fix(asan): heap-use-after-free in pegasus_write_service.cpp #478

foreverneverer · 2020-02-18T10:52:02Z

What problem does this PR solve?

It reports heap-use-after-free bug when excuting the unittest pegasus_write_service_test.duplicate_batched(build with sanitizer). The reason is that err = _impl->batch_commit(ctx.decree) (line 312 ) still use the member of the local variable put_rpc after put_rpc freed(line 304).
https://github.com/XiaoMi/pegasus/blob/695b366dc8605d4b27b9ff6800f2ff066ca56419/src/server/pegasus_write_service.cpp#L300-L321

Coredump

==2862==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00034a0a8 at pc 0x000000956a4e bp 0x7f2f92cb98a0 sp 0x7f2f92cb9890
WRITE of size 4 at 0x60b00034a0a8 thread T45 (replica.default)
    #0 0x956a4d in dsn::apps::update_response::operator=(dsn::apps::update_response const&) /home/mi/work/PegasusDB/pegasus/src/base/rrdb_types.cpp:355
    #1 0x62f7d1 in pegasus::server::pegasus_write_service::impl::clear_up_batch_states(long, int) /home/mi/work/PegasusDB/pegasus/src/server/pegasus_write_service_impl.h:664
    #2 0x6ad9f7 in pegasus::server::pegasus_write_service::impl::batch_commit(long) /home/mi/work/PegasusDB/pegasus/src/server/pegasus_write_service_impl.h:512
    #3 0x6ad9f7 in pegasus::server::pegasus_write_service::duplicate(long, dsn::apps::duplicate_request const&, dsn::apps::duplicate_response&) /home/mi/work/PegasusDB/pegasus/src/server/pegasus_write_service.cpp:312
    #4 0x636086 in pegasus::server::pegasus_write_service_test_duplicate_batched_Test::TestBody() /home/mi/work/PegasusDB/pegasus/src/server/test/pegasus_write_service_test.cpp:269
    #5 0x9ece7c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ece7c)
    #6 0x9e64e6 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e64e6)
    #7 0x9c9909 in testing::Test::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9c9909)
    #8 0x9ca2a1 in testing::TestInfo::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca2a1)
    #9 0x9ca994 in testing::TestCase::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca994)
    #10 0x9d1adb in testing::internal::UnitTestImpl::RunAllTests() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d1adb)
    #11 0x9ee454 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ee454)
    #12 0x9e7328 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e7328)
    #13 0x9d0577 in testing::UnitTest::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d0577)
    #14 0x5c9db0 in RUN_ALL_TESTS() /home/mi/work/PegasusDB/pegasus/rdsn/thirdparty/output/include/gtest/gtest.h:2233
    #15 0x5c9db0 in gtest_app::start(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /home/mi/work/PegasusDB/pegasus/src/server/test/main.cpp:21
    #16 0x7f2fb3c6b1c0 in dsn::service_node::start_app() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/service_engine.cpp:94
    #17 0x7f2fb3cc38c5 in dsn::service_control_task::exec() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/tool_api.cpp:60
    #18 0x7f2fb3c886bf in dsn::task::exec_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task.cpp:180
    #19 0x7f2fb3cbb1d7 in dsn::task_worker::loop() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:211
    #20 0x7f2fb3cbb95b in dsn::task_worker::run_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:191
    #21 0x7f2fb0cc5c7f  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8c7f)
    #22 0x7f2fb16036b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #23 0x7f2fb042b41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x60b00034a0a8 is located 40 bytes inside of 112-byte region [0x60b00034a080,0x60b00034a0f0)
freed by thread T45 (replica.default) here:
    #0 0x7f2fb47bcb2a in operator delete(void*) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99b2a)
    #1 0x6ad3be in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /usr/include/c++/5/bits/shared_ptr_base.h:659
    #2 0x6ad3be in std::__shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /usr/include/c++/5/bits/shared_ptr_base.h:925
    #3 0x6ad3be in std::shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>::~shared_ptr() /usr/include/c++/5/bits/shared_ptr.h:93
    #4 0x6ad3be in dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::~rpc_holder() /home/mi/work/PegasusDB/pegasus/DSN_ROOT/include/dsn/cpp/rpc_holder.h:75
    #5 0x6ad3be in pegasus::server::pegasus_write_service::duplicate(long, dsn::apps::duplicate_request const&, dsn::apps::duplicate_response&) /home/mi/work/PegasusDB/pegasus/src/server/pegasus_write_service.cpp:304
    #6 0x636086 in pegasus::server::pegasus_write_service_test_duplicate_batched_Test::TestBody() /home/mi/work/PegasusDB/pegasus/src/server/test/pegasus_write_service_test.cpp:269
    #7 0x9ece7c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ece7c)
    #8 0x9e64e6 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e64e6)
    #9 0x9c9909 in testing::Test::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9c9909)
    #10 0x9ca2a1 in testing::TestInfo::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca2a1)
    #11 0x9ca994 in testing::TestCase::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca994)
    #12 0x9d1adb in testing::internal::UnitTestImpl::RunAllTests() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d1adb)
    #13 0x9ee454 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ee454)
    #14 0x9e7328 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e7328)
    #15 0x9d0577 in testing::UnitTest::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d0577)
    #16 0x5c9db0 in RUN_ALL_TESTS() /home/mi/work/PegasusDB/pegasus/rdsn/thirdparty/output/include/gtest/gtest.h:2233
    #17 0x5c9db0 in gtest_app::start(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /home/mi/work/PegasusDB/pegasus/src/server/test/main.cpp:21
    #18 0x7f2fb3c6b1c0 in dsn::service_node::start_app() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/service_engine.cpp:94
    #19 0x7f2fb3cc38c5 in dsn::service_control_task::exec() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/tool_api.cpp:60
    #20 0x7f2fb3c886bf in dsn::task::exec_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task.cpp:180
    #21 0x7f2fb3cbb1d7 in dsn::task_worker::loop() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:211
    #22 0x7f2fb3cbb95b in dsn::task_worker::run_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:191
    #23 0x7f2fb0cc5c7f  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8c7f)

previously allocated by thread T45 (replica.default) here:
    #0 0x7f2fb47bc532 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99532)
    #1 0x6acc47 in __gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> >::allocate(unsigned long, void const*) /usr/include/c++/5/ext/new_allocator.h:104
    #2 0x6acc47 in std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> > >::allocate(std::allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> >&, unsigned long) /usr/include/c++/5/bits/alloc_traits.h:491
    #3 0x6acc47 in std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> > > std::__allocate_guarded<std::allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> > >(std::allocator<std::_Sp_counted_ptr_inplace<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, (__gnu_cxx::_Lock_policy)2> >&) /usr/include/c++/5/bits/allocated_ptr.h:102
    #4 0x6acc47 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, dsn::message_ex*&>(std::_Sp_make_shared_tag, dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal*, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> const&, dsn::message_ex*&) /usr/include/c++/5/bits/shared_ptr_base.h:615
    #5 0x6acc47 in std::__shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, dsn::message_ex*&>(std::_Sp_make_shared_tag, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> const&, dsn::message_ex*&) /usr/include/c++/5/bits/shared_ptr_base.h:1097
    #6 0x6acc47 in std::shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>::shared_ptr<std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, dsn::message_ex*&>(std::_Sp_make_shared_tag, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> const&, dsn::message_ex*&) /usr/include/c++/5/bits/shared_ptr.h:319
    #7 0x6acc47 in std::shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> std::allocate_shared<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal>, dsn::message_ex*&>(std::allocator<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> const&, dsn::message_ex*&) /usr/include/c++/5/bits/shared_ptr.h:620
    #8 0x6acc47 in std::shared_ptr<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal> std::make_shared<dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::internal, dsn::message_ex*&>(dsn::message_ex*&) /usr/include/c++/5/bits/shared_ptr.h:636
    #9 0x6acc47 in dsn::rpc_holder<dsn::apps::update_request, dsn::apps::update_response>::rpc_holder(dsn::message_ex*) /home/mi/work/PegasusDB/pegasus/DSN_ROOT/include/dsn/cpp/rpc_holder.h:85
    #10 0x6acc47 in pegasus::server::pegasus_write_service::duplicate(long, dsn::apps::duplicate_request const&, dsn::apps::duplicate_response&) /home/mi/work/PegasusDB/pegasus/src/server/pegasus_write_service.cpp:304
    #11 0x636086 in pegasus::server::pegasus_write_service_test_duplicate_batched_Test::TestBody() /home/mi/work/PegasusDB/pegasus/src/server/test/pegasus_write_service_test.cpp:269
    #12 0x9ece7c in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ece7c)
    #13 0x9e64e6 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e64e6)
    #14 0x9c9909 in testing::Test::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9c9909)
    #15 0x9ca2a1 in testing::TestInfo::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca2a1)
    #16 0x9ca994 in testing::TestCase::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ca994)
    #17 0x9d1adb in testing::internal::UnitTestImpl::RunAllTests() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d1adb)
    #18 0x9ee454 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9ee454)
    #19 0x9e7328 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9e7328)
    #20 0x9d0577 in testing::UnitTest::Run() (/home/mi/work/PegasusDB/pegasus/src/builder/server/test/pegasus_unit_test+0x9d0577)
    #21 0x5c9db0 in RUN_ALL_TESTS() /home/mi/work/PegasusDB/pegasus/rdsn/thirdparty/output/include/gtest/gtest.h:2233
    #22 0x5c9db0 in gtest_app::start(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /home/mi/work/PegasusDB/pegasus/src/server/test/main.cpp:21
    #23 0x7f2fb3c6b1c0 in dsn::service_node::start_app() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/service_engine.cpp:94
    #24 0x7f2fb3cc38c5 in dsn::service_control_task::exec() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/tool_api.cpp:60
    #25 0x7f2fb3c886bf in dsn::task::exec_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task.cpp:180
    #26 0x7f2fb3cbb1d7 in dsn::task_worker::loop() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:211
    #27 0x7f2fb3cbb95b in dsn::task_worker::run_internal() /home/mi/work/PegasusDB/pegasus/rdsn/src/core/core/task_worker.cpp:191
    #28 0x7f2fb0cc5c7f  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8c7f)

Thread T45 (replica.default) created by T0 here:
    #0 0x7f2fb4759253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
    #1 0x7f2fb0cc5dc2 in std::thread::_M_start_thread(std::shared_ptr<std::thread::_Impl_base>, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8dc2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/mi/work/PegasusDB/pegasus/src/base/rrdb_types.cpp:355 dsn::apps::update_response::operator=(dsn::apps::update_response const&)
Shadow bytes around the buggy address:
  0x0c16800613c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16800613d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16800613e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c16800613f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1680061400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c1680061410: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fa fa
  0x0c1680061420: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x0c1680061430: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
  0x0c1680061440: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x0c1680061450: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1680061460: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==2862==ABORTING
run unit test failed
run test "pegasus_unit_test" in /home/mi/work/PegasusDB/pegasus/src/builder/bin/pegasus_unit_test failed

What is changed and how it works?

Same to the code:
https://github.com/XiaoMi/pegasus/blob/695b366dc8605d4b27b9ff6800f2ff066ca56419/src/server/pegasus_server_write.cpp#L89-L124
add _put_rpc_batch.emplace_back(std::move(rpc)) (line 93) and _put_rpc_batch.clear() (line 122) after it no longer needed.

Related changes

Need to cherry-pick to the release branch
Need to be included in the release note

neverchanje · 2020-02-18T15:02:18Z

Good work! But I prefer to have the variables in the local scope. Because it's hard to explain what _put_rpc_batch is used for. Make them local variables then you don't have to explain.

        put_rpc put;
        remove_rpc remove;
        if (request.task_code == dsn::apps::RPC_RRDB_RRDB_PUT) {
            put = put_rpc(put);
            err = _impl->batch_put(ctx, put.request(), put.response());
        }
        if (request.task_code == dsn::apps::RPC_RRDB_RRDB_REMOVE) {
            remove = remove_rpc(write);
            err = _impl->batch_remove(ctx.decree, remove.request(), remove.response());
        }
        if (!err) {
            err = _impl->batch_commit(ctx.decree);
        } else {
            _impl->batch_abort(ctx.decree, err);
        }
        resp.__set_error(err);
        return resp.error;

… duplicate_huaf_bug

foreverneverer · 2020-02-19T02:38:32Z

remove = remove_rpc(write)

Ok, It's better!

src/server/pegasus_write_service.cpp

foreverneverer and others added 2 commits February 18, 2020 18:24

fix

584a363

Merge branch 'master' into duplicate_huaf_bug

4cba1fa

foreverneverer added 2 commits February 19, 2020 10:36

fix

c651d84

Merge branch 'duplicate_huaf_bug' of github.com:Shuo-Jia/pegasus into…

7289c63

… duplicate_huaf_bug

levy5307 reviewed Feb 19, 2020

View reviewed changes

src/server/pegasus_write_service.cpp Show resolved Hide resolved

foreverneverer force-pushed the duplicate_huaf_bug branch from ec59a0c to 7289c63 Compare February 19, 2020 09:30

neverchanje approved these changes Feb 19, 2020

View reviewed changes

Merge branch 'master' into duplicate_huaf_bug

948e37d

hycdong approved these changes Feb 19, 2020

View reviewed changes

Merge branch 'master' into duplicate_huaf_bug

c7a6e03

neverchanje merged commit 6b2a270 into apache:master Feb 19, 2020

weekly-digest bot mentioned this pull request Feb 23, 2020

Weekly Digest (16 February, 2020 - 23 February, 2020) #484

Open

neverchanje mentioned this pull request Mar 31, 2020

Release 1.12.3 #506

Closed

neverchanje pushed a commit that referenced this pull request Mar 31, 2020

fix(asan): heap-use-after-free in pegasus_write_service.cpp (#478)

b41c693

neverchanje added the 1.12.3 label Apr 17, 2020

acelyc111 pushed a commit that referenced this pull request Jun 23, 2022

fix: fix memory leak in unit test netprovider.cpp (#478)

c9d5c22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(asan): heap-use-after-free in pegasus_write_service.cpp #478

fix(asan): heap-use-after-free in pegasus_write_service.cpp #478

foreverneverer commented Feb 18, 2020

neverchanje commented Feb 18, 2020 •

edited

Loading

foreverneverer commented Feb 19, 2020

fix(asan): heap-use-after-free in pegasus_write_service.cpp #478

fix(asan): heap-use-after-free in pegasus_write_service.cpp #478

Conversation

foreverneverer commented Feb 18, 2020

What problem does this PR solve?

Coredump

What is changed and how it works?

neverchanje commented Feb 18, 2020 • edited Loading

foreverneverer commented Feb 19, 2020

neverchanje commented Feb 18, 2020 •

edited

Loading