844088 - ASAN: Several xpcshell tests in toolkit/identity trigger use-after-free, involving KeyGenRunnable

Status: RESOLVED FIXED

(Core Graveyard :: Identity, defect)

Description

[Christian Holler (:decoder)]

Attachment: ASan log

In several try runs I've already been observing that tests like

toolkit/identity/tests/unit/test_jwcrypto.js
toolkit/identity/tests/unit/test_relying_party.js
toolkit/identity/tests/unit/test_provisioning.js

cause ASan errors. I was however never able to reproduce it locally. Now I managed to reproduce a failure with the third test locally, using:

taskset -c 0 make -C toolkit/identity/tests/ xpcshell-tests

on an optimized build (mozilla-central 885cde564ff3). Might need to run it multiple times, but maybe the attached symbolized trace already helps to solve this issue.

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This looks like it's just the XPCWrappedJS off the main thread bug in different clothing.

Comment 2

[Jason Smith [:jsmith]]

For the ASAN failures, how much risk do these ASAN failures pose to FF OS's use of navigator.id from a security perspective?

I'm looking to know if this is worth nominating to block or not.

Comment 3

[Ben Adida [:benadida]]

Jed and I stand ready to fix this ... except we don't know how to read these traces. Kyle: can you help us? Is this how we handled wrapped JS objects, or is it in the C++ crypto code we're using?

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Ben Adida [:benadida] from comment #3)
> Jed and I stand ready to fix this ... except we don't know how to read these
> traces. Kyle: can you help us? Is this how we handled wrapped JS objects, or
> is it in the C++ crypto code we're using?

I think its the same underlying issue as bug 843923 (which is being fixed in bug 773610) and has nothing to do with identity.

Comment 5

[Ben Adida [:benadida]]

(In reply to Kyle Huey [:khuey] ([e-mail]) from comment #4)
> 
> I think its the same underlying issue as bug 843923 (which is being fixed in
> bug 773610) and has nothing to do with identity.

OK, it looks to me like there is a fix in sight for this, so should we wait and see if that fix also fixes this? Or should we be more aggressive and investigate this further right away?

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I think you should just wait and see.

Comment 7

[Daniel Veditz [:dveditz]]

(In reply to Jason Smith [:jsmith] from comment #2)
> For the ASAN failures, how much risk do these ASAN failures pose to FF OS's
> use of navigator.id from a security perspective?
> 
> I'm looking to know if this is worth nominating to block or not.

Shouldn't block, but you'll eventually want the fix when we have one.

Comment 8

[Daniel Veditz [:dveditz]]

Assigning to bholley so he can mark it fixed when bug 772610 lands (assuming that turns out to do the trick).

Comment 9

[Andrew McCreight [:mccr8]]

More precisely, it appears that bug 850253 should fix this.

Comment 10

[Andrew McCreight [:mccr8]]

decoder, now that bug 850253 has landed on central, can you make sure that this doesn't happen any more?  Thanks!

Comment 11

[Christian Holler (:decoder)]

Several try runs haven't shown the issue anymore, confirming as fixed :)

Comment 12

[Daniel Veditz [:dveditz]]

Does this need to be fixed on prior branches? I don't think the identity code is enabled anywhere shipping, is it?

Comment 13

[Daniel Veditz [:dveditz]]

oh, b2g18 has this though.

Comment 14

[Jason Smith [:jsmith]]

(In reply to Daniel Veditz [:dveditz] from comment #13)
> oh, b2g18 has this though.

Right. B2G Identity is enabled on b2g18 and b2g18v1.01. Given comment 7 doesn't indicate this is a blocker, I'd suggest nominating the dependency here (bug 850253) for approval b2g18 to uplift this fix.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Bug 850253 landed on b2g18.

https://hg.mozilla.org/releases/mozilla-b2g18/rev/2d1fe68319cc

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/bb1ba0f59b31