Yifan Cai created CASSANDRA-21714:
-------------------------------------
Summary: Fix Use-After-Free in Zstd Dictionary Compressor When
Cache Eviction Races In-Flight Compression
Key: CASSANDRA-21714
URL: https://issues.apache.org/jira/browse/CASSANDRA-21714
Project: Apache Cassandra
Issue Type: Bug
Reporter: Yifan Cai
Assignee: Yifan Cai
ZstdDictionaryCompressor's compress/uncompress calls relied on a
compressor-lifetime dictionary reference rather than holding one for the
duration of each native call. When Caffeine evicts the compressor from its
cache, the eviction listener releases that reference synchronously, and if it
was the dictionary's last reference, the dictionary's native compression tables
are closed while a borrowed context is still in use, causing a use-after-free.
This change has each compress/uncompress call take its own reference for the
duration of the native call, so eviction cannot tidy the dictionary out from
under an in-flight call. Includes a concurrency test that races cache eviction
against compress/uncompress calls to reproduce the failure without the fix.
Scott raised the issue at https://github.com/cscotta/cassandra/issues/18
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
