Skip to content

branch-4.1: [fix](rpc) Fix AutoReleaseClosure data race with callback reuse (#61782) - #67340

Open
linrrzqqq wants to merge 1 commit into
apache:branch-4.1from
linrrzqqq:pick-61782-branch-4.1
Open

branch-4.1: [fix](rpc) Fix AutoReleaseClosure data race with callback reuse (#61782)#67340
linrrzqqq wants to merge 1 commit into
apache:branch-4.1from
linrrzqqq:pick-61782-branch-4.1

Conversation

@linrrzqqq

Copy link
Copy Markdown
Collaborator

pick: #61782

@hello-stephen

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@linrrzqqq

Copy link
Copy Markdown
CollaboratorAuthor

run buildall

…he#61782)
The callback's call() method may reuse the callback object (e.g., in
vdata_stream_sender.h get_send_callback()), triggering a new RPC that
mutates response_ and cntl_. If AutoReleaseClosure::Run() invokes call()
before checking cntl_->Failed() or response_->status(), it reads the NEW
RPC's state instead of the ORIGINAL RPC's result, causing:
```
*** SIGSEGV address not mapped to object (@0x0) received by PID 238162 (TID 240463 OR 0xfffa2c9898e0) from PID 0; stack trace: ***
0# doris::signal::(anonymous namespace)::FailureSignalHandler(int, siginfo_t*, void*) at /home/zcp/repo_center/doris_release/doris/be/src/common/signal_handler.h:421
1# os::Linux::chained_handler(int, siginfo_t*, void*) in /opt/module/doris/java8/jre/lib/aarch64/server/libjvm.so
2# JVM_handle_linux_signal in /opt/module/doris/java8/jre/lib/aarch64/server/libjvm.so
3# signalHandler(int, siginfo_t*, void*) in /opt/module/doris/java8/jre/lib/aarch64/server/libjvm.so
4# 0x0000FFFF0AB107C0 in linux-vdso.so.1
5# doris::Status doris::Status::create<true>(doris::PStatus const&) at /home/zcp/repo_center/doris_release/doris/be/src/common/status.h:398
6# void doris::AutoReleaseClosure<doris::PTransmitDataParams, doris::pipeline::ExchangeSendCallback<doris::PTransmitDataResult> >::_process_status<doris::PTransmitDataResult>(doris::PTransmitDataResult*) at /home/zcp/repo_center/doris_release/doris/be/src/util/ref_count_closure.h:128
7# doris::AutoReleaseClosure<doris::PTransmitDataParams, doris::pipeline::ExchangeSendCallback<doris::PTransmitDataResult> >::Run() at /home/zcp/repo_center/doris_release/doris/be/src/util/ref_count_closure.h:102
8# brpc::Controller::EndRPC(brpc::Controller::CompletionInfo const&) in /opt/module/doris/be/lib/doris_be
9# brpc::policy::ProcessRpcResponse(brpc::InputMessageBase*) in /opt/module/doris/be/lib/doris_be
10# brpc::ProcessInputMessage(void*) in /opt/module/doris/be/lib/doris_be
11# bthread::TaskGroup::task_runner(long) in /opt/module/doris/be/lib/doris_be
12# bthread_make_fcontext in /opt/module/doris/be/lib/doris_be
```
we have confirmed the data race is real existing with temporary LOGs
which has been removed:
```
F20260325 21:46:58.465230 3453395 brpc_closure.h:116] Check failed: _debug_generation_at_construction == current_gen (2 vs. 3) RACE DETECTED: AutoReleaseClosure response_ was reused by a new RPC (generation changed from 2 to 3) while still in Run(). The old closure is about to read response_->status() but the new RPC may be concurrently writing to the same response_ object.
```
and we add some be-ut which could only pass WITH this patch.
before we fix:
```
[----------] 7 tests from ExchangeSinkTest (5 ms total)
[----------] Global test environment tear-down
[==========] 7 tests from 1 test suite ran. (5 ms total)
[ PASSED ] 4 tests.
[ FAILED ] 3 tests, listed below:
[ FAILED ] ExchangeSinkTest.test_closure_call_must_not_corrupt_status_check
[ FAILED ] ExchangeSinkTest.test_closure_call_must_not_hide_error_status
[ FAILED ] ExchangeSinkTest.test_closure_call_must_not_hide_rpc_failure
```
after:
```
[----------] 7 tests from ExchangeSinkTest (4 ms total)
[----------] Global test environment tear-down
[==========] 7 tests from 1 test suite ran. (5 ms total)
[ PASSED ] 7 tests.
```
@yiguolei
yiguoleiforce-pushed the pick-61782-branch-4.1 branch from 4c83974 to efa7456CompareSeptember 5, 2026 14:00
@yiguolei

Copy link
Copy Markdown
Contributor

run buildall

@hello-stephen

Copy link
Copy Markdown
Contributor

BE UT Coverage Report

Increment line coverage 50.45% (56/111) 🎉

Increment coverage report
Complete coverage report

CategoryCoverage
Function Coverage59.58% (25803/43308)
Line Coverage44.19% (264940/599598)
Region Coverage40.14% (210387/524124)
Branch Coverage41.56% (96981/233370)

@hello-stephen

Copy link
Copy Markdown
Contributor

BE Regression && UT Coverage Report

Increment line coverage 82.88% (92/111) 🎉

Increment coverage report
Complete coverage report

CategoryCoverage
Function Coverage74.42% (31361/42139)
Line Coverage58.61% (348658/594853)
Region Coverage55.37% (290893/525359)
Branch Coverage56.16% (130919/233128)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@linrrzqqq@hello-stephen@yiguolei@zclllyybb