Skip to content

Fix use-after-free in GenericClient/GenericService message deleters - #3360

Merged
ahcorde merged 3 commits into
rollingfrom
ahcorde/rolling/fix_generic_client_service_deleters
Nov 4, 2026
Merged

ahcorde merged 3 commits into
rollingfrom
ahcorde/rolling/fix_generic_client_service_deleters

Conversation

@ahcorde

@ahcorde ahcorde commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Description

The shared_ptr deleters returned by GenericClient::create_response(), GenericService::create_request() and GenericService::create_response()capturedthis` and read the message members through it. If the message outlived the client or service (for example a response kept from a future), the deleter accessed a destroyed object.

  • Capture the members pointer and the type support library by value instead of this. Holding the library also keeps it loaded until fini_function runs.
  • Add tests that free the messages after the client or service is destroyed. UBSan reports the old code; the fixed code is clean.

Did you use Generative AI?

Claude Opus 5.5

Signed-off-by: Alejandro Hernandez Cordero <ahcorde@gmail.com>
@ahcorde ahcorde self-assigned this Oct 16, 2026
@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

ABI Compliance Check

✅ Verdict: compatible

Library Verdict Summary
libcomponent_manager.so ✅ compatible No ABI changes detected.
librclcpp.so ✅ compatible No ABI changes detected.
librclcpp_action.so ✅ compatible No ABI changes detected.
librclcpp_lifecycle.so ✅ compatible No ABI changes detected.
✅ libcomponent_manager.so — full abidiff report

Compared:

  • Base: lib-base/libcomponent_manager.so
  • Head: lib-pr/libcomponent_manager.so @ d3e1f52
(empty report — no differences printed by abidiff)
✅ librclcpp.so — full abidiff report

Compared:

  • Base: lib-base/librclcpp.so
  • Head: lib-pr/librclcpp.so @ d3e1f52
(empty report — no differences printed by abidiff)
✅ librclcpp_action.so — full abidiff report

Compared:

  • Base: lib-base/librclcpp_action.so
  • Head: lib-pr/librclcpp_action.so @ d3e1f52
(empty report — no differences printed by abidiff)
✅ librclcpp_lifecycle.so — full abidiff report

Compared:

  • Base: lib-base/librclcpp_lifecycle.so
  • Head: lib-pr/librclcpp_lifecycle.so @ d3e1f52
(empty report — no differences printed by abidiff)

Updated for commit d3e1f52 · check run · suppressions: /home/runner/work/_temp/ros2-abi-suppressions.txt

Comment thread rclcpp/src/rclcpp/generic_client.cpp Resolved
Signed-off-by: Alejandro Hernandez Cordero <ahcorde@gmail.com>

@clalancette clalancette left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me with green CI.

@ahcorde

ahcorde commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

Pulls: #3360
Gist: https://gist.githubusercontent.com/ahcorde/bc1c4de6d9c353fbb514eef125b993e2/raw/29f016f8831f87b607ff0c0e4144e593f670f837/ros2.repos
BUILD args: --packages-above-and-dependencies rclcpp
TEST args: --packages-above rclcpp
ROS Distro: rolling
Job: ci_launcher
ci_launcher ran: https://ci.ros2.org/job/ci_launcher/20995

  • Linux Build Status
  • Linux-aarch64 Build Status
  • Linux-rhel Build Status
  • Windows Build Status

@ahcorde

ahcorde commented Nov 4, 2026

Copy link
Copy Markdown
Contributor Author
  • Linux Build Status
  • Linux-aarch64 Build Status
  • Linux-rhel Build Status
  • Windows Build Status

@ahcorde

ahcorde commented Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

Pulls: #3360
Gist: https://gist.githubusercontent.com/ahcorde/afc67059c1a2ca1d9228d56bc99b0597/raw/29f016f8831f87b607ff0c0e4144e593f670f837/ros2.repos
BUILD args: --packages-above-and-dependencies rclcpp
TEST args: --packages-above rclcpp
ROS Distro: rolling
Job: ci_launcher
ci_launcher ran: https://ci.ros2.org/job/ci_launcher/21005

  • Linux Build Status
  • Linux-aarch64 Build Status
  • Linux-rhel Build Status
  • Windows Build Status

@ahcorde
ahcorde merged commit 9e81fb5 into rolling Nov 4, 2026
11 checks passed
@ahcorde
ahcorde deleted the ahcorde/rolling/fix_generic_client_service_deleters branch November 4, 2026 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants