From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Vladimir Davydov Subject: [PATCH] memtx: cancel checkpoint thread at exit Date: Thu, 18 Apr 2019 18:46:54 +0300 Message-Id: <8278bbd0a73bbd0e18a4e8633eb0ad71f2ffa3f7.1555601315.git.vdavydov.dev@gmail.com> To: tarantool-patches@freelists.org List-ID: If a tarantool instance exits while checkpointing is in progress, the memtx checkpoint thread, which writes the snap file, can access already freed data resulting in a crash. Let's fix this the same way we did for relay and vinyl threads - simply cancel the thread forcefully and wait for it to terminate. Closes #4170 --- https://github.com/tarantool/tarantool/issues/4170 https://github.com/tarantool/tarantool/commits/dv/gh-4170-memtx-cancel-checkpoint-thread-at-exit src/box/memtx_engine.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/src/box/memtx_engine.c b/src/box/memtx_engine.c index 48f700a0..2b9bef24 100644 --- a/src/box/memtx_engine.c +++ b/src/box/memtx_engine.c @@ -52,6 +52,9 @@ /* sync snapshot every 16MB */ #define SNAP_SYNC_INTERVAL (1 << 24) +static void +checkpoint_cancel(struct checkpoint *ckpt); + /* * Memtx yield-in-transaction trigger: roll back the effects * of the transaction and mark the transaction as aborted. @@ -179,6 +182,8 @@ static void memtx_engine_shutdown(struct engine *engine) { struct memtx_engine *memtx = (struct memtx_engine *)engine; + if (memtx->checkpoint != NULL) + checkpoint_cancel(memtx->checkpoint); mempool_destroy(&memtx->iterator_pool); if (mempool_is_initialized(&memtx->rtree_iterator_pool)) mempool_destroy(&memtx->rtree_iterator_pool); @@ -590,6 +595,11 @@ checkpoint_new(const char *snap_dirname, uint64_t snap_io_rate_limit) xdir_create(&ckpt->dir, snap_dirname, SNAP, &INSTANCE_UUID, &opts); vclock_create(&ckpt->vclock); ckpt->touch = false; + /* + * Reset the checkpoint thread id so that checkpoint_cancel() + * doesn't attempt to cancel the thread if it isn't running. + */ + ckpt->cord.id = 0; return ckpt; } @@ -605,6 +615,19 @@ checkpoint_delete(struct checkpoint *ckpt) free(ckpt); } +static void +checkpoint_cancel(struct checkpoint *ckpt) +{ + /* + * Cancel the checkpoint thread if it's running and wait + * for it to terminate so as to eliminate the possibility + * of use-after-free. + */ + if (ckpt->cord.id != 0 && + tt_pthread_cancel(ckpt->cord.id) != ESRCH) + tt_pthread_join(ckpt->cord.id, NULL); + checkpoint_delete(ckpt); +} static int checkpoint_add_space(struct space *sp, void *data) -- 2.11.0