Skip to content
Snippets Groups Projects
  • Vladimir Davydov's avatar
    1c4605bb
    vinyl: fix use-after-free of LSM tree in scheduler · 1c4605bb
    Vladimir Davydov authored
    Between picking an LSM tree from a heap and taking a reference to it in
    vy_task_new() there are a few places where the scheduler may yield:
     - in vy_worker_pool_get() to start a worker pool;
     - in vy_task_dump_new() to wait for a memory tree to be unpinned;
     - in vy_task_compaction_new() to commit an entry to the metadata log
       after splitting or coalescing a range.
    
    If a concurrent fiber drops and deletes the LSM tree in the meanwhile,
    the scheduler will crash. To avoid that, let's take a reference to
    the LSM tree.
    
    It's quite difficult to write a functional test for it without a bunch
    of ugly error injections so we rely on fuzzing tests.
    
    Closes #9995
    
    NO_DOC=bug fix
    NO_TEST=fuzzing
    1c4605bb
    History
    vinyl: fix use-after-free of LSM tree in scheduler
    Vladimir Davydov authored
    Between picking an LSM tree from a heap and taking a reference to it in
    vy_task_new() there are a few places where the scheduler may yield:
     - in vy_worker_pool_get() to start a worker pool;
     - in vy_task_dump_new() to wait for a memory tree to be unpinned;
     - in vy_task_compaction_new() to commit an entry to the metadata log
       after splitting or coalescing a range.
    
    If a concurrent fiber drops and deletes the LSM tree in the meanwhile,
    the scheduler will crash. To avoid that, let's take a reference to
    the LSM tree.
    
    It's quite difficult to write a functional test for it without a bunch
    of ugly error injections so we rely on fuzzing tests.
    
    Closes #9995
    
    NO_DOC=bug fix
    NO_TEST=fuzzing