From 4cad1ff60165c909a864d23b385f83a7e2c339ea Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Fri, 29 May 2026 06:00:49 -0700
Subject: [PATCH] Fix data race in stable response padding key initialization

The global HMAC key used for stable response padding was being lazily
initialized using a non-atomic boolean guard and POD statics. On
weakly-ordered architectures (like ARM64), this could allow a concurrent
thread to observe the key as zero-initialized, leading to predictable
padding and potential size disclosure.

Additionally, the lack of synchronization meant multiple threads could
race to initialize the key, potentially resulting in inconsistent
padding values across threads during the race window.

This CL replaces the racy initialization, which was introduced in
crrev.com/c/6052616, with a thread-safe static const initialization
using crypto::RandBytesAsArray.

Fixed: 513049578
Change-Id: I9effaa7e50e3becd96714cad37e4d05960118f13
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7849753
Reviewed-by: Mingyu Lei <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1638424}
---

diff --git a/storage/common/quota/padding_key.cc b/storage/common/quota/padding_key.cc
index 93b753c..64cbd8a5 100644
--- a/storage/common/quota/padding_key.cc
+++ b/storage/common/quota/padding_key.cc
@@ -45,15 +45,10 @@
                                      const base::Time& response_time,
                                      const std::string& request_method,
                                      int64_t side_data_size) {
-  static std::array<uint8_t, 16> s_padding_key;
-  static bool s_padding_key_generated = false;
-
-  if (!s_padding_key_generated) {
-    // This just needs to be consistent within a single browser session, so we
-    // generate it the first time we need it.
-    crypto::RandBytes(s_padding_key);
-    s_padding_key_generated = true;
-  }
+  // This just needs to be consistent within a single browser session, so we
+  // generate it the first time we need it.
+  static const std::array<uint8_t, 16> s_padding_key =
+      crypto::RandBytesAsArray<16>();
 
   DCHECK(!response_url.empty());