Skip to content

Fix use after free issue of EventDispatcher LatencyRecorder#3267

Merged
wwbmmm merged 1 commit intoapache:masterfrom
chenBright:fix_ep_bvar
Apr 10, 2026
Merged

Fix use after free issue of EventDispatcher LatencyRecorder#3267
wwbmmm merged 1 commit intoapache:masterfrom
chenBright:fix_ep_bvar

Conversation

@chenBright
Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: resolve #3265

Problem Summary:

  1. Use-After-Free crash on process exit: In StopAndJoinGlobalDispatchers() (registered via atexit), the global bvar::LatencyRecorder pointers g_edisp_read_lantency and g_edisp_write_lantency are explicitly deleted. However, bvar's background sampler thread (bvar_sampler_collector) is a leaky singleton that is never joined or stopped. If the sampler thread is concurrently accessing these recorders when they are deleted, a Use-After-Free occurs.

  2. Unnecessary "latency" prefix stripping in LatencyRecorder::expose().

    // User may add "_latency" as the suffix, remove it.
    if (prefix.ends_with("latency") || prefix.ends_with("Latency")) {
    prefix.remove_suffix(7);
    if (prefix.empty()) {
    LOG(ERROR) << "Invalid prefix2=" << prefix2;
    return -1;
    }
    }

What is changed and the side effects?

Changed:

Side effects:

  • Performance effects:

  • Breaking backward compatibility:


Check List:

@wwbmmm wwbmmm merged commit 771de31 into apache:master Apr 10, 2026
17 checks passed
@chenBright chenBright deleted the fix_ep_bvar branch April 10, 2026 06:15
zchuango pushed a commit to zchuango/brpc that referenced this pull request May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

进程退出时在 atexit 中手动 delete 全局 bvar::LatencyRecorder 导致 UAF Coredump

2 participants