fix(bug-1733): fix heap-use-after-free race in vtask_enq()

vtask_enq() published a task onto the shared dispatch queue via
dataq_enq() before finishing its own initialization (task->owner) -- a
concurrent vcpu could dequeue, run, and free the task before the
producer's own write executed, an ASAN-confirmed UAF that crashed 2 of
3 controllers under a heavy burst-array-job HA workload. Moved
task->owner = vtaskmgr before the publish, mirroring the endpoint_ref-
before-publish discipline already established two lines above it
(bug-1298). Adds a stress-test regression guard (test_vtask_enq_race.c).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019QxaSzHRB7pmYFp4cVnwkA
This commit is contained in:
Rongsong Shen 2026-08-29 11:28:48 +00:00
parent b1323f8dab
commit 42e1eeaa29
No known key found for this signature in database
GPG key ID: 5BCDAAE0123E9FE2
4 changed files with 159 additions and 1 deletions

View file

@ -188,6 +188,7 @@ libxce_test_src = ['testsuite/test.c',
'testsuite/test_wal_wire.c',
'testsuite/test_ctrlstatus.c',
'testsuite/test_vtask_admission.c',
'testsuite/test_vtask_enq_race.c',
'testsuite/test_xcealloc.c',
'raft/raft_sim.c',
]