1747959 - Crash in [@ je_free | nssCKFWObject_Destroy | NSSCKFWC_FindObjects | builtinsC_FindObjects]

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

Ongoing double-free crash in NSS, goes back to at least 78ESR

Crash report: https://crash-stats.mozilla.org/report/index/f0b92097-748c-44c0-ad10-36ef70211228

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

Top 10 frames of crashing thread:

0 mozglue.dll je_free memory/build/malloc_decls.h:54
1 nssckbi.dll nssCKFWObject_Destroy security/nss/lib/ckfw/object.c:276
2 nssckbi.dll NSSCKFWC_FindObjects security/nss/lib/ckfw/wrap.c:2576
3 nssckbi.dll builtinsC_FindObjects security/nss/lib/ckfw/nssck.api:706
4 nss3.dll pk11_FindObjectsByTemplate security/nss/lib/pk11wrap/pk11obj.c:1896
5 nss3.dll PK11_FindRawCertsWithSubject security/nss/lib/pk11wrap/pk11obj.c:1947
6 xul.dll mozilla::psm::NSSCertDBTrustDomain::FindIssuer security/certverifier/NSSCertDBTrustDomain.cpp:246
7 xul.dll mozilla::pkix::BuildForward security/nss/lib/mozpkix/lib/pkixbuild.cpp:365
8 xul.dll mozilla::pkix::PathBuildingStep::Check security/nss/lib/mozpkix/lib/pkixbuild.cpp:211
9 xul.dll mozilla::psm::CheckCandidates security/certverifier/NSSCertDBTrustDomain.cpp:185

Comment 1

[John Schanck [:jschanck]]

Looks like this could be PSM actually. We're not taking the module list lock in FindRootsWithSubject https://searchfox.org/mozilla-central/source/security/certverifier/NSSCertDBTrustDomain.cpp#114.

Comment 2

[John Schanck [:jschanck]]

Attachment: Bug 1747959 - Take module list lock in FindRootsWithSubject. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5de493c03573
Take module list lock in FindRootsWithSubject. r=keeler

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/5de493c03573

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jschanck, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.