Skip to content

Fix UAF in batch_create_stream_feedback_race unittest#3305

Merged
wwbmmm merged 1 commit into
apache:masterfrom
chenBright:fix_stream_consume
May 20, 2026
Merged

Fix UAF in batch_create_stream_feedback_race unittest#3305
wwbmmm merged 1 commit into
apache:masterfrom
chenBright:fix_stream_consume

Conversation

@chenBright
Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: resolve

Problem Summary:

StreamingRpcTest.batch_create_stream_feedback_race crashes
with SIGSEGV inside Stream::Consume(ci1 ci2):

#0  0x00007ff22a810461 in brpc::Stream::Consume (meta=0x2757c540, iter=...) at src/brpc/stream.cpp:604
#1  0x00007ff22a69453c in bthread::ExecutionQueueBase::_execute (this=this@entry=0x2757e300, head=<optimized out>, high_priority=<optimized out>, niterated=niterated@entry=0x0) at src/bthread/execution_queue.cpp:308
#2  0x00007ff22a6948e0 in bthread::ExecutionQueueBase::_execute_tasks (arg=<optimized out>) at src/bthread/execution_queue.cpp:169
#3  0x00007ff22a6bf510 in bthread::TaskGroup::task_runner (skip_remained=<optimized out>) at src/bthread/task_group.cpp:388
#4  0x00007ff22a693b21 in bthread_make_fcontext () from ./libbrpc.dbg.so
#5  0x0000000000000000 in ?? ()

Stream close is asynchronous: StreamClose only marks the fake socket
failed; the handler's on_closed is invoked later on the consumer
bthread, when Consume is invoked with iter.is_queue_stopped().

The test allocates BatchStreamClientHandler and
BatchStreamFeedbackRaceState on its stack and passes the handler
pointer to two streams via StreamOptions::handler. It also keeps a
SocketUniquePtr (client_extra_ptr) alive across the whole test body
to enlarge the SetConnected race window. That reference pins the
extra stream's fake socket, so BeforeRecycle ->
execution_queue_stop -> the final Consume(is_queue_stopped) for the
extra stream cannot run until client_extra_ptr itself destructs at
scope exit — which happens after the handler/state stack objects have
already been destroyed. When Consume finally runs,
_options.handler is dangling.

Other tests in this file avoid the issue by setting a flag in
on_closed and waiting on it before returning, but
BatchStreamClientHandler::on_closed was empty.

What is changed and the side effects?

Changed:

Side effects:

  • Performance effects:

  • Breaking backward compatibility:


Check List:

@wwbmmm wwbmmm merged commit 3aa5dab into apache:master May 20, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants