a10acf7b4dcddd45f2acc8b3e81a6825a28e4814  Fix race in HttpCacheDataRemover destruction

The bug at a glance

A lifetime/race bug in the network service: HttpCacheDataRemover/Counter objects owning in-flight background operations were not torn down early in ~NetworkContext(), so their completion callbacks could run against a partially/fully destroyed NetworkContext, producing dangling-pointer use and callback races. Impact is a network-process UAF, but it requires precise timing of context teardown during an in-flight cache clear, limiting practical exploitability.

An attacker who can cause a cache-clear/counter operation to be in flight when the NetworkContext is destroyed (e.g. profile/context shutdown racing a browsing-data clear) could hit a use-after-free in the network process. Defenders care because the network service is a sandboxed-but-privileged process and the bug is a teardown race, which fuzzers/shutdown stress can surface.

Root cause

HttpCacheDataRemovers run asynchronous background operations and post completion callbacks that reference the owning NetworkContext. Before the fix, ~NetworkContext() did not explicitly clear http_cache_data_removers_/http_cache_data_counters_, so an in-flight remover could outlive or race against the destructor and invoke RemoveInvalidationFilterCallback (or its completion) on freed/dangling state. The fix sets is_destructing_ and immediately clears both vectors at the top of the destructor to cancel in-flight operations, and the CL adds null checks in RemoveInvalidationFilterCallback; the new unittest destroys the context mid-ClearHttpCache and asserts the callback is not invoked.

Key code

Cancel in-flight cache removers/counters at the start of teardown

NetworkContext::~NetworkContext() {
  is_destructing_ = true;

  // Clear pending HttpCacheDataRemovers and counters explicitly to cancel
  // any in-flight background operations and avoid callback races.
  http_cache_data_removers_.clear();
  http_cache_data_counters_.clear();

Patch walkthrough

• services/network/network_context.cc — Explicitly clears http_cache_data_removers_ and http_cache_data_counters_ at the start of ~NetworkContext(), destroying the in-flight operations (and their pending callbacks) before the rest of the context is torn down, which prevents dangling-pointer access and callback races.
• services/network/network_context.h — Documents that pending removers are cleared in the destructor to cancel in-flight tasks before teardown; clarifies the lifetime invariant (comment only).
• services/network/network_context_unittest.cc — Adds DestroyWithPendingHttpCacheDataRemovers, which starts ClearHttpCache then destroys the context and spins the run loop, asserting the completion callback is not fired post-destruction (regression coverage).

Background

NetworkContext — Per-profile network-service object owning HTTP cache, cookies and request machinery.

HttpCacheDataRemover / HttpCacheDataCounter — Helper objects that asynchronously clear or count HTTP cache entries and report back via callbacks referencing the NetworkContext.

Teardown callback race — When owned async helpers are not cancelled before their owner is destroyed, their completion callbacks can touch freed memory.

is_destructing_ — Flag the context sets during destruction so callbacks can detect shutdown and avoid acting.

Vulnerability window

1. Reachability — A browsing-data/cache clear starts an HttpCacheDataRemover operation on a NetworkContext. (inferred)
2. Trigger — The NetworkContext is destroyed (profile/context shutdown) while that operation is still in flight. (inferred)
3. Primitive — Pre-fix, the remover’s completion/RemoveInvalidationFilterCallback runs against a destroyed context, dereferencing dangling pointers.
4. Escalation — Reclaiming the freed NetworkContext memory before the callback fires could turn the UAF into controlled corruption in the network process. (inferred)

Proof of concept

Conceptually, initiate an HTTP cache clear (ClearHttpCache) and then cause the owning NetworkContext to be destroyed before the asynchronous remover completes; pre-fix, the remover’s callback executes against freed context state. Reliable triggering needs winning the shutdown-vs-completion race. No exploit code is provided.

Exploitation

1. Setup — Start an in-flight HTTP cache clear/count on a target NetworkContext. (inferred)
2. Race — Force context teardown while the operation is pending so the completion callback is queued against a dying object. (inferred)
3. Use — Pre-fix callback dereferences the freed NetworkContext/remover state, a use-after-free.
4. Corruption — Heap grooming to reclaim the freed allocation could escalate to memory corruption. (inferred)

Detection & hunting

For defenders and detection engineers:

• weggli/grep for destructors that leave owned async-helper vectors uncleared before dependent members are destroyed — Audit ~NetworkContext-style destructors for explicit cancellation of owned operations that post callbacks.
• ASAN/TSAN heap-use-after-free or data race in HttpCacheDataRemover/NetworkContext teardown frames — Stress profile/context shutdown concurrent with ClearHttpCache under sanitizers.

Audit directions

• services/network NetworkContext owned async helpers — Check ProxyLookupRequest and other vectors/sets of in-flight operations for the same early-cancel-on-destruction pattern.
• RemoveInvalidationFilterCallback and sibling cache callbacks — Verify all such callbacks null-check / honor is_destructing_ before touching context state.