RockteMQ-AI commented on issue #10613:
URL: https://github.com/apache/rocketmq/issues/10613#issuecomment-4955781129

   **Issue Evaluation**
   
   Category: `type/bug` | Status: **Confirmed**
   
   The reported issue has been verified against the current codebase. Both 
problems are confirmed.
   
   **Problem (a): Premature `onSuccess(null)` on send success — CONFIRMED**
   
   In `DefaultMQProducerImpl.java:1665-1666`, the `request(Message, 
RequestCallback, long)` overload calls 
`requestResponseFuture.executeRequestCallback()` inside 
`SendCallback.onSuccess`, before any reply has arrived. At that point 
`responseMsg` is still `null`, so the user callback fires with 
`onSuccess(null)`. The other two async overloads (`request(msg, selector, arg, 
callback, timeout)` at line 1723 and `request(msg, mq, callback, timeout)` at 
line 1793) correctly only set `sendRequestOk=true` without invoking the 
callback — this overload is inconsistent.
   
   **Problem (b): Reply-vs-timeout race → double callback — CONFIRMED**
   
   `RequestResponseFuture.executeRequestCallback()` (line 41-49) has no 
single-shot guard (no AtomicBoolean, no CAS, no synchronized block). The three 
invocation paths (`SendCallback.onSuccess`, 
`ClientRemotingProcessor.processReplyMessage`, 
`RequestFutureHolder.scanExpiredRequest`) are not coordinated atomically:
   - `processReplyMessage` (line 280-287) does a non-atomic `get` + `remove` on 
the ConcurrentHashMap
   - `scanExpiredRequest` (line 57-67) can interleave within that window via 
`iterator.remove()`
   - Result: both reply and timeout paths can invoke the callback for the same 
request
   
   **Root Cause:** Missing single-shot guard in `executeRequestCallback()` + 
non-atomic get+remove in reply processing + inconsistent callback invocation 
across overloads.
   
   **Impact:** `DefaultMQProducerImpl` async request-reply API
   **Severity:** HIGH — Problem (a) is deterministic (every successful send 
fires `onSuccess(null)`); Problem (b) is a realistic TOCTOU race under load.
   
   An automated fix proposal will be generated. Reply `/approve` to proceed 
with PR generation, `/revise` to request changes to the approach, or `/reject` 
to decline.
   
   ---
   *Automated evaluation by github-manager-bot*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to