wdgzyjx/myxce
1
0
Fork 0
forked from lei.chen/myxce
Code Pull requests Activity

fix(config): serialize load_primary_config against concurrent invocations (bug-1476)

Browse source 
myconf->lock (mylock_init/fini wiring) had landed but load_primary_config()
itself was left in its RED-phase reproduction state (unguarded, decoding
directly into the shared myconf->cluster_config field), so the fix's own
regression test failed on resume: thread B raced through while thread A was
parked mid-call.

Wraps the whole free-decode-publish sequence in myconf->lock (acquired first,
released on every return path) and decodes into a local cluster_config_t*
first, publishing into myconf->cluster_config only after full decode and
validation succeed -- closing the UAF/double-free window a live 3-node ASan
soak caught (two concurrent handle_repl_config_push deliveries for the same
standby racing two load_primary_config calls).

Verified 4/4 clean full-suite runs (1036 tests, 0 failures) including the
specific race test.
This commit is contained in:
Rongsong Shen 2026-07-28 08:13:54 +00:00
parent ce8df99037
commit b08e392eeb
8 changed files with 704 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/include/myconf.h
View file

@ -10,6 +10,7 @@
#include <tlog.h>
#include "clusterconfig.h"
#include "mylock.h"
#include "xce/cluster.h"
/* Forward declaration — avoids circular include with cluster_def.h */
@ -50,6 +51,16 @@ typedef struct {
uint32_t resmgr_inst_delta; /* --resmgr-inst-delta CLI value; 0 = use hardcoded default */
uint32_t xstrings_nhash; /* --xstrings-nhash CLI value; 0 = use hardcoded default */
uint32_t xstrings_delta; /* --xstrings-delta CLI value; 0 = use hardcoded default */
/* bug-1476: serializes load_primary_config()'s free-decode-publish
* sequence against concurrent invocations for the SAME myconf_t (e.g.
* two racing handle_repl_config_push deliveries dispatched onto separate
* VTASK_LIVE_BLOCK workers for the same standby -- a live ASan
* heap-use-after-free was caught this way). Must be mylock_init()'d
* before first use (main.c) and mylock_fini()'d in myconf_fini(); test
* fixtures that drive the real load_primary_config()/
* config_activate_committed() must init it too (see
* t43_attach_myconf/t43_free_myconf in test_config_repl.c). */
mylock_t lock;
} myconf_t;
extern cluster_config_t* get_default_conf(void*);