(doris) branch master updated: [bugfix](core) writer status is read and write concurrently and will core by use after free (#29982)

[yi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

yiguolei pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/master by this push:
     new 2e8f0204c3e [bugfix](core) writer status is read and write concurrently and will core by use after free (#29982)
2e8f0204c3e is described below

commit 2e8f0204c3e49fd40386fa7e2b56d06f3a2d416a
Author: yiguolei <67...@qq.com>
AuthorDate: Mon Jan 15 17:48:10 2024 +0800

    [bugfix](core) writer status is read and write concurrently and will core by use after free (#29982)
    
    Co-authored-by: yiguolei <yi...@gmail.com>
---
 be/src/vec/sink/writer/async_result_writer.cpp | 6 +++++-
 be/src/vec/sink/writer/async_result_writer.h   | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/be/src/vec/sink/writer/async_result_writer.cpp b/be/src/vec/sink/writer/async_result_writer.cpp
index 93b86ca843e..0ce3196e3a3 100644
--- a/be/src/vec/sink/writer/async_result_writer.cpp
+++ b/be/src/vec/sink/writer/async_result_writer.cpp
@@ -51,13 +51,13 @@ Status AsyncResultWriter::sink(Block* block, bool eos) {
         add_block = _get_free_block(block, rows);
     }
 
+    std::lock_guard l(_m);
     // if io task failed, just return error status to
     // end the query
     if (!_writer_status.ok()) {
         return _writer_status;
     }
 
-    std::lock_guard l(_m);
     _eos = eos;
     if (_dependency && _is_finished()) {
         _dependency->set_ready();
@@ -128,6 +128,10 @@ void AsyncResultWriter::process_block(RuntimeState* state, RuntimeProfile* profi
     // if not in transaction or status is in error or force close we can do close in
     // async IO thread
     if (!_writer_status.ok() || !in_transaction()) {
+        std::lock_guard l(_m);
+        // Using lock to make sure the writer status is not modified
+        // There is a unique ptr err_msg in Status, if it is modified, the unique ptr
+        // maybe released. And it will core because use after free.
         _writer_status = close(_writer_status);
         _need_normal_close = false;
     }
diff --git a/be/src/vec/sink/writer/async_result_writer.h b/be/src/vec/sink/writer/async_result_writer.h
index d48e41daa62..ced123267c5 100644
--- a/be/src/vec/sink/writer/async_result_writer.h
+++ b/be/src/vec/sink/writer/async_result_writer.h
@@ -84,7 +84,10 @@ public:
     // Add the IO thread task process block() to thread pool to dispose the IO
     void start_writer(RuntimeState* state, RuntimeProfile* profile);
 
-    Status get_writer_status() { return _writer_status; }
+    Status get_writer_status() {
+        std::lock_guard l(_m);
+        return _writer_status;
+    }
 
 protected:
     Status _projection_block(Block& input_block, Block* output_block);


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org