1951554 - (CVE-2025-3608) ThreadSanitizer: data race [@ GetConnInfo] vs. [@ mozilla::net::nsHttpTransaction::DisableHttp3]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: tsan-log.txt

Found with m-c 20250303-d4371465982d (--enable-thread-sanitizer --enable-fuzzing)

This was found by visiting a live website with a TSan build.

STR:

• Launch browser and visit site

This issue was triggered by visiting https://www.aol.com/.

WARNING: ThreadSanitizer: data race (pid=160094)
  Read of size 8 at 0x7264000771e8 by main thread:
    #0 get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:314:27 (libxul.so+0x41a1d09) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #1 operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:344:12 (libxul.so+0x41a1d09)
    #2 GetConnInfo /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpTransaction.cpp:1022:43 (libxul.so+0x41a1d09)
    #3 non-virtual thunk to mozilla::net::nsHttpTransaction::GetConnInfo() const /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpTransaction.cpp (libxul.so+0x41a1d09)
    #4 mozilla::net::nsHttpChannel::ContinueProcessResponse1() /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:2750:61 (libxul.so+0x412669d) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #5 mozilla::net::nsHttpChannel::ProcessResponse() /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:2693:10 (libxul.so+0x4126306) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #6 mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest*) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:8058:31 (libxul.so+0x4145bfd) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #7 non-virtual thunk to mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest*) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp (libxul.so+0x41468a5) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #8 nsInputStreamPump::OnStateStart() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:504:20 (libxul.so+0x3b536e8) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #9 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:409:21 (libxul.so+0x3b5324f) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #10 non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp (libxul.so+0x3b54579) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    ...

  Previous write of size 8 at 0x7264000771e8 by thread T7:
    #0 swap /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:270:13 (libxul.so+0x41a948c) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #1 mozilla::net::nsHttpTransaction::DisableHttp3(bool) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpTransaction.cpp:2784:15 (libxul.so+0x41a948c)
    #2 mozilla::net::Http3Session::Shutdown() /builds/worker/checkouts/gecko/netwerk/protocol/http/Http3Session.cpp:300:30 (libxul.so+0x401c6b7) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #3 mozilla::net::Http3Session::~Http3Session() /builds/worker/checkouts/gecko/netwerk/protocol/http/Http3Session.cpp:395:3 (libxul.so+0x401d3de) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #4 mozilla::net::Http3Session::Release() /builds/worker/checkouts/gecko/netwerk/protocol/http/Http3Session.cpp:61:1 (libxul.so+0x401a63a) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #5 Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:49:40 (libxul.so+0x409b142) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #6 Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:409:36 (libxul.so+0x409b142)
    #7 assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:68:7 (libxul.so+0x409b142)
    #8 operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:180:5 (libxul.so+0x409b142)
    #9 mozilla::net::HttpConnectionUDP::CloseTransaction(mozilla::net::nsAHttpTransaction*, nsresult, bool) /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpConnectionUDP.cpp:514:17 (libxul.so+0x409b142)
    #10 mozilla::net::HttpConnectionUDP::OnQuicTimeoutExpired() /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpConnectionUDP.cpp:539:5 (libxul.so+0x409c5eb) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    ...

  Location is heap block of size 1240 at 0x726400077100 allocated by main thread:
    #0 malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:666:5 (firefox-bin+0xd5870) (BuildId: c23a8080410895e75213a9ce9421a9827c597478)
    #1 moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15 (firefox-bin+0x15cce8) (BuildId: c23a8080410895e75213a9ce9421a9827c597478)
    #2 operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10 (libxul.so+0x4120431) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #3 mozilla::net::nsHttpChannel::InitTransaction() /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:1832:20 (libxul.so+0x4120431)
    #4 mozilla::net::nsHttpChannel::DispatchTransaction(mozilla::net::HttpTransactionShell*) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:1382:17 (libxul.so+0x4120043) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #5 DoConnectActual /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:1375:10 (libxul.so+0x411ed5f) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #6 mozilla::net::nsHttpChannel::DoConnect(mozilla::net::HttpTransactionShell*) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:1362:10 (libxul.so+0x411ed5f)
    #7 mozilla::net::nsHttpChannel::ContinueConnect() /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:1324:17 (libxul.so+0x411cdad) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #8 mozilla::net::nsHttpChannel::TriggerNetwork() /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:10757:10 (libxul.so+0x411e1de) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #9 mozilla::net::nsHttpChannel::OnCacheEntryAvailableInternal(nsICacheEntry*, bool, nsresult) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:4860:10 (libxul.so+0x413601f) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    #10 mozilla::net::nsHttpChannel::OnCacheEntryAvailable(nsICacheEntry*, bool, nsresult) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:4788:8 (libxul.so+0x4135c44) (BuildId: 484928afbdd0d069e31cd70a0342bf5d7488dbda)
    ...

Comment 1

[Valentin Gosu [:valentin] (he/him)]

nsHttpTransaction::GetConnInfo and nsHttpTransaction::DisableHttp3 both need to hold the mutex while accessing mConnInfo. Probably the same for all other methods using mConnInfo.

Comment 2

[Kershaw Chang [:kershaw]]

Attachment: Bug 1951554 - Avoid racing on nsHttpTransaction::mConnInfo, r=#necko

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b3ffe3409712
Avoid racing on nsHttpTransaction::mConnInfo, r=necko-reviewers,valentin

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b3ffe3409712

Comment 7

[Kershaw Chang [:kershaw]]

Attachment: Bug 1951554 - Avoid racing on nsHttpTransaction::mConnInfo, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D243146

Comment 8

[Phabricator Automation]

release Uplift Approval Request

• User impact if declined: Possible crash. See bug 1956962, this could be a sec-high bug.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low.
• Explanation of risk level: This patch is straightforward.
• String changes made/needed: N/A
• Is Android affected?: yes

Comment 9

[Andrew McCreight [:mccr8]]

Per jesup's suggestion, I'll bump this up to sec-high. Comment 0 suggests it isn't that hard to reproduce the race.

Comment 10

[Andrew McCreight [:mccr8]]

Maybe you want to revist the uplift flags, Ryan? Thanks.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Sure, but ESR128 and ESR115 are the branches we'll want to uplift to. It'll need rebasing for both, however.

Comment 12

[Andrew McCreight [:mccr8]]

The bug 1956962 crashes only started showing up in 137 so it is possible that it doesn't affect older branches, but maybe that's just a fluke. Hopefully Kershaw can figure that out given that we have a patch now.

Comment 13

[Kershaw Chang [:kershaw]]

(In reply to Andrew McCreight [:mccr8] from comment #12)

The bug 1956962 crashes only started showing up in 137 so it is possible that it doesn't affect older branches, but maybe that's just a fluke. Hopefully Kershaw can figure that out given that we have a patch now.

This is regressed by bug 1948203, so old branches are not affected.
I think we should just uplift this to release 137.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Could be a candidate for next week's mid-cycle dot release since ESR isn't affected.

Comment 15

[Pascal Chevrel:pascalc]

I will build on Monday, can we get sec-approval+ and a CVE or are we OK with shipping the fix in 138?

Comment 16

[Kershaw Chang [:kershaw]]

Comment on attachment 9475643 [details]
Bug 1951554 - Avoid racing on nsHttpTransaction::mConnInfo, r=#necko

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Probably not easy, since this is a race.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: 137
• If not all supported branches, which bug introduced the flaw?: Bug 1948203
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Should be low, since the patch is straightforward and is already landed.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 17

[Kershaw Chang [:kershaw]]

(In reply to Pascal Chevrel:pascalc from comment #15)

I will build on Monday, can we get sec-approval+ and a CVE or are we OK with shipping the fix in 138?

Yes, I think it's fine to ship this in 138.

Comment 18

[Pascal Chevrel:pascalc]

(In reply to Kershaw Chang [:kershaw] from comment #17)

(In reply to Pascal Chevrel:pascalc from comment #15)

I will build on Monday, can we get sec-approval+ and a CVE or are we OK with shipping the fix in 138?

Yes, I think it's fine to ship this in 138.

Ok, marking 137 as wontfix then, thanks.

Comment 19

[Pascal Chevrel:pascalc]

Comment on attachment 9475643 [details]
Bug 1951554 - Avoid racing on nsHttpTransaction::mConnInfo, r=#necko

-> 138

Comment 20

[Kershaw Chang [:kershaw]]

(In reply to Pascal Chevrel:pascalc from comment #18)

(In reply to Kershaw Chang [:kershaw] from comment #17)

(In reply to Pascal Chevrel:pascalc from comment #15)

I will build on Monday, can we get sec-approval+ and a CVE or are we OK with shipping the fix in 138?

Yes, I think it's fine to ship this in 138.

Ok, marking 137 as wontfix then, thanks.

Ah, sorry I was confused with the Fx version. I'd like to uplift this to release 137 if possible.
Thanks.

Comment 21

[Pascal Chevrel:pascalc]

Dan, should we include this bug in the dot release? Thanks

Comment 22

[Daniel Veditz [:dveditz]]

Comment on attachment 9475643 [details]
Bug 1951554 - Avoid racing on nsHttpTransaction::mConnInfo, r=#necko

sec-approval+ for taking this in the mid-cycle point release, a=dveditz

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/8969c956ed8e

Reminder that the dot release ships on April 15 around 3PM CET, so we'll need an advisory ready, thanks!