[
https://issues.apache.org/jira/browse/ZOOKEEPER-2111?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Hongchao Deng updated ZOOKEEPER-2111:
-------------------------------------
Description:
In ClientCnxn.queuePacket, it checks variables of state and closing and then
make decisions. There is toctou race in queuePacket():
{code}
if (!state.isAlive() || closing) {
conLossPacket(packet);
} else {
...
}
{code}
A possible race:
in SendThread.run():
{code}
while (state.isAlive()) {
...
}
cleanup();
{code}
When it checks in queuePacket(), state is still alive. Then state isn't alive,
SendThread.run() cleans up outgoingQueue. Then queuePacket adds packet to
outgoingQueue. The packet should be waken up with exception. But it won't at
this case.
The same problem could happen to variable "closing".
was:
In ClientCnxn.queuePacket, it checks variables of state and closing and then
make decisions. There is toctou race in queuePacket():
{code}
if (!state.isAlive() || closing) {
conLossPacket(packet);
} else {
...
}
{code}
A possible race:
in SendThread.run():
{code}
while (state.isAlive()) {
...
}
cleanup();
{code}
When it checks in queuePacket(), state is still alive. Then state isn't alive,
SendThread.run() cleans up outgoingQueue. Then queuePacket adds packet to
outgoingQueue. The packet should be waken up with exception. But it won't at
this case.
> Not isAlive states should be synchronized in ClientCnxn
> -------------------------------------------------------
>
> Key: ZOOKEEPER-2111
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2111
> Project: ZooKeeper
> Issue Type: Bug
> Components: java client
> Reporter: Hongchao Deng
> Assignee: Hongchao Deng
> Attachments: ZOOKEEPER-2111.patch, ZOOKEEPER-2111.patch
>
>
> In ClientCnxn.queuePacket, it checks variables of state and closing and then
> make decisions. There is toctou race in queuePacket():
> {code}
> if (!state.isAlive() || closing) {
> conLossPacket(packet);
> } else {
> ...
> }
> {code}
> A possible race:
> in SendThread.run():
> {code}
> while (state.isAlive()) {
> ...
> }
> cleanup();
> {code}
> When it checks in queuePacket(), state is still alive. Then state isn't
> alive, SendThread.run() cleans up outgoingQueue. Then queuePacket adds packet
> to outgoingQueue. The packet should be waken up with exception. But it won't
> at this case.
> The same problem could happen to variable "closing".
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
