Closed Bug 1770520 Opened 2 years ago Closed 2 years ago

Crash in [@ __GI_mincore ]

Categories

(Core :: Security: Process Sandboxing, defect)

Product:
Core
Component:
Security: Process Sandboxing
Platform:
Unspecified
Linux
Type:
defect

Tracking

()

Status:
VERIFIED WONTFIX
Tracking Flags:
Tracking Status
firefox-esr91 --- unaffected
firefox100 --- unaffected
firefox101 --- unaffected
firefox102 + fixed

People

(Reporter: jld, Assigned: jld)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Breaking this out from from bug 1769499 comment #11: Mesa EGL uses mincore to determine if a pointer is dereferenceable, as part of its logic for detecting what kind of “native display” pointer is being passed to it. We already allowed that for content processes, so we just need to copy that to the RDD process sandbox so that it can use EGL with GBM.

(Edited to correct some minor misinformation: the backend that used a file descriptor cast from int to void* was fbdev, not DRI, and that was removed in 2015.)

Crash Signature: [@ mincore ] [@ __GI_mincore ] [@ libc.so.6@0x10aa77 | _fini ] [@ libc.so.6@0x100327 | libEGL.so.1@0x57a3 ]
Keywords: crash
Crash Signature: [@ mincore ] [@ __GI_mincore ] [@ libc.so.6@0x10aa77 | _fini ] [@ libc.so.6@0x100327 | libEGL.so.1@0x57a3 ] → [@ mincore ] [@ __GI_mincore ] [@ libc.so.6@0x10aa77 | _fini ] [@ libc.so.6@0x100327 | libEGL.so.1@0x57a3 ] [@ libc.so.6@0x101687 | libEGL.so.1@0x589b ] [@ libc.so.6@0x10608b | libEGL.so.1@0xa3d3 ] [@ __assert_fail_base | libEGL.so.1@0x71a3 ]

The volume of crashes on Nightly is extremely high since build 20220520093126, unless this is gated on nightly, that looks like a release blocker. Is there a patch that can be backed out to restore stability on the nightly channel? Note that we are in RC week, next Monday is central to beta merge day.

status-firefox102: --- → affected
tracking-firefox102: --- → blocking
Flags: needinfo?(jld)
Keywords: regression

bug 1751363 tracks this VAAPI sandbox crash in general.
VAAPI is disabled by default.
bug 1769182 did not fully fix it because bug 1769499 changed a bit under the hood.

Blocks: 1751363
No longer blocks: 1769499
status-firefox100: --- → unaffected
status-firefox101: --- → unaffected
status-firefox102: affected → disabled
status-firefox-esr91: --- → unaffected
Regressed by: 1769499

No new crash has been introduced, only the signature changed.

Has Regression Range: --- → yes

As explained here (and in several related bugs): this feature isn't even on by default.

Flags: needinfo?(jld)

As of bug 1770407, mincore seems no longer necessary.

Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox102: disabled → fixed
Depends on: 1770407
Resolution: --- → FIXED
Summary: Allow mincore() in the RDD sandbox for Mesa EGL → Crash in [@ __GI_mincore ]
No longer blocks: 1751363

I've confirmed that we don't need this anymore.

Status: RESOLVED → VERIFIED
Resolution: FIXED → WONTFIX
You need to log in before you can comment on or make changes to this bug.