This repository has been archived by the owner on Jan 7, 2022. It is now read-only.
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix use-after-free in AllServerReadStreams::sendShardStatusToClient()
Summary: Got a segfault with this stack trace: (gdb) bt #0 0x00007ff56c2919cf in raise () from /usr/local/fbcode/platform007/lib/libpthread.so.0 #1 0x0000000002a9656a in facebook::logdevice::handle_fatal_signal (sig=<optimized out>) at logdevice/server/fatalsignal.cpp:58 #2 <signal handler called> #3 facebook::logdevice::configuration::Node::getNumShards (this=0x7fe60c71c610) at logdevice/common/configuration/Node.h:258 #4 facebook::logdevice::AllServerReadStreams::sendShardStatusToClient (this=<optimized out>, cid=...) at logdevice/server/read_path/AllServerReadStreams.cpp:769 #5 0x0000000002a9ec3b in facebook::logdevice::AllServerReadStreams::onShardStatusChanged (this=0x7ff4fcbd5c00) at logdevice/server/read_path/AllServerReadStreams.cpp:740 #6 0x0000000002f9b2d1 in facebook::logdevice::ShardAuthoritativeStatusManager::notifySubscribers (this=<optimized out>) at logdevice/common/ShardAuthoritativeStatusMap.cpp:197 #7 0x0000000002f9b21e in facebook::logdevice::UpdateShardAuthoritativeMapRequest::execute (this=<optimized out>) at logdevice/common/ShardAuthoritativeStatusMap.cpp:138 #8 0x0000000002fd4a0e in facebook::logdevice::Worker::processRequest (this=0x7ff56953d600, rq=std::unique_ptr<facebook::logdevice::Request> containing 0x7ff480557e90) at logdevice/common/Worker.cpp:1282 #9 0x0000000002fdb424 in facebook::logdevice::Worker::forcePost(std::unique_ptr<facebook::logdevice::Request, std::default_delete<facebook::logdevice::Request> >&, signed char)::$_9::operator()() (this=<optimized out>) at logdevice/common/Worker.cpp:1405 #10 folly::detail::function::FunctionTraits<void ()>::callSmall<facebook::logdevice::Worker::forcePost(std::unique_ptr<facebook::logdevice::Request, std::default_delete<facebook::logdevice::Request> >&, signed char)::$_9>(folly::detail::function::Data&) (p=...) at folly/Function.h:360 #11 0x0000000002fd581b in folly::detail::function::FunctionTraits<void ()>::operator()() (this=0x0) at folly/Function.h:376 #12 facebook::logdevice::Worker::pickAndExecuteTask (this=<optimized out>, priority_hint=<optimized out>) at logdevice/common/Worker.cpp:1342 #13 0x0000000002fdaa62 in facebook::logdevice::Worker::addWithPriority(folly::Function<void ()>, signed char)::$_8::operator()() const (this=<optimized out>) at logdevice/common/Worker.cpp:1388 #14 folly::detail::function::FunctionTraits<void ()>::callSmall<facebook::logdevice::Worker::addWithPriority(folly::Function<void ()>, signed char)::$_8>(folly::detail::function::Data&) (p=...) at folly/Function.h:360 #15 0x00000000032de717 in folly::detail::function::FunctionTraits<void ()>::operator()() (this=<optimized out>) at folly/Function.h:376 #16 facebook::logdevice::EventLoop::add(folly::Function<void ()>)::$_0::operator()() (this=0x7fee0ba685a0) at logdevice/common/EventLoop.cpp:159 #17 folly::detail::function::FunctionTraits<void ()>::callBig<facebook::logdevice::EventLoop::add(folly::Function<void ()>)::$_0>(folly::detail::function::Data&) (p=...) at folly/Function.h:367 #18 0x0000000000606428 in folly::detail::function::FunctionTraits<void ()>::operator()() (this=0x7fee0ba685a0) at folly/Function.h:376 #19 facebook::logdevice::EventLoopTaskQueue::executeTasks (this=<optimized out>, num_tasks_to_dequeue=1) at logdevice/common/EventLoopTaskQueue.cpp:151 #20 0x0000000000605801 in facebook::logdevice::EventLoopTaskQueue::haveTasksEventHandler(void*, short)::$_0::operator()(unsigned long) const (n=1, this=<optimized out>) at logdevice/common/EventLoopTaskQueue.cpp:119 #21 facebook::logdevice::LifoEventSemImpl<std::atomic>::AsyncWaiter::processBatch<facebook::logdevice::EventLoopTaskQueue::haveTasksEventHandler(void*, short)::$_0&>(facebook::logdevice::EventLoopTaskQueue::haveTasksEventHandler(void*, short)::$_0&, unsigned long) (this=0x7ff56986a4f0, func=..., maxBatchSize=<optimized out>) at logdevice/common/LifoEventSem.h:205 #22 facebook::logdevice::EventLoopTaskQueue::haveTasksEventHandler (arg=<optimized out>, what=<optimized out>) at logdevice/common/EventLoopTaskQueue.cpp:124 #23 0x0000000000603f52 in facebook::logdevice::EventHandler<&facebook::logdevice::EventLoopTaskQueue::haveTasksEventHandler, &facebook::logdevice::(anonymous namespace)::preflight_noop, &facebook::logdevice::(anonymous namespace)::postflight_noop> (what=<optimized out>, arg=0x20) at logdevice/common/EventHandler.h:92 #24 0x0000000000603e08 in event_process_active_single_queue (base=0x7ff561bddd00, activeq=0x7ff56983c230, max_to_process=2147483647, endtime=0x0) at logdevice/external/libevent-2.1.3-alpha/event.c:1449 #25 0x000000000548641c in event_process_active (base=<optimized out>) at logdevice/external/libevent-2.1.3-alpha/event.c:1596 #26 ld_event_base_loop (base=0x7ff561bddd00, flags=<optimized out>) at logdevice/external/libevent-2.1.3-alpha/event.c:1819 #27 0x00000000032dda80 in facebook::logdevice::EventLoop::run (this=0x7ff56953d600) at logdevice/common/EventLoop.cpp:222 #28 0x00000000032dd279 in facebook::logdevice::EventLoop::enter (self=0x20) at logdevice/common/EventLoop.cpp:173 #29 0x00007ff56c2866b6 in start_thread () from /usr/local/fbcode/platform007/lib/libpthread.so.0 #30 0x00007ff56b967ebf in clone () from /usr/local/fbcode/platform007/lib/libc.so.6 This diff fixes a bug that could cause this. Reviewed By: gdrane Differential Revision: D15887025 fbshipit-source-id: eb6b214ae33a0f36506d0d65d95f33469a6cbae1
- Loading branch information