<HTML><BODY><p>Hi Ilya,<br><br>The patch LGTM, thanks.<br><br>          Alexander</p><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;">
        Вторник, 15 октября 2019, 18:50 +03:00 от Ilya Kosarev <i.kosarev@tarantool.org>:<br>
        <br>
        <div id="">






<div class="js-helper js-readmsg-msg">
        <style type="text/css"></style>
        <div>
                
                
            <div id="style_15711546230619211520_BODY">If a tarantool instance exits while joining replica is in progress,<br>
the replica joining thread can access already freed data resulting<br>
in a crash. Let's fix this the same way we did for checkpoint thread<br>
- simply cancel the thread forcefully and wait for it to terminate.<br>
<br>
Closes #4528<br>
---<br>
<a href="https://github.com/tarantool/tarantool/tree/i.kosarev/gh-4528-fix-shutdown-on-replica-join" target="_blank">https://github.com/tarantool/tarantool/tree/i.kosarev/gh-4528-fix-shutdown-on-replica-join</a><br>
<a href="https://github.com/tarantool/tarantool/issues/4528" target="_blank">https://github.com/tarantool/tarantool/issues/4528</a><br>
<br>
 src/box/memtx_engine.c | 25 ++++++++++++++++++++++++-<br>
 src/box/memtx_engine.h |  2 ++<br>
 2 files changed, 26 insertions(+), 1 deletion(-)<br>
<br>
diff --git a/src/box/memtx_engine.c b/src/box/memtx_engine.c<br>
index eb11346c1..325129a6e 100644<br>
--- a/src/box/memtx_engine.c<br>
+++ b/src/box/memtx_engine.c<br>
@@ -55,6 +55,9 @@<br>
 static void<br>
 checkpoint_cancel(struct checkpoint *ckpt);<br>
 <br>
+static void<br>
+replica_join_cancel(struct cord *replica_join_cord);<br>
+<br>
 struct PACKED memtx_tuple {<br>
   /*<br>
    * sic: the header of the tuple is used<br>
@@ -129,6 +132,8 @@ memtx_engine_shutdown(struct engine *engine)<br>
   struct memtx_engine *memtx = (struct memtx_engine *)engine;<br>
   if (memtx->checkpoint != NULL)<br>
           checkpoint_cancel(memtx->checkpoint);<br>
+       if (memtx->replica_join_cord != NULL)<br>
+               replica_join_cancel(memtx->replica_join_cord);<br>
   mempool_destroy(&memtx->iterator_pool);<br>
   if (mempool_is_initialized(&memtx->rtree_iterator_pool))<br>
           mempool_destroy(&memtx->rtree_iterator_pool);<br>
@@ -528,6 +533,18 @@ checkpoint_cancel(struct checkpoint *ckpt)<br>
   checkpoint_delete(ckpt);<br>
 }<br>
 <br>
+static void<br>
+replica_join_cancel(struct cord *replica_join_cord)<br>
+{<br>
+       /*<br>
+        * Cancel the thread being used to join replica if it's<br>
+        * running and wait for it to terminate so as to<br>
+        * eliminate the possibility of use-after-free.<br>
+        */<br>
+       tt_pthread_cancel(replica_join_cord->id);<br>
+       tt_pthread_join(replica_join_cord->id, NULL);<br>
+}<br>
+<br>
 static int<br>
 checkpoint_add_space(struct space *sp, void *data)<br>
 {<br>
@@ -848,7 +865,11 @@ memtx_engine_join(struct engine *engine, void *arg, struct xstream *stream)<br>
   struct cord cord;<br>
   if (cord_costart(&cord, "initial_join", memtx_join_f, ctx) != 0)<br>
           return -1;<br>
-       return cord_cojoin(&cord);<br>
+       struct memtx_engine *memtx = (struct memtx_engine *)engine;<br>
+       memtx->replica_join_cord = &cord;<br>
+       int res = cord_cojoin(&cord);<br>
+       memtx->replica_join_cord = NULL;<br>
+       return res;<br>
 }<br>
 <br>
 static void<br>
@@ -1030,6 +1051,8 @@ memtx_engine_new(const char *snap_dirname, bool force_recovery,<br>
   memtx->max_tuple_size = MAX_TUPLE_SIZE;<br>
   memtx->force_recovery = force_recovery;<br>
 <br>
+       memtx->replica_join_cord = NULL;<br>
+<br>
   memtx->base.vtab = &memtx_engine_vtab;<br>
   memtx->base.name = "memtx";<br>
 <br>
diff --git a/src/box/memtx_engine.h b/src/box/memtx_engine.h<br>
index c092f5d8e..43e16879d 100644<br>
--- a/src/box/memtx_engine.h<br>
+++ b/src/box/memtx_engine.h<br>
@@ -107,6 +107,8 @@ struct memtx_engine {<br>
   uint64_t snap_io_rate_limit;<br>
   /** Skip invalid snapshot records if this flag is set. */<br>
   bool force_recovery;<br>
+       /** cord being currently used to join replica **/<br>
+       struct cord *replica_join_cord;<br>
   /** Common quota for tuples and indexes. */<br>
   struct quota quota;<br>
   /**<br>
-- <br>
2.17.1<br>
<br>
<br>
</div>
            
        
                
        </div>

        
</div>


</div>
</blockquote>
<br>
<br>-- <br>Alexander Tikhonov<br></BODY></HTML>