Copilot commented on code in PR #3595:
URL: https://github.com/apache/brpc/pull/3595#discussion_r4237946273
##########
src/brpc/socket.cpp:
##########
@@ -722,6 +722,10 @@ int Socket::Create(const SocketOptions& options, SocketId*
id) {
int Socket::OnCreated(const SocketOptions& options) {
if (_io_event.Init((void*)id()) != 0) {
LOG(ERROR) << "Fail to init IOEvent";
+ // This is the only failure point before _user is attached below; set
it
+ // now so the synchronous recycle runs SocketUser::BeforeRecycle and
the
+ // user is cleaned up instead of leaking.
+ _user = options.user;
SetFailed(ENOMEM, "%s", "Fail to init IOEvent");
return -1;
Review Comment:
`Socket::Create` invokes `OnCreated` and, when it returns nonzero, calls
`SetFailed()` again (`versioned_ref_with_id.h:421-426`). Calling `SetFailed`
here can release the only reference and recycle this socket before `Create`
regains control; its subsequent `SetFailed` may then operate on a
recycled/reused slot. Attach `_user` here, but return `-1` and let `Create`
perform the single failure transition so `BeforeRecycle` still cleans up the
sub-channel safely.
This issue also appears in the following locations of the same file:
- line 728
- line 728
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
