1713447 - Crash in [@ mozilla::DataChannelConnection::SctpDtlsOutput] from MOZ_DIAGNOSTIC_ASSERT(!mShutdown)

Status: RESOLVED FIXED

(Core :: WebRTC: Networking, defect, P2)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Not a new signature, 10-20 crashes per Nightly development cycle

Crash report: https://crash-stats.mozilla.org/report/index/8c4c09e0-8cf7-47d9-9b45-a983d0210529

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mShutdown)

Top 10 frames of crashing thread:

0 xul.dll mozilla::DataChannelConnection::SctpDtlsOutput netwerk/sctp/datachannel/DataChannel.cpp:968
1 xul.dll static mozilla::DataChannelRegistry::SctpDtlsOutput netwerk/sctp/datachannel/DataChannel.cpp:221
2 xul.dll sctp_lowlevel_chunk_output netwerk/sctp/src/netinet/sctp_output.c:5053
3 xul.dll sctp_send_abort_tcb netwerk/sctp/src/netinet/sctp_output.c:11577
4 xul.dll sctp_inpcb_free netwerk/sctp/src/netinet/sctp_pcb.c:4068
5 xul.dll sctp_close netwerk/sctp/src/netinet/sctp_usrreq.c:842
6 xul.dll sofree netwerk/sctp/src/user_socket.c:287
7 xul.dll sctp_timeout_handler netwerk/sctp/src/netinet/sctputil.c:2216
8 xul.dll sctp_handle_tick netwerk/sctp/src/netinet/sctp_callout.c:172
9 xul.dll user_sctp_timer_iterate netwerk/sctp/src/netinet/sctp_callout.c:214

Comment 1

[Byron Campen [:bwc]]

Looks like libusrsctp's timer thread can cause callbacks after usrsctp_close and usrsctp_deregister_address have been called.

Comment 2

[Byron Campen [:bwc]]

I suspected that libusrsctp was racy in this way (in bug 1645219), and now we have confirmation. DataChannelRegistry protects us from UAF here by intercepting libusrsctp's callbacks, so we (thankfully) don't have a sec bug here.

I think at this point, we start doing the DataChannelRegistry::Deregister sooner, first thing in Destroy, and remove the assertions that were meant to catch libusrsctp doing this racy stuff.

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

Attachment: Bug 1713447: the sctp library will call us back after usrsctp_close(), so handle and ignore r=bwc

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f02d7e733e4d
the sctp library will call us back after usrsctp_close(), so handle and ignore r=bwc

Comment 6

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/f02d7e733e4d