Fix UT: address UAF in TestRaftLogStore lifecycle_test under ASan#860
Fix UT: address UAF in TestRaftLogStore lifecycle_test under ASan#860Besroy wants to merge 1 commit intoeBay:masterfrom
Conversation
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #860 +/- ##
==========================================
- Coverage 56.51% 48.29% -8.22%
==========================================
Files 108 110 +2
Lines 10300 12877 +2577
Branches 1402 6179 +4777
==========================================
+ Hits 5821 6219 +398
+ Misses 3894 2564 -1330
- Partials 585 4094 +3509 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| auto ld_key = logdev_key{idx, dev_offset}; | ||
| auto comp_cb = req->log_store->get_comp_cb(); | ||
| (req->cb) ? req->cb(req, ld_key) : comp_cb(req, ld_key); | ||
| m_pending_callback--; |
There was a problem hiding this comment.
m_pending_callback += req_map.size();
for(....){
}
m_pending_callback = 0;
There was a problem hiding this comment.
callback_lambda can be called in async-mode, if we directly set it as 0 out of callback_lambda, then the design of pending callback will not take effect -- the process remains pending_callback = n; -> pending_callback=0 -> all tasks complete, calling callback_lambda
There was a problem hiding this comment.
there is a change here that m_pending_callback is zero but there exist still entities in the req_map
There was a problem hiding this comment.
please change that both cases it resolves the issue
There was a problem hiding this comment.
Since it is non-atomic operation, it's unavoidable that m_pending_callback is zero but there exist still entities in the req_map. But your concern is valid. Although we call flush synchronously before m_id_logstore_map.clear() in stop(), and the on_flush_completion is called synchronously as well (meaning before clear, if the callback not complete, m_pending_callback must be > 0), we don't actually check m_pending_callback again after flush, so there's still a UAF risk.
I've update the pr to ensure logstore won't be cleared until all callbacks are called, please review again, thanks.
6227ac0 to
8f63e39
Compare
8f63e39 to
b5cbfd9
Compare
This change restore pending callback tracking in LogDev::on_flush_completion to fix the UT TestRaftLogStore.lifecycle_test UAF issue.