc62ff29)
0:27.55 GECKO(3067322) #15 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /home/bcampen/checkouts/mozilla-central/ipc/glue/MessagePump.cpp:237:9 (libxul.so+0x68b0ded)
0:27.55 GECKO(3067322) #16 RunInternal /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:316:10 (libxul.so+0x67e430c)
0:27.55 GECKO(3067322) #17 RunHandler /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:309:3 (libxul.so+0x67e430c)
0:27.55 GECKO(3067322) #18 MessageLoop::Run() /home/bcampen/checkouts/mozilla-central/ipc/chromium/src/base/message_loop.cc:291:3 (libxul.so+0x67e430c)
0:27.55 GECKO(3067322) #19 XRE_InitChildProcess(int, char**, XREChildData const*) /home/bcampen/checkouts/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:744:34 (libxul.so+0xc62f7d9)
0:27.55 GECKO(3067322) #20 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /home/bcampen/checkouts/mozilla-central/toolkit/xre/Bootstrap.cpp:67:12 (libxul.so+0xc6384a7)
0:27.55 GECKO(3067322) #21 content_process_main /home/bcampen/checkouts/mozilla-central/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28 (firefox+0x11171a)
0:27.55 GECKO(3067322) #22 main /home/bcampen/checkouts/mozilla-central/browser/app/nsBrowserApp.cpp:303:18 (firefox+0x11171a)

Group: core-security → media-core-security

Fixing this will require moving a lot of pref lookups around. This stuff has needed a cleanup for a while, which makes a good cover bug.

Using bug 1193437 for cover.

Depends on: 1193437
Blocks: mochitest_media_tsan
See Also: → 1651509
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE

AFAICT, this is a sec-high affecting all supported releases. Is there something we need to do to address this on !Trunk or are we effectively planning to wontfix this for <Fx80?

Flags: needinfo?(docfaraday)

I think a beta uplift would be justified.

Flags: needinfo?(docfaraday)

Probably ESR too? Or is the backport really hairy?

Grafts cleanly to ESR78, needs rebasing for ESR68 (I can't comment on how hairy that rebase would be).

Group: media-core-security
You need to log in before you can comment on or make changes to this bug.