adfbd9b2964b73d018a884aefec00dc6520e678c  WebNN: Guard against duplicate context removal on disconnect

The bug at a glance

WebNNContextImpl::OnDisconnect() had no already-lost guard, so it could run more than once for the same context; the first removal erases the context from the provider map and the second hits a duplicate-removal CHECK, intentionally aborting the WebNN service. This is a controlled CHECK crash (denial of service), not memory corruption: no attacker-controlled read/write, no type confusion. Impact is limited to crashing the WebNN service process; it is a reliability/availability defect, hence low severity.

OnDisconnect() posts a RemoveWebNNContextImpl() task to the provider but did not mark the context as already lost. Racing/duplicate disconnect paths could invoke OnDisconnect() twice for the same context, posting the removal task twice; the first removal erases the entry and the second triggers the provider’s duplicate-removal CHECK, aborting the service.

Root cause

A bool is_lost_ (GUARDED_BY_CONTEXT(sequence_checker_)) is added. On the first OnDisconnect() the flag is false, so it proceeds and sets is_lost_ = true; any subsequent OnDisconnect() sees is_lost_ and returns immediately, making teardown idempotent so the removal task is posted exactly once and the duplicate-removal CHECK is never hit.

Key code

Idempotency guard: OnDisconnect returns early once is_lost_ is set, so removal runs exactly once.

void WebNNContextImpl::OnDisconnect() {
  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
  if (is_lost_) {
    return;
  }
  is_lost_ = true;
  // ... reset receivers, post RemoveWebNNContextImpl() to provider ...
}

Patch walkthrough

• services/webnn/webnn_context_impl.cc — At the top of OnDisconnect(), after the sequence check, returns early if is_lost_ is already true and otherwise sets is_lost_ = true before continuing to reset receivers and post the removal task, ensuring the body runs only once per context.
• services/webnn/webnn_context_impl.h — Declares bool is_lost_ GUARDED_BY_CONTEXT(sequence_checker_) = false, documented as making OnDisconnect() idempotent so racing disconnect paths post the removal task only once.

Background

WebNNContextImpl — GPU/WebNN service-side object representing a WebNN context bound over Mojo; destroyed on client disconnect.

OnDisconnect() — Mojo disconnect handler that tears down the context and posts RemoveWebNNContextImpl() to the provider to erase it from the context map.

Duplicate-removal CHECK — A CHECK in the provider’s removal that fires if a context is removed when it is no longer present in the map, intentionally aborting the process on this invariant violation.

GUARDED_BY_CONTEXT — A Chromium thread-safety annotation ensuring is_lost_ is only accessed on the context’s bound sequence, so the flag check/set is race-free on that sequence.

Vulnerability window

1. pre-fix — OnDisconnect() lacked a guard; it could run twice for one context, posting the removal task twice and the second removal hit the duplicate-removal CHECK, aborting the WebNN service. (from commit message)
2. fix — is_lost_ flag added; OnDisconnect() becomes idempotent, posting removal exactly once.
3. post-fix — Racing disconnect paths no longer trigger the CHECK.

Proof of concept

No PoC is derivable from the diff. Triggering it would require inducing two OnDisconnect() invocations for the same WebNNContextImpl (e.g. racing disconnect paths), which the patch references but does not detail; the specific sequence is not shown and should not be fabricated.

Exploitation

1. trigger — Cause OnDisconnect() to run more than once for the same context via racing/duplicate disconnect paths. (from commit message)
2. first removal — The first RemoveWebNNContextImpl() erases the context from the provider map. (from commit message)
3. second removal — The second removal finds the context absent and hits the duplicate-removal CHECK, aborting the WebNN service (DoS). (from commit message)

Detection & hunting

For defenders and detection engineers:

• WebNN service CHECK abort —
• Double-disconnect patterns —

Audit directions

• Mojo disconnect idempotency —
• CHECK-guarded map removals —