Closed Bug 1951161 Opened 1 year ago Closed 1 year ago

SUMMARY: ThreadSanitizer: data race /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c in nssPKIObject_DeleteStoredObject

Categories

(NSS :: Libraries, defect)

Product:
NSS
Component:
Libraries
Type:
defect

Tracking

(firefox-esr115 wontfix, firefox-esr128138+ fixed, firefox136 wontfix, firefox137 wontfix, firefox138 fixed)

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox-esr115 --- wontfix
firefox-esr128 138+ fixed
firefox136 --- wontfix
firefox137 --- wontfix
firefox138 --- fixed

People

(Reporter: mdauer, Assigned: mdauer)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-race, sec-moderate, Whiteboard: [post-critsmash-triage][adv-main138+r][adv-esr128.10+r])

Attachments

(2 files)

crash-1740769242.zip
1.17 KB, application/zip
Details
Bug 1951161 - Improve locking in nssPKIObject_GetInstances, r?#nss-reviewers
48 bytes, text/x-phabricator-request
Details | Review

This was found as part of Bug 1913677. To reproduce, perform the following steps:

  1. Apply the patch from D226460
  2. Build with ./build.sh -c --fuzz=tsan --disable-tests
  3. Run mkdir nsstsandb && certutil -N -d sql:nsstsandb --empty-password
  4. Run TSAN_OPTIONS="suppressions=/path/to/nss/fuzz/config/tsan.suppressions" /path/to/dist/Debug/bin/nsstsan-database replay /path/to/crash-1740769242/*

Marking this security sensitive as a precaution.

Attached file crash-1740769242.zip — 
WARNING: ThreadSanitizer: data race (pid=264647)
  Write of size 4 at 0x727000011900 by thread T2:
    #0 nssPKIObject_DeleteStoredObject /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c (nsstsan-database+0x142b01) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 NSSCertificate_DeleteStoredObject /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/certificate.c:202:12 (nsstsan-database+0x13b975) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #2 SEC_DeletePermCertificate /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/certdb/stanpcertdb.c:83:13 (nsstsan-database+0x11a339) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #3 NSSCertificateDB_DeleteCertificate(unsigned char) /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:233:9 (nsstsan-database+0x100c33) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 TSanThread::SingleRun() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:304:3 (nsstsan-database+0x100172) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #5 TSanThread::Loop() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/thread.cc:61:11 (nsstsan-database+0x105b59) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #6 void std::__invoke_impl<void, void (TSanThread::*)(), TSanThread*>(std::__invoke_memfun_deref, void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14 (nsstsan-database+0x10623b) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #7 std::__invoke_result<void (TSanThread::*)(), TSanThread*>::type std::__invoke<void (TSanThread::*)(), TSanThread*>(void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14 (nsstsan-database+0x10623b)
    #8 void std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:292:13 (nsstsan-database+0x10623b)
    #9 std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:299:11 (nsstsan-database+0x10623b)
    #10 std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>>::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:244:13 (nsstsan-database+0x10623b)
    #11 execute_native_thread_routine /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:104:18 (libstdc++.so.6+0xecdb3) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)

  Previous read of size 4 at 0x727000011900 by thread T5:
    #0 nssPKIObject_GetInstances /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c:335:17 (nsstsan-database+0x142f68) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 NSSCertificate_IsPrivateKeyAvailable /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/certificate.c:675:37 (nsstsan-database+0x13c4b1) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #2 nssTrust_GetCERTCertTrustForCert /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pki3hack.c:633:9 (nsstsan-database+0x13fa72) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #3 SEC_DeletePermCertificate /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/certdb/stanpcertdb.c:69:17 (nsstsan-database+0x11a2fb) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 NSSCertificateDB_DeleteCertificate(unsigned char) /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:233:9 (nsstsan-database+0x100c33) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #5 TSanThread::SingleRun() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:304:3 (nsstsan-database+0x100172) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #6 TSanThread::Loop() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/thread.cc:61:11 (nsstsan-database+0x105b59) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #7 void std::__invoke_impl<void, void (TSanThread::*)(), TSanThread*>(std::__invoke_memfun_deref, void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14 (nsstsan-database+0x10623b) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #8 std::__invoke_result<void (TSanThread::*)(), TSanThread*>::type std::__invoke<void (TSanThread::*)(), TSanThread*>(void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14 (nsstsan-database+0x10623b)
    #9 void std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:292:13 (nsstsan-database+0x10623b)
    #10 std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:299:11 (nsstsan-database+0x10623b)
    #11 std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>>::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:244:13 (nsstsan-database+0x10623b)
    #12 execute_native_thread_routine /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:104:18 (libstdc++.so.6+0xecdb3) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)

  Location is heap block of size 2048 at 0x727000011800 allocated by thread T1:
    #0 malloc <null> (nsstsan-database+0x7dba0) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 PR_Malloc /home/mdauer/mercurial/nss-nspr/nspr/Debug/pr/src/malloc/../../../../pr/src/malloc/prmem.c:425:53 (nsstsan-database+0x4db5ee) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #2 PL_ArenaAllocate /home/mdauer/mercurial/nss-nspr/nspr/Debug/lib/ds/../../../lib/ds/plarena.c:132:21 (nsstsan-database+0x4ce634) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #3 nss_zalloc_arena_locked /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/base/arena.c:751:5 (nsstsan-database+0x131128) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 nss_ZAlloc /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/base/arena.c:872:14 (nsstsan-database+0x131128)
    #5 nssPKIObject_Create /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c:101:14 (nsstsan-database+0x142082) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #6 add_object_instance /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c:775:24 (nsstsan-database+0x143b73) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #7 nssPKIObjectCollection_AddInstanceAsObject /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c:920:12 (nsstsan-database+0x143e0e) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #8 collector /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/trustdomain.c:978:12 (nsstsan-database+0x149980) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #9 nssToken_TraverseCertificates /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/dev/devtoken.c:1450:23 (nsstsan-database+0x1388dd) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #10 NSSTrustDomain_TraverseCertificates /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/trustdomain.c:1023:23 (nsstsan-database+0x14990c) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #11 PK11_ListCerts /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pk11wrap/pk11cert.c:2810:5 (nsstsan-database+0x16f898) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #12 TSanThread::PrepareRun() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:266:30 (nsstsan-database+0xffb05) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #13 TSanThread::Loop() /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/thread.cc:59:11 (nsstsan-database+0x105acb) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #14 void std::__invoke_impl<void, void (TSanThread::*)(), TSanThread*>(std::__invoke_memfun_deref, void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14 (nsstsan-database+0x10623b) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #15 std::__invoke_result<void (TSanThread::*)(), TSanThread*>::type std::__invoke<void (TSanThread::*)(), TSanThread*>(void (TSanThread::*&&)(), TSanThread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14 (nsstsan-database+0x10623b)
    #16 void std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:292:13 (nsstsan-database+0x10623b)
    #17 std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:299:11 (nsstsan-database+0x10623b)
    #18 std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (TSanThread::*)(), TSanThread*>>>::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:244:13 (nsstsan-database+0x10623b)
    #19 execute_native_thread_routine /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:104:18 (libstdc++.so.6+0xecdb3) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)

  Thread T2 (tid=264650, running) created by main thread at:
    #0 pthread_create <null> (nsstsan-database+0x7f54f) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 __gthread_create /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:676:35 (libstdc++.so.6+0xeceb0) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)
    #2 std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:172:37 (libstdc++.so.6+0xeceb0)
    #3 TSanFramework::Run(char*, int, int) /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/framework.cc:71:48 (nsstsan-database+0x104e60) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 main /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:317:19 (nsstsan-database+0x1002b2) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)

  Thread T5 (tid=264653, running) created by main thread at:
    #0 pthread_create <null> (nsstsan-database+0x7f54f) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 __gthread_create /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:676:35 (libstdc++.so.6+0xeceb0) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)
    #2 std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:172:37 (libstdc++.so.6+0xeceb0)
    #3 TSanFramework::Run(char*, int, int) /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/framework.cc:71:48 (nsstsan-database+0x104e60) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 main /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:317:19 (nsstsan-database+0x1002b2) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)

  Thread T1 (tid=264649, running) created by main thread at:
    #0 pthread_create <null> (nsstsan-database+0x7f54f) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #1 __gthread_create /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/include/x86_64-linux-gnu/bits/gthr-default.h:676:35 (libstdc++.so.6+0xeceb0) (BuildId: ca77dae775ec87540acd7218fa990c40d1c94ab1)
    #2 std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) /build/gcc-14-ig5ci0/gcc-14-14.2.0/build/x86_64-linux-gnu/libstdc++-v3/src/c++11/../../../../../src/libstdc++-v3/src/c++11/thread.cc:172:37 (libstdc++.so.6+0xeceb0)
    #3 TSanFramework::Run(char*, int, int) /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/lib/tsan/framework.cc:71:48 (nsstsan-database+0x104e60) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)
    #4 main /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../fuzz/targets/tsan_database.cc:317:19 (nsstsan-database+0x1002b2) (BuildId: 8aa5826af6ffb6ab32990608e47f5673e7732157)

SUMMARY: ThreadSanitizer: data race /home/mdauer/mercurial/nss-nspr/nss/out/Debug/../../lib/pki/pkibase.c in nssPKIObject_DeleteStoredObject
Assignee: nobody → mdauer
Status: NEW → ASSIGNED

https://hg.mozilla.org/projects/nss/rev/29c666798d71a7dadfb126aaed92b68e5cb496c6

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Group: crypto-core-security → core-security-release
Flags: qe-verify-
Whiteboard: [post-critsmash-triage]

John: is this going to land on the NSS branch used with the upcoming ESR 128.10 release?

tracking-firefox-esr128: --- → 138+
Flags: needinfo?(jschanck)

Ben is on point for this release cycle; redirecting the NI to him.

Flags: needinfo?(jschanck) → needinfo?(bbeurdouche)

confirmed with Ben that this is contained in the NSS release. (see bug 1961205)

status-firefox-esr128: affected → fixed
Flags: needinfo?(bbeurdouche)
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main138+r]
Whiteboard: [post-critsmash-triage][adv-main138+r] → [post-critsmash-triage][adv-main138+r][adv-esr128.23+r]
Whiteboard: [post-critsmash-triage][adv-main138+r][adv-esr128.23+r] → [post-critsmash-triage][adv-main138+r][adv-esr128.10+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: