744722 - crash in ssl_DefSend

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[George R. Goffe]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:14.0) Gecko/20120411 Firefox/14.0a1
Build ID: 20120411030716

Steps to reproduce:

This branch has been crashing regularly for over a week now. Automatic crash reports have been forwarded. I have run FF Nightly with gdb to catch a back trace for the next crash. Here's the back trace information:

#0  0x00000037c6c0eb1c in __libc_send (fd=<optimized out>, buf=<optimized out>, n=<optimized out>, flags=<optimized out>)                                              
    at ../sysdeps/unix/sysv/linux/x86_64/send.c:33                                                                                                                     
#1  0x00007ffff7ae80ef in pt_Send () from /opt/firefox.vers14/libnspr4.so                                                                                              
#2  0x00007ffff688fcd6 in ssl_DefSend () from /opt/firefox.vers14/libssl3.so                                                                                           
#3  0x00007ffff68838aa in ssl3_SendRecord () from /opt/firefox.vers14/libssl3.so                                                                                       
#4  0x00007ffff6885def in SSL3_SendAlert () from /opt/firefox.vers14/libssl3.so                                                                                        
#5  0x00007ffff6893be5 in ssl_SecureClose () from /opt/firefox.vers14/libssl3.so                                                                                       
#6  0x00007ffff51af93f in nsNSSSocketInfo::CloseSocketAndDestroy(nsNSSShutDownPreventionLock const&) () from /opt/firefox.vers14/libxul.so                             
#7  0x00007ffff51af999 in nsSSLIOLayerClose(PRFileDesc*) () from /opt/firefox.vers14/libxul.so                                                                         
#8  0x00007ffff48eb8c2 in nsSocketTransport::ReleaseFD_Locked(PRFileDesc*) () from /opt/firefox.vers14/libxul.so                                                       
#9  0x00007ffff48ed4b2 in nsSocketTransport::OnSocketDetached(PRFileDesc*) () from /opt/firefox.vers14/libxul.so                                                       
#10 0x00007ffff48ee891 in nsSocketTransportService::DetachSocket(nsSocketTransportService::SocketContext*, nsSocketTransportService::SocketContext*) ()                
   from /opt/firefox.vers14/libxul.so                                                                                                                                  
#11 0x00007ffff48eecb7 in nsSocketTransportService::DoPollIteration(bool) () from /opt/firefox.vers14/libxul.so                                                        
#12 0x00007ffff48eef9b in nsSocketTransportService::Run() () from /opt/firefox.vers14/libxul.so                                                                        
#13 0x00007ffff542dd7e in nsThread::ProcessNextEvent(bool, bool*) () from /opt/firefox.vers14/libxul.so                                                                
#14 0x00007ffff53fb789 in NS_ProcessNextEvent_P(nsIThread*, bool) () from /opt/firefox.vers14/libxul.so                                                                
#15 0x00007ffff542e895 in nsThread::ThreadFunc(void*) () from /opt/firefox.vers14/libxul.so                                                                            
#16 0x00007ffff7aebb24 in _pt_root () from /opt/firefox.vers14/libnspr4.so                                                                                             
#17 0x00000037c6c07d90 in start_thread (arg=0x7fffeb7ff700) at pthread_create.c:309                                                                                    
#18 0x00000037c64f0f5d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

I get this now pretty often. 
Mike, did you re-land the patch which caused problem for me earlier and was backed out.

Comment 2

[Eric Rescorla (:ekr)]

Are you able to show locals in pt_Send()? I know optimization makes this a pain.

I'd particularly like to see pt->secret->md, buf, and amount.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

I'll try to get some more information when I get the crash in GDB next time.
(This is happening quite often, perhaps 4 times a day. Haven't found the regression range yet.)

Comment 4

[Eric Rescorla (:ekr)]

Looking at this, two observations:

1. The fact that we are getting to send() at all means that the fd stack is at least partly non-corrupted, since the vtbl in the fd below NSS must be OKish.
2. send() is supposed to work correctly [or return error] no matter what insane fd you pass in, so that means that the buffer is the most likely problem.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

smaug, in comment 1, are you referring to bug 736066, "Build NSS object files more like the rest of the tree"?

And, are you building with clang or GCC? FWIW, I am not sure that NSS "supports" being built with clang.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Über-silly me. Is this after all just broken pipe and gdb complaining about the signal.
Testing now without gdb. (Though, I was getting some crashes without gdb too)

Comment 7

[David]

I've been getting random crashes of Nightly since about 2 updates ago.  No other browsers are suffering this crash symptom. Chrome and Explorer work just fine when I switch to them. I'm in windows 8 with nothing fancy loaded.

Comment 8

[Scoobidiver (away)]

(In reply to David from comment #7)
> I've been getting random crashes of Nightly since about 2 updates ago.
I doubt your crashes are related to this bug which is one year old. Take a look at about:crashes, click crash IDs and scroll down to Related Bugs and comment if you have reliable steps to reproduce.

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Is this still an issue?

Comment 10

[George R. Goffe]

Hi,

I'm astounded... reported 4 years ago...

I have not experienced this problem since I reported it...

George...

Comment 11

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks for the update.