[all-commits] [llvm/llvm-project] 1aa1cb: [LLDB] Fix use-after-free destroying a Binder from...

[aokblast via All-commits]

  Branch: refs/heads/users/aokblast/lldb/fix_use_after_free_json_transport
  Home:   https://github.com/llvm/llvm-project
  Commit: 1aa1cbd77b7b4391e151a484b21073f50e21d016
      https://github.com/llvm/llvm-project/commit/1aa1cbd77b7b4391e151a484b21073f50e21d016
  Author: ShengYi Hung <aokblast at FreeBSD.org>
  Date:   2026-07-12 (Sun, 12 Jul 2026)

  Changed paths:
    M lldb/include/lldb/Host/JSONTransport.h

  Log Message:
  -----------
  [LLDB] Fix use-after-free destroying a Binder from its OnClosed handler

transport::Binder::OnClosed() holds m_mutex (a recursive_mutex) while
invoking m_disconnect_handler. In the MCP server, that handler removes
the disconnected client, which owns the transport and therefore the
Binder itself. As a result, the Binder -- and its m_mutex -- are
destroyed while the scoped_lock in OnClosed still holds the lock.

This is a use-after-free everywhere, as the lock guard later unlocks
freed memory.

Move the disconnect handler out of the critical section and release the
lock before invoking it, so the Binder can be safely destroyed without
holding or destroying a locked mutex.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications