[BugFix] Fix the mem_tracker use-after-free of UDF #41710

trueeyu · 2024-02-27T02:31:46Z

Why I'm doing:

*** Aborted at 1686120661 (unix time) try "date -d @1686120661" if you are using GNU date ***
PC: @          0x2ce0b61 starrocks::MemTracker::consume()
*** SIGSEGV (@0x0) received by PID 117789 (TID 0x7f9cd0728700) from PID 0; stack trace: ***
    @          0x58f9dc2 google::(anonymous namespace)::FailureSignalHandler()
    @     0x7f9d147ae362 (unknown)
    @     0x7f9d147b28b9 JVM_handle_linux_signal
    @     0x7f9d147a5f78 (unknown)
    @     0x7f9d13ce1390 (unknown)
    @          0x2ce0b61 starrocks::MemTracker::consume()
    @          0x486d328 _ZNSt17_Function_handlerIFvvEZN9starrocks24call_function_in_pthreadEPNS1_12RuntimeStateERKSt8functionIFNS1_6StatusEvEEEUlvE_E9_M_invokeERKSt9_Any_data
    @          0x475fbe0 starrocks::PriorityThreadPool::work_thread()
    @          0x58b97e7 thread_proxy
    @     0x7f9d13cd76ba start_thread
    @     0x7f9d132f841d clone
    @                0x0 (unknown)

After promise->set_value, if runtime state of query is first destructed, then release the memory, the mem_tracker has already been free, so it will be crash here.

What I'm doing:

Release the mem first, and then set promise value.

What type of PR is this:

Does this PR entail a change in behavior?

Yes, this PR will result in a change in behavior.
No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

Interface/UI changes: syntax, type conversion, expression evaluation, display information
Parameter changes: default values, similar parameters but with different default values
Policy changes: use new policy to replace old one, functionality automatically enabled
Feature removed
Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

I have added test cases for my bug fix or my new feature
This pr needs user documentation (for new or modified features or behaviors)
- I have added documentation for my new feature or new function
This is a backport pr

Bugfix cherry-pick branch check:

Signed-off-by: trueeyu <lxhhust350@qq.com>

github-actions · 2024-02-27T04:06:54Z

[FE Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

github-actions · 2024-02-27T04:15:34Z

[BE Incremental Coverage Report]

❌ fail : 0 / 7 (00.00%)

file detail

	path	covered_line	new_line	coverage	not_covered_line_detail
🔵	be/src/udf/java/utils.cpp	0	7	00.00%	[35, 36, 37, 38, 39, 40, 42]

github-actions · 2024-02-27T05:30:09Z

@Mergifyio backport branch-3.2

github-actions · 2024-02-27T05:30:10Z

@Mergifyio backport branch-3.1

github-actions · 2024-02-27T05:30:12Z

@Mergifyio backport branch-3.0

github-actions · 2024-02-27T05:30:13Z

@Mergifyio backport branch-2.5

mergify · 2024-02-27T05:30:36Z

backport branch-3.2

✅ Backports have been created

#41724 [BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) has been created for branch branch-3.2

mergify · 2024-02-27T05:30:38Z

backport branch-3.1

✅ Backports have been created

#41725 [BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) has been created for branch branch-3.1

mergify · 2024-02-27T05:30:40Z

backport branch-3.0

✅ Backports have been created

#41726 [BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) has been created for branch branch-3.0

mergify · 2024-02-27T05:30:43Z

backport branch-2.5

✅ Backports have been created

#41727 [BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) has been created for branch branch-2.5

@0x0

## Why I'm doing: ``` *** Aborted at 1686120661 (unix time) try "date -d @1686120661" if you are using GNU date *** PC: @ 0x2ce0b61 starrocks::MemTracker::consume() *** SIGSEGV (@0x0) received by PID 117789 (TID 0x7f9cd0728700) from PID 0; stack trace: *** @ 0x58f9dc2 google::(anonymous namespace)::FailureSignalHandler() @ 0x7f9d147ae362 (unknown) @ 0x7f9d147b28b9 JVM_handle_linux_signal @ 0x7f9d147a5f78 (unknown) @ 0x7f9d13ce1390 (unknown) @ 0x2ce0b61 starrocks::MemTracker::consume() @ 0x486d328 _ZNSt17_Function_handlerIFvvEZN9starrocks24call_function_in_pthreadEPNS1_12RuntimeStateERKSt8functionIFNS1_6StatusEvEEEUlvE_E9_M_invokeERKSt9_Any_data @ 0x475fbe0 starrocks::PriorityThreadPool::work_thread() @ 0x58b97e7 thread_proxy @ 0x7f9d13cd76ba start_thread @ 0x7f9d132f841d clone @ 0x0 (unknown) ``` After `promise->set_value`, if runtime state of query is first destructed, then release the memory, the mem_tracker has already been free, so it will be crash here. ## What I'm doing: Release the mem first, and then set promise value. Signed-off-by: trueeyu <lxhhust350@qq.com> (cherry picked from commit e36a684)

@0x0

## Why I'm doing: ``` *** Aborted at 1686120661 (unix time) try "date -d @1686120661" if you are using GNU date *** PC: @ 0x2ce0b61 starrocks::MemTracker::consume() *** SIGSEGV (@0x0) received by PID 117789 (TID 0x7f9cd0728700) from PID 0; stack trace: *** @ 0x58f9dc2 google::(anonymous namespace)::FailureSignalHandler() @ 0x7f9d147ae362 (unknown) @ 0x7f9d147b28b9 JVM_handle_linux_signal @ 0x7f9d147a5f78 (unknown) @ 0x7f9d13ce1390 (unknown) @ 0x2ce0b61 starrocks::MemTracker::consume() @ 0x486d328 _ZNSt17_Function_handlerIFvvEZN9starrocks24call_function_in_pthreadEPNS1_12RuntimeStateERKSt8functionIFNS1_6StatusEvEEEUlvE_E9_M_invokeERKSt9_Any_data @ 0x475fbe0 starrocks::PriorityThreadPool::work_thread() @ 0x58b97e7 thread_proxy @ 0x7f9d13cd76ba start_thread @ 0x7f9d132f841d clone @ 0x0 (unknown) ``` After `promise->set_value`, if runtime state of query is first destructed, then release the memory, the mem_tracker has already been free, so it will be crash here. ## What I'm doing: Release the mem first, and then set promise value. Signed-off-by: trueeyu <lxhhust350@qq.com> (cherry picked from commit e36a684)

@0x0

## Why I'm doing: ``` *** Aborted at 1686120661 (unix time) try "date -d @1686120661" if you are using GNU date *** PC: @ 0x2ce0b61 starrocks::MemTracker::consume() *** SIGSEGV (@0x0) received by PID 117789 (TID 0x7f9cd0728700) from PID 0; stack trace: *** @ 0x58f9dc2 google::(anonymous namespace)::FailureSignalHandler() @ 0x7f9d147ae362 (unknown) @ 0x7f9d147b28b9 JVM_handle_linux_signal @ 0x7f9d147a5f78 (unknown) @ 0x7f9d13ce1390 (unknown) @ 0x2ce0b61 starrocks::MemTracker::consume() @ 0x486d328 _ZNSt17_Function_handlerIFvvEZN9starrocks24call_function_in_pthreadEPNS1_12RuntimeStateERKSt8functionIFNS1_6StatusEvEEEUlvE_E9_M_invokeERKSt9_Any_data @ 0x475fbe0 starrocks::PriorityThreadPool::work_thread() @ 0x58b97e7 thread_proxy @ 0x7f9d13cd76ba start_thread @ 0x7f9d132f841d clone @ 0x0 (unknown) ``` After `promise->set_value`, if runtime state of query is first destructed, then release the memory, the mem_tracker has already been free, so it will be crash here. ## What I'm doing: Release the mem first, and then set promise value. Signed-off-by: trueeyu <lxhhust350@qq.com> (cherry picked from commit e36a684)

@0x0

## Why I'm doing: ``` *** Aborted at 1686120661 (unix time) try "date -d @1686120661" if you are using GNU date *** PC: @ 0x2ce0b61 starrocks::MemTracker::consume() *** SIGSEGV (@0x0) received by PID 117789 (TID 0x7f9cd0728700) from PID 0; stack trace: *** @ 0x58f9dc2 google::(anonymous namespace)::FailureSignalHandler() @ 0x7f9d147ae362 (unknown) @ 0x7f9d147b28b9 JVM_handle_linux_signal @ 0x7f9d147a5f78 (unknown) @ 0x7f9d13ce1390 (unknown) @ 0x2ce0b61 starrocks::MemTracker::consume() @ 0x486d328 _ZNSt17_Function_handlerIFvvEZN9starrocks24call_function_in_pthreadEPNS1_12RuntimeStateERKSt8functionIFNS1_6StatusEvEEEUlvE_E9_M_invokeERKSt9_Any_data @ 0x475fbe0 starrocks::PriorityThreadPool::work_thread() @ 0x58b97e7 thread_proxy @ 0x7f9d13cd76ba start_thread @ 0x7f9d132f841d clone @ 0x0 (unknown) ``` After `promise->set_value`, if runtime state of query is first destructed, then release the memory, the mem_tracker has already been free, so it will be crash here. ## What I'm doing: Release the mem first, and then set promise value. Signed-off-by: trueeyu <lxhhust350@qq.com> (cherry picked from commit e36a684)

…41724) Co-authored-by: trueeyu <lxhhust350@qq.com>

…41725) Co-authored-by: trueeyu <lxhhust350@qq.com>

…41726) Co-authored-by: trueeyu <lxhhust350@qq.com>

…41727) Co-authored-by: trueeyu <lxhhust350@qq.com>

Fix the mem_tracker use-after-free of UDF

164761b

Signed-off-by: trueeyu <lxhhust350@qq.com>

trueeyu marked this pull request as ready for review February 27, 2024 02:31

trueeyu requested a review from a team as a code owner February 27, 2024 02:31

github-actions bot added 3.2 3.1 3.0 2.5 labels Feb 27, 2024

mergify bot assigned trueeyu Feb 27, 2024

stdpain approved these changes Feb 27, 2024

View reviewed changes

mxdzs0612 approved these changes Feb 27, 2024

View reviewed changes

silverbullet233 approved these changes Feb 27, 2024

View reviewed changes

imay merged commit e36a684 into StarRocks:main Feb 27, 2024
53 of 54 checks passed

github-actions bot removed 3.2 3.1 labels Feb 27, 2024

github-actions bot removed 3.0 2.5 labels Feb 27, 2024

mergify bot mentioned this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) #41724

Merged

18 tasks

This was referenced Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) #41725

Merged

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) #41726

Merged

mergify bot mentioned this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) #41727

Merged

18 tasks

wanpengfei-git pushed a commit that referenced this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) (#…

0457053

…41724) Co-authored-by: trueeyu <lxhhust350@qq.com>

github-actions bot added the 3.2-merged label Feb 27, 2024

wanpengfei-git pushed a commit that referenced this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) (#…

8ccdcf8

…41725) Co-authored-by: trueeyu <lxhhust350@qq.com>

github-actions bot added the 3.1-merged label Feb 27, 2024

wanpengfei-git pushed a commit that referenced this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) (#…

b41332d

…41726) Co-authored-by: trueeyu <lxhhust350@qq.com>

github-actions bot added the 3.0-merged label Feb 27, 2024

wanpengfei-git pushed a commit that referenced this pull request Feb 27, 2024

[BugFix] Fix the mem_tracker use-after-free of UDF (backport #41710) (#…

41f0d7d

…41727) Co-authored-by: trueeyu <lxhhust350@qq.com>

github-actions bot added the 2.5-merged label Feb 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BugFix] Fix the mem_tracker use-after-free of UDF #41710

[BugFix] Fix the mem_tracker use-after-free of UDF #41710

trueeyu commented Feb 27, 2024 •

edited

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

[BugFix] Fix the mem_tracker use-after-free of UDF #41710

[BugFix] Fix the mem_tracker use-after-free of UDF #41710

Conversation

trueeyu commented Feb 27, 2024 • edited

Why I'm doing:

What I'm doing:

What type of PR is this:

Checklist:

Bugfix cherry-pick branch check:

github-actions bot commented Feb 27, 2024

[FE Incremental Coverage Report]

github-actions bot commented Feb 27, 2024

[BE Incremental Coverage Report]

file detail

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

github-actions bot commented Feb 27, 2024

mergify bot commented Feb 27, 2024 • edited

✅ Backports have been created

mergify bot commented Feb 27, 2024 • edited

✅ Backports have been created

mergify bot commented Feb 27, 2024 • edited

✅ Backports have been created

mergify bot commented Feb 27, 2024 • edited

✅ Backports have been created

trueeyu commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited

mergify bot commented Feb 27, 2024 •

edited