Skip to content

Fix data race on RspConnector lifetime - #1169

Open
xusheng6 wants to merge 2 commits into
devfrom
test_1074_rspconnector_lifetime
Open

Fix data race on RspConnector lifetime#1169
xusheng6 wants to merge 2 commits into
devfrom
test_1074_rspconnector_lifetime

Conversation

@xusheng6

Copy link
Copy Markdown
Member

Fixes #1074

m_rspConnector is a raw pointer in the Gdb, Corellium and Esreven adapters, with no
synchronization on the read or the delete. A call already in flight can end up using a
freed connector. This is the top debugger crash cluster in Sentry (BINARYNINJA-4E, C1,
E1, E4, ...), which faults inside mtx_do_lock while locking m_socketLock on a dead
connector.

The existing null checks cannot fix this, because the pointer can be freed between the
check and the use.

Change

Wrap the field in AtomicRspConnector, a mutex-guarded shared_ptr. Callers load a
strong reference before use, and teardown just stores nullptr, so the connector is
destroyed only when the last reference drops.

This is 73e6517 from fix-rspconnector-lifetime-race, rebased onto dev. One conflict in
EsrevenAdapter::GetTTDCallsForSymbols, plus four places where the newer bare
!m_rspConnector guards were folded into the load()-then-check pattern.

Testing

test/repro/ adds an ASan driver that runs AddBreakpoint against Quit over a fake
RSP server. Same harness and settings both sides:

build result
dev use-after-free on the first iteration
this branch 25 iterations clean, no ASan report

The failing stack matches the Sentry reports: freed in GdbAdapter::Quit, read from
AddBreakpoint -> TransmitAndReceive -> SendPayload -> SendRaw.

m_rspConnector was a raw pointer with no synchronization on the read or
the delete, so a call already in flight could use a freed connector.

Wrap it in AtomicRspConnector, a mutex-guarded shared_ptr. Callers load a
strong reference before use, and teardown just stores nullptr, so the
connector is destroyed only when the last reference drops.

Fixes #1074
Runs GdbAdapter::AddBreakpoint against GdbAdapter::Quit over a fake RSP
server. Use-after-free on the first iteration before the fix, 25
iterations clean after.

Refs #1074
@xusheng6
xusheng6 requested a review from bdash August 12, 2026 20:16
@xusheng6

Copy link
Copy Markdown
Member Author

@bdash would you please review this? I had a closer look at sentry, and it seems to me that it is still happening

@xusheng6 xusheng6 added this to the Krypton milestone Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Data race on m_rspConnector lifetime across Gdb/Corellium/Esreven adapters

2 participants