darion-yaphet commented on PR #3590: URL: https://github.com/apache/brpc/pull/3590#issuecomment-6084505091
The init bthreads themselves are joined inside StartInternal(), and task_runner() calls return_keytable() before bumping the version, so they're done with the pool by the time we reach a failure path. But anything spawned from bthread_init_fn with the inherited attr carries can outlive the failed Start(). It still calls borrow_keytable()/return_keytable() on that pool. With delete _keytable_pool that's a heap-use-after-free. ASan confirms it. Fixed by doing what Join() does: call bthread_keytable_pool_destroy() but don't delete the struct. A destroyed pool makes late return_keytable() calls just delete their KeyTable, and the struct stays valid. The TLS data and reserved KeyTables are still released, which was the main leak. I also added failed_start_keeps_keytable_pool_for_init_bthreads, which spawns such a child from bthread_init_fn and fails Start() with EADDRINUSE. It fails under ASan with the old code and passes now. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
