Fix crash when BRBitcoinPeer disconnects fast#410
Open
cryptodev100 wants to merge 1 commit intoblockset-corp:developfrom
Open
Fix crash when BRBitcoinPeer disconnects fast#410cryptodev100 wants to merge 1 commit intoblockset-corp:developfrom
cryptodev100 wants to merge 1 commit intoblockset-corp:developfrom
Conversation
Contributor
Author
|
This PR might be related to breadwallet/breadwallet-core#295, but breadwallet/breadwallet-core#295 is already outdated and I only tested with new code. |
voisine
approved these changes
Jan 5, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dear Blockset maintainers,
I was playing around with the great functionality of walletkit, but then I stumbled upon a strange crash.
The crash happened especially often when trying to connect to a BitcoinPeer in iPhone-airplane-mode, but it also sometimes happened when my iPhone was not in airplane-mode.
My investigations made it clear that I was dealing with a race-condition and a potential use-after-free.
Therefore, this PR fixes a suspected race-condition when a BRBitcoinPeer disconnects within a very short time.
I don't have a minimum reproducible sample, but I will try to explain how I discovered this crash:
It starts with connecting to BitCoin-peers in peer-2-peer-only-mode, when we reach
btcPeerConnectwithinBRBitcoinPeer.c.btcPeerConnectspawns a new thread that executes_peerThreadRoutine._peerThreadRoutinetries to establish a socket, when it fails to establish a socket, then it will eventually call_peerDisconnectedand exit the previously created thread.An "info-struct" gets passed to
_peerDisconnected._peerDisconnectedfrees members of the info-struct and does some cleanup-stuff.However, I suspect that
_peerDisconnectedmight be called twice for the same info-struct.Let me show you the two callsites of
_peerDisconnected.The first callsite is the following code-snippet, which has a suspicious locking because
manager->lockgets unlocked and then a few lines later locked again within_peerDisconnected.The second callsite is a threadCleanup-function of
_peerThreadRoutine, as shown in the following code-snippet:Now my suspection is that those callsites are racing against each other.
In particular, I observed that
_peerDisconnectedgot invoked with a garbage-info-struct that led to segmentation-faults withinbtcPeerFree.Can you confirm that there are troubles with the multithreaded cleanup of BRBitcoinPeers?