Skip to content

Commit

Permalink
uv/append: Don't call uvMaybeFireCloseCb() in uvAliveSegmentWriterClo…
Browse files Browse the repository at this point in the history
…seCb

We actually don't track that there are pending segment writer close operations,
so this call to uvMaybeFireCloseCb() can't really unblock anything waiting on
it.

On the contrary, if it fires after the close callback has actually been fired,
it causes a double free:

=================================================================
==199067==ERROR: AddressSanitizer: attempting double-free on 0x602000000010 in thread T0:
    #0 0x7fd5e44d7288 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    cowsql#1 0x7fd5e4b5a259 in ioCloseCb src/raft.c:115
    cowsql#2 0x7fd5e4b84861 in uvMaybeFireCloseCbReal src/uv.c:202
    cowsql#3 0x7fd5e4afba70 in uv_run (/lib/x86_64-linux-gnu/libuv.so.1+0xfa70) (BuildId: 7f7f8c148150666c7b116bf98bf6e27f96c697a9)
    cowsql#4 0x55b25438ebe5 in SubmitRun tools/benchmark/submit.c:314
    cowsql#5 0x55b254388955 in main tools/benchmark/main.c:60
    cowsql#6 0x7fd5e42456c9  (/lib/x86_64-linux-gnu/libc.so.6+0x276c9) (BuildId: 072feb34c63e054d60d94cbc68d92e4caad25d72)
    cowsql#7 0x7fd5e4245784 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27784) (BuildId: 072feb34c63e054d60d94cbc68d92e4caad25d72)
    cowsql#8 0x55b254388bf0 in _start (/home/free/src/c/raft/tools/.libs/raft-benchmark+0x7bf0) (BuildId: 09105ce7d1a7fe71ca812de2af648a85fc490ebb)

0x602000000010 is located 0 bytes inside of 15-byte region [0x602000000010,0x60200000001f)
freed by thread T0 here:
    #0 0x7fd5e44d7288 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    cowsql#1 0x7fd5e4b5a259 in ioCloseCb src/raft.c:115
    cowsql#2 0x7fd5e4b84861 in uvMaybeFireCloseCbReal src/uv.c:202
    cowsql#3 0x7fd5e4afba70 in uv_run (/lib/x86_64-linux-gnu/libuv.so.1+0xfa70) (BuildId: 7f7f8c148150666c7b116bf98bf6e27f96c697a9)

previously allocated by thread T0 here:
    #0 0x7fd5e44d85bf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    cowsql#1 0x7fd5e4b59983 in raft_init src/raft.c:62
    cowsql#2 0x55b25438e7d4 in serverInit tools/benchmark/submit.c:127
    cowsql#3 0x55b25438ebbf in SubmitRun tools/benchmark/submit.c:302
    cowsql#4 0x55b254388955 in main tools/benchmark/main.c:60
    cowsql#5 0x7fd5e42456c9  (/lib/x86_64-linux-gnu/libc.so.6+0x276c9) (BuildId: 072feb34c63e054d60d94cbc68d92e4caad25d72)

Signed-off-by: Free Ekanayaka <free@ekanayaka.io>
  • Loading branch information
freeekanayaka committed Sep 14, 2023
1 parent 33e613e commit 250dd08
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions src/uv_append.c
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,8 @@ struct uvAppend
static void uvAliveSegmentWriterCloseCb(struct UvWriter *writer)
{
struct uvAliveSegment *segment = writer->data;
struct uv *uv = segment->uv;
uvSegmentBufferClose(&segment->pending);
RaftHeapFree(segment);
uvMaybeFireCloseCb(uv);
}

/* Submit a request to close the current open segment. */
Expand Down

0 comments on commit 250dd08

Please sign in to comment.