Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-43028

memOverheadChangedCallback heap-use-after-free during ~VBucket

    XMLWordPrintable

    Details

    • Triage:
      Triaged
    • Story Points:
      1
    • Is this a Regression?:
      Yes

      Description

      The memOverheadChangedCallback accesses the VBucket state.
      During VBucket destruction the callback is triggered when destroying the CheckpointManager as this in turn destroys Checkpoint s, reducing overhead. The state is no longer valid at this point.

      First seen in CV from merging patches introducing the memOverheadChangedCallback forward to master. Not previously identified on mad-hatter, possibly as a result of mad-hatter CV using an older clang.

      http://cv.jenkins.couchbase.com/job/kv_engine.threadsanitizer/job/master/7760/consoleFull#-130641249961882284-c5b1-40af-8076-4f8cb2d12fb1

        Attachments

          Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            Activity

            james.harrison James Harrison created issue -
            james.harrison James Harrison made changes -
            Field Original Value New Value
            Link This issue relates to MB-42986 [ MB-42986 ]
            james.harrison James Harrison made changes -
            Description The {{memOverheadChangedCallback}} accesses the VBucket state.
            During VBucket destruction the callback is triggered when destroying the {{CheckpointManager}} as this in turn destroys {{Checkpoint}}s, reducing overhead. The state is no longer valid at this point.

            First seen in CV from merging patches introducing the {{memOverheadChangedCallback}} forward to master. Not previously identified on mad-hatter, possibly as a result of mad-hatter CV using an older clang.

            http://cv.jenkins.couchbase.com/job/kv_engine.threadsanitizer/job/master/7760/consoleFull#-130641249961882284-c5b1-40af-8076-4f8cb2d12fb1
            The {{memOverheadChangedCallback}} accesses the VBucket state.
            During VBucket destruction the callback is triggered when destroying the {{CheckpointManager}} as this in turn destroys {{Checkpoint}} s, reducing overhead. The state is no longer valid at this point.

            First seen in CV from merging patches introducing the {{memOverheadChangedCallback}} forward to master. Not previously identified on mad-hatter, possibly as a result of mad-hatter CV using an older clang.

            http://cv.jenkins.couchbase.com/job/kv_engine.threadsanitizer/job/master/7760/consoleFull#-130641249961882284-c5b1-40af-8076-4f8cb2d12fb1
            owend Daniel Owen made changes -
            Priority Major [ 3 ] Blocker [ 1 ]
            owend Daniel Owen made changes -
            Fix Version/s 6.6.2 [ 17103 ]
            Fix Version/s 6.6.1 [ 17002 ]
            owend Daniel Owen made changes -
            Component/s couchbase-bucket [ 10173 ]
            owend Daniel Owen made changes -
            Labels approved-for-6.6.1
            owend Daniel Owen made changes -
            Is this a Regression? Unknown [ 10452 ] Yes [ 10450 ]
            owend Daniel Owen made changes -
            Link This issue relates to MB-40528 [ MB-40528 ]
            owend Daniel Owen made changes -
            Link This issue relates to MB-40528 [ MB-40528 ]
            owend Daniel Owen made changes -
            Link This issue blocks MB-40528 [ MB-40528 ]
            drigby Dave Rigby made changes -
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Resolved [ 5 ]
            owend Daniel Owen made changes -
            Assignee James Harrison [ james.harrison ] Daniel Owen [ owend ]
            Status Resolved [ 5 ] Closed [ 6 ]
            wayne Wayne Siu made changes -
            Fix Version/s Cheshire-Cat [ 15915 ]
            lynn.straus Lynn Straus made changes -
            Fix Version/s 7.0.0 [ 17233 ]
            lynn.straus Lynn Straus made changes -
            Fix Version/s Cheshire-Cat [ 15915 ]

              People

              Assignee:
              owend Daniel Owen
              Reporter:
              james.harrison James Harrison
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  PagerDuty