[Fix](func) Keep multi-match regex cache owner alive by linrrzqqq · Pull Request #66909 · apache/doris

linrrzqqq · 2026-08-18T16:44:59Z

What problem does this PR solve?

Problem Summary:

multi_match_any compiles each pattern array and stores the result in a process-wide, direct-mapped cache.

The previous implementation retained the cache entry's shared_ptr only while preparing the regex database and scratch space. The subsequent scan used a rawRegexps*. If another concurrent request inserted a different pattern array into the same cache bucket, the old cache entry could be replaced and destroyed while it was still being scanned, resulting in a use-after-free.

This change keeps the cache entry's shared_ptr alive for the entire hs_scan operation. Cache eviction can still replace the global entry, but the compiled database is not destroyed until all active scans have completed.

Release note

Fix a potential use-after-free in multi_match_any when concurrent pattern arrays collide in the compiled-regex cache.

hello-stephen · 2026-08-18T16:45:04Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

linrrzqqq · 2026-08-19T01:56:31Z

run buildall

HappenLee · 2026-08-19T04:21:32Z

+ static Status prepare_regexps_and_scratch(
+ const std::vector<StringRef>& needles,
+ multiregexps::DeferredConstructedRegexpsPtr& deferred_constructed_regexps,
+ multiregexps::Regexps*& regexps, multiregexps::ScratchPtr& smart_scratch) {


do not keep raw pointer

HappenLee

LGTM

github-actions · 2026-08-19T06:18:03Z

PR approved by at least one committer and no changes requested.

github-actions · 2026-08-19T06:18:06Z

PR approved by anyone and no changes requested.

HappenLee · 2026-08-19T07:13:03Z

run buildall

linrrzqqq · 2026-08-20T01:51:16Z

run buildall

### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: The multi-string search unit test included the production .cpp file directly. This violates build hygiene and can cause duplicate strong symbols in unity builds. Move the testable implementation template into a header shared by production code and the unit test. ### Release note None ### Check List (For Author) - Test: Unit Test - ./run-be-ut.sh --run --filter=FunctionsMultiStringSearchTest.* -j50 --coverage - ./build.sh --be - build-support/check-format.sh - build-support/run-clang-tidy.sh for the modified production and test translation units - Behavior changed: No - Does this need documentation: No

linrrzqqq · 2026-08-20T06:09:38Z

run buildall

hello-stephen · 2026-08-20T07:44:32Z

TPC-H: Total hot run time: 17476 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 2af2d869ff33f51ed9c763e09fd9c32a9b2cc6e4, data reload: false
------ Round 1 ----------------------------------
============================================
q1	17590	3119	3102	3102
q2	1879	234	152	152
q3	10479	908	535	535
q4	4666	243	204	204
q5	7682	594	387	387
q6	132	118	94	94
q7	531	507	390	390
q8	9247	890	974	890
q9	3468	2443	2395	2395
q10	6501	849	710	710
q11	437	272	240	240
q12	688	386	327	327
q13	17868	1551	1170	1170
q14	156	150	137	137
q15	q16	438	398	368	368
q17	838	826	791	791
q18	3141	2264	2285	2264
q19	1110	913	790	790
q20	672	532	466	466
q21	5302	1836	1940	1836
q22	334	267	228	228
Total cold run time: 93159 ms
Total hot run time: 17476 ms
----- Round 2, with runtime_filter_mode=off -----
============================================
q1	3468	3396	3403	3396
q2	213	215	156	156
q3	2335	2404	2259	2259
q4	1199	1171	907	907
q5	2212	2114	2117	2114
q6	175	124	90	90
q7	1054	944	865	865
q8	1632	1446	1434	1434
q9	3128	3120	3108	3108
q10	1876	1789	1628	1628
q11	359	279	255	255
q12	449	424	343	343
q13	1483	1551	1153	1153
q14	169	169	175	169
q15	q16	390	394	365	365
q17	1072	1039	1049	1039
q18	4985	4397	4758	4397
q19	876	862	861	861
q20	957	941	820	820
q21	3866	3074	3264	3074
q22	404	352	338	338
Total cold run time: 32302 ms
Total hot run time: 28771 ms

hello-stephen · 2026-08-20T07:51:03Z

TPC-DS: Total hot run time: 83383 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 2af2d869ff33f51ed9c763e09fd9c32a9b2cc6e4, data reload: false
query5	4260	418	337	337
query6	413	169	165	165
query7	4855	460	258	258
query8	294	126	114	114
query9	8664	2912	2910	2910
query10	399	255	218	218
query11	5365	1046	939	939
query12	125	73	71	71
query13	1207	464	313	313
query14	6066	2217	2112	2112
query14_1	1988	1992	1978	1978
query15	172	124	114	114
query16	917	379	366	366
query17	804	455	389	389
query18	2339	342	242	242
query19	169	149	112	112
query20	72	70	73	70
query21	216	116	104	104
query22	5429	5411	5400	5400
query23	6700	6290	6031	6031
query23_1	5943	5981	6200	5981
query24	7318	1120	775	775
query24_1	791	825	780	780
query25	435	309	261	261
query26	1250	262	176	176
query27	2710	457	290	290
query28	4619	1515	1508	1508
query29	950	445	361	361
query30	271	181	154	154
query31	848	424	361	361
query32	104	50	48	48
query33	473	226	196	196
query34	1007	858	484	484
query35	394	410	352	352
query36	560	557	518	518
query37	128	86	73	73
query38	1004	860	806	806
query39	476	497	487	487
query39_1	493	478	476	476
query40	220	124	109	109
query41	59	57	68	57
query42	86	82	81	81
query43	248	240	220	220
query44	1025	551	563	551
query45	116	111	113	111
query46	784	831	532	532
query47	773	761	728	728
query48	318	339	232	232
query49	543	264	192	192
query50	797	326	260	260
query51	7971	8011	8019	8011
query52	84	74	68	68
query53	206	214	177	177
query54	279	180	173	173
query55	76	64	57	57
query56	243	229	240	229
query57	698	676	664	664
query58	229	215	181	181
query59	1214	1233	1098	1098
query60	252	207	183	183
query61	108	116	119	116
query62	364	200	196	196
query63	201	153	159	153
query64	2831	710	596	596
query65	1589	1649	1578	1578
query66	1949	327	244	244
query67	9844	9798	9587	9587
query68	2792	1234	768	768
query69	339	241	200	200
query70	664	618	610	610
query71	297	255	257	255
query72	2229	1722	1343	1343
query73	648	614	352	352
query74	1571	1240	1143	1143
query75	1229	1153	1004	1004
query76	2296	752	552	552
query77	252	258	212	212
query78	3899	3684	3241	3241
query79	2447	815	577	577
query80	1602	403	341	341
query81	486	204	181	181
query82	621	133	102	102
query83	322	256	227	227
query84	311	123	105	105
query85	846	429	366	366
query86	394	168	163	163
query87	989	974	902	902
query88	2797	2154	2140	2140
query89	309	228	202	202
query90	1968	152	146	146
query91	157	142	123	123
query92	51	48	47	47
query93	1519	1157	850	850
query94	645	260	233	233
query95	619	451	337	337
query96	849	609	279	279
query97	1057	1064	1019	1019
query98	162	137	133	133
query99	416	358	309	309
Total cold run time: 177534 ms
Total hot run time: 83383 ms

hello-stephen · 2026-08-20T07:55:25Z

ClickBench: Total hot run time: 14.57 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit 2af2d869ff33f51ed9c763e09fd9c32a9b2cc6e4, data reload: false
query1	0.01	0.00	0.00
query2	0.08	0.04	0.04
query3	0.24	0.11	0.11
query4	1.60	0.10	0.10
query5	0.16	0.16	0.15
query6	1.27	0.72	0.68
query7	0.03	0.00	0.00
query8	0.05	0.03	0.03
query9	0.29	0.21	0.21
query10	0.33	0.34	0.34
query11	0.17	0.12	0.11
query12	0.15	0.12	0.12
query13	0.31	0.31	0.30
query14	0.45	0.46	0.44
query15	0.36	0.36	0.35
query16	0.23	0.20	0.22
query17	0.70	0.70	0.69
query18	0.18	0.17	0.17
query19	1.22	1.19	1.08
query20	0.02	0.01	0.01
query21	15.45	0.14	0.11
query22	5.09	0.05	0.04
query23	16.19	0.25	0.10
query24	3.00	0.34	0.24
query25	0.10	0.04	0.04
query26	0.77	0.17	0.13
query27	0.03	0.03	0.04
query28	3.60	0.56	0.26
query29	12.50	3.14	2.59
query30	0.26	0.12	0.11
query31	2.76	0.38	0.17
query32	3.57	0.31	0.24
query33	1.47	1.41	1.46
query34	15.39	2.15	1.76
query35	1.73	1.76	1.69
query36	0.45	0.28	0.29
query37	0.06	0.04	0.04
query38	0.04	0.03	0.03
query39	0.03	0.03	0.03
query40	0.12	0.08	0.07
query41	0.07	0.02	0.02
query42	0.03	0.02	0.02
query43	0.03	0.03	0.03
Total cold run time: 90.59 s
Total hot run time: 14.57 s

HappenLee

LGTM

github-actions · 2026-08-21T03:23:43Z

PR approved by at least one committer and no changes requested.

) (#67025) pick: #66909

[Fix](func) Keep multi-match regex cache owner alive
6fadcba

linrrzqqq added the dev/4.1.x label Aug 18, 2026

HappenLee reviewed Aug 19, 2026
View reviewed changes

fix: remove raw regexps pointer
cd09c06

linrrzqqq force-pushed the fix-multi-match-any-UAF branch from 68dc839 to cd09c06Compare August 19, 2026 05:14

HappenLee previously approved these changes Aug 19, 2026
View reviewed changes

github-actionsBot added approved Indicates a PR has been approved by one committer. reviewed labels Aug 19, 2026

linrrzqqq dismissed HappenLee’s stale review via 2af2d86August 20, 2026 03:01

github-actionsBot removed the approved Indicates a PR has been approved by one committer. label Aug 20, 2026

HappenLee approved these changes Aug 21, 2026
View reviewed changes

jacktengg approved these changes Aug 21, 2026
View reviewed changes

jacktengg merged commit f45b322 into apache:masterAug 21, 2026
32 of 34 checks passed

linrrzqqq deleted the fix-multi-match-any-UAF branch August 21, 2026 03:19

github-actionsBot added approved Indicates a PR has been approved by one committer. dev/4.1.x-conflict labels Aug 21, 2026

linrrzqqq mentioned this pull request Aug 21, 2026
branch-4.1: [Fix](func) Keep multi-match regex cache owner alive (#66909) #67025
Merged

yiguolei pushed a commit that referenced this pull request Aug 24, 2026
branch-4.1: [Fix](func) Keep multi-match regex cache owner alive (#66909
383cf33
) (#67025) pick: #66909

yiguolei added dev/4.1.4-merged and removed dev/4.1.x dev/4.1.x-conflict labels Aug 24, 2026

yiguolei mentioned this pull request Sep 1, 2026
4.1.4 Release Note #67355
Open

Uh oh!

Conversation

linrrzqqq commented Aug 18, 2026

What problem does this PR solve?

Release note

Uh oh!

hello-stephen commented Aug 18, 2026

Uh oh!

linrrzqqq commented Aug 19, 2026

Uh oh!

HappenLeeAug 19, 2026

Choose a reason for hiding this comment

Uh oh!

HappenLee left a comment

Choose a reason for hiding this comment

Uh oh!

github-actionsBot commented Aug 19, 2026

Uh oh!

github-actionsBot commented Aug 19, 2026

Uh oh!

HappenLee commented Aug 19, 2026

Uh oh!

linrrzqqq commented Aug 20, 2026

Uh oh!

linrrzqqq commented Aug 20, 2026

Uh oh!

hello-stephen commented Aug 20, 2026

Uh oh!

hello-stephen commented Aug 20, 2026

Uh oh!

hello-stephen commented Aug 20, 2026

Uh oh!

HappenLee left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actionsBot commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants