966446 - Use after free of PGrallocBufferParent by new texture when the child process is killed

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Sotaro Ikeda [:sotaro OOO until July/21]]

I faced this problem during Bug 946720 development. In the past same problem was fixed by Bug 862324. But it is only for deprecated texture.

Comment 1

[Sotaro Ikeda [:sotaro OOO until July/21]]

Attachment: stack trace of the crash

Comment 2

[Sotaro Ikeda [:sotaro OOO until July/21]]

Deprecated texture's problem was actually fixed by Bug 915869.

Comment 3

[Sotaro Ikeda [:sotaro OOO until July/21]]

The problem is that GrallocTextureHostOGL calls PGrallocBufferParent::Send__delete__() after GrallocBufferActor deletion.

Comment 4

[Sotaro Ikeda [:sotaro OOO until July/21]]

There are the following ways to fix the problem.
- [1] Change GrallocBufferActor as reference counted and GrallocTextureHostOGL does not directly call PGrallocBufferParent::Send__delete__().
- [2] GrallocTextureHostOGL forget a pointer to GrallocBufferActor when GrallocBufferActor is destroyed by IPC error.

[1] is ideal way to fix the problem. But the change becomes relatively large. It might be better to put off [1] to MozSurface implementation. [2] is not a better way, but relatively easy to implement. [2] is same way as in  Bug 915869 for deprecated texture.

Comment 5

[Sotaro Ikeda [:sotaro OOO until July/21]]

Attachment: patch - Handle GrallocBufferActor::ActorDestroy for new texture

This is a hacky fix. Confirmed that problem in bug 946720 is fixed by the patch. 
In near future, MozSurface should fix the problem correctly.

Comment 6

[Sotaro Ikeda [:sotaro OOO until July/21]]

https://tbpl.mozilla.org/?tree=Try&rev=5f2cbc946c2b

Comment 7

[Sotaro Ikeda [:sotaro OOO until July/21]]

Attachment: patch v2 - Handle GrallocBufferActor::ActorDestroy for new texture (r=nical)

Committable patch. Carry 'r=nical'.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/eee6439dac17

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/eee6439dac17

Comment 10

[Sotaro Ikeda [:sotaro OOO until July/21]]

Nominate to "1.3T+". This bug block's bug 994590.

Comment 11

[James Zhang (Spreadtrum)]

v1.3 patch conflict

Comment 12

[Keven Kuo [:kkuo]]

Hi! Sotaro,

Could you help? Thanks

--
Keven

Comment 13

[Sotaro Ikeda [:sotaro OOO until July/21]]

Attachment: patch v2 for b2g v1.3t- Handle GrallocBufferActor::ActorDestroy for new texture (r=nical)

A patch for b2g v1.3t.

Comment 14

[Gregor Wagner [:gwagner]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3t/rev/09956a76fd78