fix(bug-1733): fix heap-use-after-free race in vtask_enq()
vtask_enq() published a task onto the shared dispatch queue via dataq_enq() before finishing its own initialization (task->owner) -- a concurrent vcpu could dequeue, run, and free the task before the producer's own write executed, an ASAN-confirmed UAF that crashed 2 of 3 controllers under a heavy burst-array-job HA workload. Moved task->owner = vtaskmgr before the publish, mirroring the endpoint_ref- before-publish discipline already established two lines above it (bug-1298). Adds a stress-test regression guard (test_vtask_enq_race.c). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QxaSzHRB7pmYFp4cVnwkA
This commit is contained in:
parent
b1323f8dab
commit
42e1eeaa29
4 changed files with 159 additions and 1 deletions
|
|
@ -188,6 +188,7 @@ libxce_test_src = ['testsuite/test.c',
|
|||
'testsuite/test_wal_wire.c',
|
||||
'testsuite/test_ctrlstatus.c',
|
||||
'testsuite/test_vtask_admission.c',
|
||||
'testsuite/test_vtask_enq_race.c',
|
||||
'testsuite/test_xcealloc.c',
|
||||
'raft/raft_sim.c',
|
||||
]
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue