[
https://issues.apache.org/jira/browse/CASSANDRA-21714?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yifan Cai updated CASSANDRA-21714:
----------------------------------
Bug Category: Parent values: Availability(12983)Level 1 values: Process
Crash(12992)
Complexity: Low Hanging Fruit
Component/s: Local/SSTable
Discovered By: User Report
Severity: Normal
Status: Open (was: Triage Needed)
> Fix Use-After-Free in Zstd Dictionary Compressor When Cache Eviction Races
> In-Flight Compression
> ------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21714
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21714
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Local/SSTable
> Reporter: Yifan Cai
> Assignee: Yifan Cai
> Priority: Normal
>
> ZstdDictionaryCompressor's compress/uncompress calls relied on a
> compressor-lifetime dictionary reference rather than holding one for the
> duration of each native call. When Caffeine evicts the compressor from its
> cache, the eviction listener releases that reference synchronously, and if it
> was the dictionary's last reference, the dictionary's native compression
> tables are closed while a borrowed context is still in use, causing a
> use-after-free. This change has each compress/uncompress call take its own
> reference for the duration of the native call, so eviction cannot tidy the
> dictionary out from under an in-flight call. Includes a concurrency test that
> races cache eviction against compress/uncompress calls to reproduce the
> failure without the fix.
> Scott raised the issue at https://github.com/cscotta/cassandra/issues/18
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
