lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(controller): a worker join that fails its commit barrier leaves nothing bound (bug-1728)

Browse source 
"ERROR incorrect worker idx -1" on every node after a worker-join commit
timeout (during a PreVote/election) was the visible end of a real
dangling pointer. init_worker/rejoin_worker bind the endpoint to the
worker (apply_join_state: w->ep = ep, UNAVAIL cleared) before the commit
barrier; on barrier failure handle_worker_join returned without setting
priv->u.idx, so when that connection closed handle_endpoint_error saw
idx -1, logged the ERROR and never ran handle_worker_leave -- the worker
kept w->ep pointing at the freed endpoint, available for dispatch, until
it rejoined.

- handle_worker_join: on barrier failure, clear w->ep (if still this
  endpoint) and mark the worker unavailable, as if the join never
  happened; the worker retries its join.
- handle_endpoint_error: an idx -1 worker endpoint is now the legitimate
  "closed before its join completed" case -- WARN, nothing to clean up.

test_worker_join_withheld_acks_replies_error also asserts the worker is
unbound and unavailable after the -ETIMEDOUT reply (RED before).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-09-27 05:48:49 +00:00
parent 7aac018c00
commit 33c4f28c6a
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
3 changed files with 39 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/controller/join.c
View file

@ -130,6 +130,21 @@ static int handle_worker_join(cluster_t* c, endpoint_t* ep,
if (rc != 0) {
WARN("%s commit barrier failed for %s, rc %d", __func__,
from->name, rc);
/* bug-1728: init_worker/rejoin_worker already bound this
* endpoint to the worker (apply_join_state: w->ep = ep, UNAVAIL
* cleared). The join failed and priv->u.idx stays -1, so this
* connection's teardown will never run handle_worker_leave --
* undo the binding now, as if the join never happened (the
* worker retries), rather than leave w->ep to dangle once the
* endpoint is freed. */
if (w != NULL) {
lock(w, RTTI_LOCK_WRITE);
if (w->ep == ep) {
w->ep = NULL;
mark_worker_unavail(c, w);
}
unlock(w);
}
idx = rc;
}
}