• Yanqi Lv's avatar
    Fix dict use-after-free problem in kvs->rehashing (#13154) · e64d91c3
    Yanqi Lv authored
    
    
    In ASAN CI, we find server may crash because of NULL ptr in `kvstoreIncrementallyRehash`.
    the reason is that we use two phase unlink in `dbGenericDelete`. After `kvstoreDictTwoPhaseUnlinkFind`,
    the dict may be in rehashing and only have one element in ht[0] of `db->keys`.
    
    When we delete the last element in `db->keys` meanwhile `db->keys` is in rehashing, we may free the
    dict in `kvstoreDictTwoPhaseUnlinkFree` without deleting the node in `kvs->rehashing`. Then we may
    use this freed ptr in `kvstoreIncrementallyRehash` in the `serverCron` and cause the crash.
    This is indeed a use-after-free problem.
    
    The fix is to call rehashingCompleted in dictRelease and dictEmpty, so that every call for
    rehashingStarted is always matched with a rehashingCompleted.
    
    Adding a test in the unit test to catch it consistently
    
    ---------
    Co-authored-by: default avatarOran Agra <oran@redislabs.com>
    Co-authored-by: default avatardebing.sun <debing.sun@redis.com>
    e64d91c3
dict.c 72.8 KB