1768707 - Crash in [@ RtlpFindAndCommitPages | RtlpExtendHeap | RtlpAllocateHeap | RtlpAllocateHeapInternal | RtlpAllocateUserBlockFromHeap | RtlpAllocateUserBlock | RtlpLowFragHeapAllocFromContext | RtlpAllocateHeapInternal | RtlAnsiStringToUnicodeString | RegQ...

Status: NEW

(External Software Affecting Firefox :: Other, defect)

Description

[Bob Owen (:bobowen)]

This appears to be win32k lockdown related.
For 09/05 reports now have 8 clients and 8 crashes in crash pings.
Found earlier reports, but becomes more clearly related as we ramp up.

All have cyinjct.dll (Palo Alto Networks (Netherlands) B.V.) in the stack.

Crash report: https://crash-stats.mozilla.org/report/index/c2e6c830-399b-434b-b1b6-1d2ab0220506

Reason: STATUS_HEAP_CORRUPTION

Top 10 frames of crashing thread:

0 ntdll.dll RtlReportFatalFailure 
1 ntdll.dll RtlReportCriticalFailure 
2 ntdll.dll RtlpHeapHandleError 
3 ntdll.dll RtlpHpHeapHandleError 
4 ntdll.dll RtlpLogHeapFailure 
5 ntdll.dll RtlpAnalyzeHeapFailure 
6 ntdll.dll RtlpFindAndCommitPages 
7 ntdll.dll RtlpExtendHeap 
8 ntdll.dll RtlpAllocateHeap 
9 ntdll.dll RtlpAllocateHeapInternal 

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1759168

Comment 2

[Bob Owen (:bobowen)]

Looking across the crash pings for Fx100 as a whole, looks like this is happening for win32k lockdown disabled as well.
So may not be related, could just be a quirk of the data.

Comment 3

[Bob Owen (:bobowen)]

Adding this signature because it also seems to appear for cyinjct.dll.
However it looks like many of the same signature are to do with mbae64.dll (Malwarebytes Inc), so that might need a separate bug.
Not sure if this is all to do with win32k lockdown, but possibly makes the crashes more frequent.

Comment 4

[Marco Castelluccio [:marco]]

Bob, the volume is pretty low, should we mark this as S3 or could it become more frequent with win32k broader rollout?

Comment 5

[Bob Owen (:bobowen)]

(In reply to Marco Castelluccio [:marco] from comment #4)

Bob, the volume is pretty low, should we mark this as S3 or could it become more frequent with win32k broader rollout?

I now think that nearly all of this probably has nothing to do with win32k lockdown.
Probably more just to do with the third-parties, although I guess the signature could have more than one cause.
I might look at splitting them as well.