Skip to content

Commit 0ca0d43

Browse files
Gabriel39zhiqiang-hhhh
authored andcommitted
[fix](schema scan) Fix invalid pointer access (apache#48313)
Schema scanner runs on a separate thread which is executed asynchronously. We should make sure all context used not be freed once it is scheduled. ERROR: AddressSanitizer: heap-buffer-overflow on address 0x613002f33eb2 at pc 0x55e085dccbe3 bp 0x7f345c0e1f10 sp 0x7f345c0e1f08 READ of size 1 at 0x613002f33eb2 thread T2776 (FragmentMgrAsyn) #0 0x55e085dccbe2 in std::__atomic_base::load(std::memory_order) const /var/local/ldb-toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:481:9 #1 0x55e085dccbe2 in std::atomic::operator bool() const /var/local/ldb-toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/atomic:87:22 apache#2 0x55e085dccbe2 in doris::SchemaScanner::get_next_block_async(doris::RuntimeState*)::$_0::operator()() const /home/zcp/repo_center/doris_master/doris/be/src/exec/schema_scanner.cpp:118:5 apache#3 0x55e085dccbe2 in void std::__invoke_impl(std::__invoke_other, doris::SchemaScanner::get_next_block_async(doris::RuntimeState*)::$_0&) /var/local/ldb-toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 apache#4 0x55e085dccbe2 in std::enable_if, void>::type std::__invoke_r(doris::SchemaScanner::get_next_block_async(doris::RuntimeState*)::$_0&) /var/local/ldb-toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 apache#5 0x55e085dccbe2 in std::_Function_handler::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:291:9 apache#6 0x55e050f081ca in doris::ThreadPool::dispatch_thread() /home/zcp/repo_center/doris_master/doris/be/src/util/threadpool.cpp:608:24 apache#7 0x55e050ede467 in doris::Thread::supervise_thread(void*) /home/zcp/repo_center/doris_master/doris/be/src/util/thread.cpp:498:5 apache#8 0x7f376ef5aac2 in start_thread nptl/pthread_create.c:442:8 apache#9 0x7f376efec84f misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
1 parent 0f4a035 commit 0ca0d43

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

be/src/exec/schema_scanner.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,12 +117,12 @@ Status SchemaScanner::get_next_block_async(RuntimeState* state) {
117117
auto task_ctx = state->get_task_execution_context();
118118
RETURN_IF_ERROR(ExecEnv::GetInstance()->fragment_mgr()->get_thread_pool()->submit_func(
119119
[this, task_ctx, state]() {
120-
DCHECK(_async_thread_running == false);
121120
auto task_lock = task_ctx.lock();
122121
if (task_lock == nullptr) {
123122
_scanner_status.update(Status::InternalError("Task context not exists!"));
124123
return;
125124
}
125+
DCHECK(_async_thread_running == false);
126126
SCOPED_ATTACH_TASK(state);
127127
_async_thread_running = true;
128128
if (!_opened) {

0 commit comments

Comments
 (0)