[
https://issues.apache.org/jira/browse/CASSANDRA-21714?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yifan Cai updated CASSANDRA-21714:
----------------------------------
Test and Documentation Plan: unit
Status: Patch Available (was: Open)
> Fix Use-After-Free in Zstd Dictionary Compressor When Cache Eviction Races
> In-Flight Compression
> ------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21714
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21714
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Local/SSTable
> Reporter: Yifan Cai
> Assignee: Yifan Cai
> Priority: Normal
>
> ZstdDictionaryCompressor's compress/uncompress calls relied on a
> compressor-lifetime dictionary reference rather than holding one for the
> duration of each native call. When Caffeine evicts the compressor from its
> cache, the eviction listener releases that reference synchronously, and if it
> was the dictionary's last reference, the dictionary's native compression
> tables are closed while a borrowed context is still in use, causing a
> use-after-free. This change has each compress/uncompress call take its own
> reference for the duration of the native call, so eviction cannot tidy the
> dictionary out from under an in-flight call. Includes a concurrency test that
> races cache eviction against compress/uncompress calls to reproduce the
> failure without the fix.
> Scott raised the issue at https://github.com/cscotta/cassandra/issues/18
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
