Unverified Commit e64d91c3 authored by Yanqi Lv's avatar Yanqi Lv Committed by GitHub
Browse files

Fix dict use-after-free problem in kvs->rehashing (#13154)



In ASAN CI, we find server may crash because of NULL ptr in `kvstoreIncrementallyRehash`.
the reason is that we use two phase unlink in `dbGenericDelete`. After `kvstoreDictTwoPhaseUnlinkFind`,
the dict may be in rehashing and only have one element in ht[0] of `db->keys`.

When we delete the last element in `db->keys` meanwhile `db->keys` is in rehashing, we may free the
dict in `kvstoreDictTwoPhaseUnlinkFree` without deleting the node in `kvs->rehashing`. Then we may
use this freed ptr in `kvstoreIncrementallyRehash` in the `serverCron` and cause the crash.
This is indeed a use-after-free problem.

The fix is to call rehashingCompleted in dictRelease and dictEmpty, so that every call for
rehashingStarted is always matched with a rehashingCompleted.

Adding a test in the unit test to catch it consistently

---------
Co-authored-by: default avatarOran Agra <oran@redislabs.com>
Co-authored-by: default avatardebing.sun <debing.sun@redis.com>
parent bad33f87
......@@ -706,6 +706,10 @@ int _dictClear(dict *d, int htidx, void(callback)(dict*)) {
/* Clear & Release the hash table */
void dictRelease(dict *d)
{
/* Someone may be monitoring a dict that started rehashing, before
* destroying the dict fake completion. */
if (dictIsRehashing(d) && d->type->rehashingCompleted)
d->type->rehashingCompleted(d);
_dictClear(d,0,NULL);
_dictClear(d,1,NULL);
zfree(d);
......@@ -1588,6 +1592,10 @@ void *dictFindPositionForInsert(dict *d, const void *key, dictEntry **existing)
}
void dictEmpty(dict *d, void(callback)(dict*)) {
/* Someone may be monitoring a dict that started rehashing, before
* destroying the dict fake completion. */
if (dictIsRehashing(d) && d->type->rehashingCompleted)
d->type->rehashingCompleted(d);
_dictClear(d,0,callback);
_dictClear(d,1,callback);
d->rehashidx = -1;
......
......@@ -957,6 +957,9 @@ int kvstoreTest(int argc, char **argv, int flags) {
}
kvstoreIteratorRelease(kvs_it);
/* Make sure the dict was removed from the rehashing list. */
while (kvstoreIncrementallyRehash(kvs2, 1000)) {}
dict *d = kvstoreGetDict(kvs2, didx);
assert(d == NULL);
assert(kvstoreDictSize(kvs2, didx) == 0);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment