lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(raft-drive-async): endpoint-quiescence for bug-1197 vote-ep teardown (task 3.4a)

Browse source 
When the (still-default-OFF) peer-control dispatch flag is ON,
raft_cb_become_follower runs as a vtask pool worker and frees every peer
vote-ep while other pool workers may still hold those eps' data — a UAF
(bug-1197). This makes that path quiescence-safe so the flag can later be
flipped ON (deferred to the 4.x prod-flip gate; production stays OFF here).

Mechanism (no libxce-wide endpoint refcount; reuses the existing per-ep FIFO +
busy serialization):

- Deferred teardown-as-vtask: the loser loop, when dispatch is ON and the pool
  is wired, does per vote-ep endpoint_mark_tearing_down -> iomgr_unmonitor ->
  enqueue a VTASK_IO/VTASK_LIVENESS teardown vtask bound to that ep. Per-ep busy
  FIFO makes it run strictly after any in-flight/queued same-ep peer-control
  vtask; the body NULLs iod->ep before endpoint_fini+free(ep) to disarm
  run_task's post-body endpoint_unblock_tasks (which would touch the freed
  ep->lock). OFF / pool-unwired path is byte-for-byte the legacy endpoint_fini.

- RCU-like drain closes the dispatch/teardown TOCTOU window: new _Atomic int
  endpoint_t.dispatch_inflight (+ tearing_down:1 bit). The ON dispatch brackets
  its flag-check+enqueue with fetch_add/fetch_sub (seq_cst);
  endpoint_mark_tearing_down sets the flag under ep->lock, releases, then spins
  until dispatch_inflight drains to 0. So every dispatch that read the flag
  false finishes its enqueue before mark returns (FIFO-before the teardown
  vtask); any later dispatch reads the flag set and drops the packet. ep->lock
  is deliberately NOT held across the enqueue (it inverts with the taskq lock in
  vtask_eligible); the counter is the lock-free handshake. Drain is bounded: the
  held window is just a calloc + non-blocking enqueue on the single io_worker.

Still open before the production flag flip (4.x): the borrowed-ep race in
snapshot_lane_fn/configpush_lane_fn is distinct (slowlane thread vs io_worker
RDHUP teardown, not the vtask-pool FIFO) and needs its own per-standby-ep
discipline.

Tests: test_ha_vep_teardown.c — 5 ASan tests (ordering, late-event drop, run_task
unblock disarm, OFF-path unchanged, deterministic mark-drains-inflight-dispatch).
xcelib_test 282/0; controller_unit_test EXIT=0; ASan-clean. Adversarial
cpp-review: no CRITICAL/HIGH; handshake formally sound, flag-ON path race-free.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S6fDCtXkkEgupu7rUah1y2
This commit is contained in:
Rongsong Shen 2026-06-26 17:37:26 +00:00
parent bd02064ebc
commit 6d510d8cf4
10 changed files with 1037 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

30
.wolf/memory.md
View file

@ -3486,3 +3486,33 @@
| 08:57 | Edited src/controller/ha.c | modified XCE_TESTING() | ~115 |
| 09:05 | Edited .kiro/specs/raft-drive-async/tasks.md | inline fix | ~51 |
| 09:05 | raft-drive-async 3.3: requester-less config-push SlowLane offload (DORMANT flag-OFF), 3 drive-thread sites + deep-copy bytes ownership | ha.c, ha.h, test_ha_liveness.c | 3 tests pass, ctrl EXIT=0, cpp-review GO no CRIT/HIGH/MED | ~58k |
| 09:54 | Edited src/include/netio.h | 2→3 lines | ~35 |
| 09:55 | Edited src/include/netio.h | 3→8 lines | ~137 |
| 09:55 | Edited src/lib/netio.c | 2→3 lines | ~26 |
| 09:55 | Edited src/lib/netio.c | modified endpoint_is_task_blocked() | ~251 |
| 09:55 | Edited src/controller/ha.c | 3→6 lines | ~99 |
| 09:55 | Edited src/controller/ha.c | added 1 condition(s) | ~308 |
| 09:56 | Edited src/controller/ha.c | added 6 condition(s) | ~1427 |
| 09:56 | Edited src/controller/ha.c | added 2 condition(s) | ~344 |
| 09:57 | Edited src/controller/ha.h | modified ha_vote_ep_teardown_for_test() | ~192 |
| 09:59 | Created src/controller/testsuite/test_ha_vep_teardown.c | — | ~3633 |
| 10:00 | Edited src/controller/testsuite/controller_test.c | 1→2 lines | ~23 |
| 10:00 | Edited src/controller/testsuite/controller_test.c | 3→4 lines | ~26 |
| 10:00 | Edited src/controller/meson.build | 1→2 lines | ~22 |
| 10:06 | Session end: 37 writes across 10 files (test_ha_liveness.c, ha.c, ha.h, persist.c, tasks.md) | 18 reads | ~251937 tok |
| 10:06 | Edited src/include/netio.h | 4→5 lines | ~30 |
| 10:06 | Edited src/include/netio.h | expanded (+6 lines) | ~152 |
| 10:07 | Edited src/lib/netio.c | 3→5 lines | ~27 |
| 10:07 | Edited src/lib/netio.c | 3→4 lines | ~34 |
| 10:07 | Edited src/lib/netio.c | modified endpoint_mark_tearing_down() | ~351 |
| 10:08 | Edited src/controller/ha.c | added 1 condition(s) | ~584 |
| 10:08 | Edited src/controller/ha.c | modified XCE_TESTING() | ~182 |
| 10:08 | Edited src/controller/ha.h | modified ha_peerctrl_predispatch_probe() | ~158 |
| 10:10 | Edited src/controller/testsuite/test_ha_vep_teardown.c | 5→10 lines | ~114 |
| 10:10 | Edited src/controller/testsuite/test_ha_vep_teardown.c | 5→2 lines | ~22 |
| 10:11 | Edited src/controller/testsuite/test_ha_vep_teardown.c | modified body_probe() | ~285 |
| 10:11 | Edited src/controller/testsuite/test_ha_vep_teardown.c | 3→5 lines | ~39 |
| 10:12 | Edited src/controller/testsuite/test_ha_vep_teardown.c | added error handling | ~1403 |
| 10:35 | Edited src/controller/ha.c | modified NOTE() | ~147 |
| 10:36 | Edited .kiro/specs/raft-drive-async/tasks.md | 1→2 lines | ~121 |
| 10:38 | raft-drive-async 3.4a: bug-1197 endpoint-quiescence (deferred teardown-vtask + RCU dispatch_inflight drain); flags STILL OFF | netio.h, netio.c, ha.c, ha.h, test_ha_vep_teardown.c | xcelib 282/0, ctrl EXIT=0, 5 vep tests ASan-clean, cpp-review GO race-free | ~75k |