1754608 - Intermittent SUMMARY: ThreadSanitizer: data race on ConfirmationContext::TaskAddr / mTask.get()

Status: RESOLVED FIXED

(Core :: Networking: DNS, defect, P3)

Description

[Treeherder Bug Filer]

Filed by: ctuns [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=367309030&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/fGGfbhiOTb-oD-fAizjDiQ/runs/0/artifacts/public/logs/live_backing.log

---

[task 2022-02-09T23:27:01.739Z] 23:27:01     INFO -  TEST-PASS | security/manager/ssl/tests/unit/test_validity.js | took 2984ms
[task 2022-02-09T23:27:01.742Z] 23:27:01     INFO -  Retrying tests that failed when run in parallel.
[task 2022-02-09T23:27:01.744Z] 23:27:01     INFO -  TEST-START | netwerk/test/unit/test_trr.js
[task 2022-02-09T23:27:31.916Z] 23:27:31  WARNING -  TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_trr.js | xpcshell return code: -6
[task 2022-02-09T23:27:31.916Z] 23:27:31     INFO -  TEST-INFO took 30171ms
[task 2022-02-09T23:27:31.916Z] 23:27:31     INFO -  >>>>>>>
[task 2022-02-09T23:27:31.918Z] 23:27:31     INFO -  PID 22240 | start!
[task 2022-02-09T23:27:31.918Z] 23:27:31     INFO -  TEST-PASS | netwerk/test/unit/test_trr.js | setup - [setup : 10] "33846" != null

Comment 1

[Frederik Braun [:freddy]]

Attachment: tsan-log.txt

Drive-by comment, extracting the tsan log from the treeherder file (which is bound to expire eventually)

Comment 2

[Jens Stutte [:jstutte]]

The stack seems to point to TRRService::Observe and TRRService::ConfirmationContext.

Comment 3

[Andrew McCreight [:mccr8]]

From the line numbers, it looks like a race on TRRService::ConfirmationContext::mTask.

Comment 4

[Dragana Damjanovic [:dragana]]

Valentin, can you take a look?

Comment 5

[Valentin Gosu [:valentin] (he/him)]

This is indeed a race on mTask caused by us using the address of the task object to check if we should trigger a new confirmation.
We should either lock mTask or figure out a better way of doing this that doesn't rely on mTask at all. Either way, I don't see any ways this could turn into a vulnerability.

Comment 6

[Kershaw Chang [:kershaw]]

This bug seems to be fixed by bug 1755877.
I think we can close this one.