Fix use-after-free from SampleBuffer self-deletion in its own FdWatch callback - #818
Open
MarkRose wants to merge 1 commit into
Open
Fix use-after-free from SampleBuffer self-deletion in its own FdWatch callback#818MarkRose wants to merge 1 commit into
MarkRose wants to merge 1 commit into
Conversation
… callback RtlUsb::SampleBuffer::removeSamples() is invoked as the activity callback of the FdWatch that monitors the read end of its internal signal pipe. When the RTL reader thread exits and closes the write end of that pipe, read() returns 0 (EOF) and removeSamples() responded by synchronously calling closeReadPipe() (which deletes the FdWatch currently dispatching this very callback) and then emitting writePipeClosed(), which is connected to RtlUsb::verboseClose() and ends up deleting the SampleBuffer object itself — all while still executing a member function on that same object's call stack. This is a self-delete-during-callback bug that can lead to use-after-free. - Add SampleBuffer::handleWritePipeClosed(), a small helper that performs the closeReadPipe()/writePipeClosed() cleanup, and defer its invocation via Async::Application::runTask() from removeSamples() instead of calling it inline. This ensures the FdWatch and the owning SampleBuffer are only destroyed after control has returned to the top-level event loop, not from within the FdWatch's own activity dispatch. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RtlUsb::SampleBuffer::removeSamples() is invoked as the activity callback
of the FdWatch that monitors the read end of its internal signal pipe.
When the RTL reader thread exits and closes the write end of that pipe,
read() returns 0 (EOF) and removeSamples() responded by synchronously
calling closeReadPipe() (which deletes the FdWatch currently dispatching
this very callback) and then emitting writePipeClosed(), which is
connected to RtlUsb::verboseClose() and ends up deleting the SampleBuffer
object itself — all while still executing a member function on that
same object's call stack. This is a self-delete-during-callback bug that
can lead to use-after-free.
the closeReadPipe()/writePipeClosed() cleanup, and defer its invocation
via Async::Application::runTask() from removeSamples() instead of
calling it inline. This ensures the FdWatch and the owning SampleBuffer
are only destroyed after control has returned to the top-level event
loop, not from within the FdWatch's own activity dispatch.
Co-Authored-By: Claude Opus 4.8 [email protected]