1714391 - Crash in [@ nouveau_fence_next] -- UAF, called from WebGL

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

This is mostly happening in 78.7.1 -- it used to happen in versions up through 88, but perhaps is fixed in 89+?

UAF in code called from WebGL

Crash report: https://crash-stats.mozilla.org/report/index/6e143ade-2813-4ea7-bacd-f679d0210603

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 nouveau_dri.so nouveau_fence_next /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/gallium/drivers/nouveau/../../../../../../src/gallium/drivers/nouveau/nouveau_fence.c:226
1 nouveau_dri.so nv30_context_kick_notify /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/gallium/drivers/nouveau/../../../../../../src/gallium/drivers/nouveau/nv30/nv30_context.c:47
2 libdrm_nouveau.so.2 pushbuf_submit /build/libdrm-JmVZ1P/libdrm-2.4.67/build/nouveau/../../nouveau/pushbuf.c:328
3 libdrm_nouveau.so.2 pushbuf_flush /build/libdrm-JmVZ1P/libdrm-2.4.67/build/nouveau/../../nouveau/pushbuf.c:405
4 libdrm_nouveau.so.2 nouveau_pushbuf_kick /build/libdrm-JmVZ1P/libdrm-2.4.67/build/nouveau/../../nouveau/pushbuf.c:779
5 nouveau_dri.so nv30_context_flush /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/gallium/drivers/nouveau/../../../../../../src/gallium/drivers/nouveau/nv30/nv30_context.c:81
6 nouveau_dri.so st_flush /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_flush.c:87
7 nouveau_dri.so st_glFlush /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_flush.c:121
8 nouveau_dri.so _mesa_flush /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/mesa/../../../../src/mesa/main/context.c:1691
9 nouveau_dri.so _mesa_make_current /build/mesa-iwkJTx/mesa-10.1.3/build/dri/src/mesa/../../../../src/mesa/main/context.c:1503

Comment 1

[Julien Cristau [:jcristau]]

Looks like the reports are mostly from Linux Mint 17.x (based on ubuntu 14.04 and EOL in 2019), and mesa versions 10.1.0 and 10.1.3, also from 2014.

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1714391.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1714391.

Comment 4

[Andrew Osmond [:aosmond] (he/him)]

Attached two patches as ESR has diverged so we can't uplift directly. Blocks everything on Mesa < 11 instead of < 10.

Comment 5

[Andrew Osmond [:aosmond] (he/him)]

Comment on attachment 9227764 [details]
Bug 1714391.

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Not easily. We are just blocking Mesa version 10, so that would be their starting point.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely to cause regressions. We just block WebGL (well all gfx features) with really old Mesa which very few users are likely still using.

Comment 6

[Kelsey Gilbert [:jgilbert]]

Woah, hold up. Block nouveau in this case, not all mesa <11.

Comment 7

[Andrew Osmond [:aosmond] (he/him)]

Any landing guidance?

Comment 8

[Julien Cristau [:jcristau]]

r=jrmuizel,jgilbert
https://hg.mozilla.org/integration/autoland/rev/d99fe7dbb8f8a7f090df19d9c80b05fa386b2811

Please request uplift when you get a chance.

Comment 9

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 9227764 [details]
Bug 1714391.

Beta/Release Uplift Approval Request

• User impact if declined: Crashes on old nouveau drivers with WebGL
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just a block list entry
• String changes made/needed:

Comment 10

[Ryan VanderMeulen (PTO, back July 27)]

Comment on attachment 9227764 [details]
Bug 1714391.

Approved for 90.0b12 and 78.12esr.

Comment 11

[Ryan VanderMeulen (PTO, back July 27)]

https://hg.mozilla.org/releases/mozilla-beta/rev/727efd13240c

Comment 12

[Ryan VanderMeulen (PTO, back July 27)]

https://hg.mozilla.org/releases/mozilla-esr78/rev/17211c48aea7

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/d99fe7dbb8f8

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.