From d1b85f893ece8efddc234dc6b79805904a5ba97c Mon Sep 17 00:00:00 2001 From: Haojun Liao Date: Wed, 21 Dec 2022 16:24:37 +0800 Subject: [PATCH 1/4] fix(query): update the blockInfo --- source/dnode/vnode/src/tsdb/tsdbRead.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/source/dnode/vnode/src/tsdb/tsdbRead.c b/source/dnode/vnode/src/tsdb/tsdbRead.c index 24a614800e..705130931e 100644 --- a/source/dnode/vnode/src/tsdb/tsdbRead.c +++ b/source/dnode/vnode/src/tsdb/tsdbRead.c @@ -190,7 +190,7 @@ static int32_t doMergeRowsInLastBlock(SLastBlockReader* pLastBlockReader, STabl static int32_t doMergeRowsInBuf(SIterInfo* pIter, uint64_t uid, int64_t ts, SArray* pDelList, SRowMerger* pMerger, STsdbReader* pReader); static int32_t doAppendRowFromTSRow(SSDataBlock* pBlock, STsdbReader* pReader, STSRow* pTSRow, - STableBlockScanInfo* pInfo); + STableBlockScanInfo* pScanInfo); static int32_t doAppendRowFromFileBlock(SSDataBlock* pResBlock, STsdbReader* pReader, SBlockData* pBlockData, int32_t rowIndex); static void setComposedBlockFlag(STsdbReader* pReader, bool composed); @@ -2482,6 +2482,8 @@ static int32_t buildComposedDataBlock(STsdbReader* pReader) { int32_t nextIndex = -1; SBlockIndex bIndex = {0}; + pBlockInfo = getCurrentBlockInfo(&pReader->status.blockIter); + bool hasNeighbor = getNeighborBlockOfSameTable(pBlockInfo, pBlockScanInfo, &nextIndex, pReader->order, &bIndex); if (!hasNeighbor) { // do nothing setBlockAllDumped(pDumpInfo, pBlock->maxKey.ts, pReader->order); From d5a770c98a7cebf4ef10afe38c6161399b57ae4f Mon Sep 17 00:00:00 2001 From: Haojun Liao Date: Wed, 21 Dec 2022 16:25:18 +0800 Subject: [PATCH 2/4] fix(query): add comment. --- source/dnode/vnode/src/tsdb/tsdbRead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/dnode/vnode/src/tsdb/tsdbRead.c b/source/dnode/vnode/src/tsdb/tsdbRead.c index 705130931e..4aca1ea228 100644 --- a/source/dnode/vnode/src/tsdb/tsdbRead.c +++ b/source/dnode/vnode/src/tsdb/tsdbRead.c @@ -2482,7 +2482,7 @@ static int32_t buildComposedDataBlock(STsdbReader* pReader) { int32_t nextIndex = -1; SBlockIndex bIndex = {0}; - pBlockInfo = getCurrentBlockInfo(&pReader->status.blockIter); + pBlockInfo = getCurrentBlockInfo(&pReader->status.blockIter); // NOTE: get the new block info bool hasNeighbor = getNeighborBlockOfSameTable(pBlockInfo, pBlockScanInfo, &nextIndex, pReader->order, &bIndex); if (!hasNeighbor) { // do nothing From 510ad2e39e3bad5bbc72240b3bae7d05c0e016da Mon Sep 17 00:00:00 2001 From: Shengliang Guan Date: Wed, 21 Dec 2022 17:15:34 +0800 Subject: [PATCH 3/4] fix: heap-use-after-free while transfer snapshot between vnode replicas --- source/libs/sync/src/syncSnapshot.c | 32 +++++++++++++++-------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/source/libs/sync/src/syncSnapshot.c b/source/libs/sync/src/syncSnapshot.c index 8d70404032..30324c1113 100644 --- a/source/libs/sync/src/syncSnapshot.c +++ b/source/libs/sync/src/syncSnapshot.c @@ -122,15 +122,16 @@ int32_t snapshotSenderStart(SSyncSnapshotSender *pSender) { pMsg->startTime = pSender->startTime; pMsg->seq = SYNC_SNAPSHOT_SEQ_PRE_SNAPSHOT; + // event log + sSDebug(pSender, "snapshot sender start"); + syncLogSendSyncSnapshotSend(pSender->pSyncNode, pMsg, "snapshot sender start"); + // send msg if (syncNodeSendMsgById(&pMsg->destId, pSender->pSyncNode, &rpcMsg) != 0) { sSError(pSender, "snapshot sender send msg failed since %s", terrstr()); return -1; } - // event log - sSDebug(pSender, "snapshot sender start"); - syncLogSendSyncSnapshotSend(pSender->pSyncNode, pMsg, "snapshot sender start"); return 0; } @@ -208,14 +209,6 @@ int32_t snapshotSend(SSyncSnapshotSender *pSender) { memcpy(pMsg->data, pSender->pCurrentBlock, pSender->blockLen); } - // send msg - if (syncNodeSendMsgById(&pMsg->destId, pSender->pSyncNode, &rpcMsg) != 0) { - sSError(pSender, "snapshot sender send msg failed since %s", terrstr()); - return -1; - } - - pSender->lastSendTime = taosGetTimestampMs(); - // event log if (pSender->seq == SYNC_SNAPSHOT_SEQ_END) { sSDebug(pSender, "snapshot sender finish, seq:%d", pSender->seq); @@ -224,6 +217,14 @@ int32_t snapshotSend(SSyncSnapshotSender *pSender) { sSDebug(pSender, "snapshot sender sending, seq:%d", pSender->seq); syncLogSendSyncSnapshotSend(pSender->pSyncNode, pMsg, "snapshot sender sending"); } + + // send msg + if (syncNodeSendMsgById(&pMsg->destId, pSender->pSyncNode, &rpcMsg) != 0) { + sSError(pSender, "snapshot sender send msg failed since %s", terrstr()); + return -1; + } + + pSender->lastSendTime = taosGetTimestampMs(); return 0; } @@ -252,6 +253,10 @@ int32_t snapshotReSend(SSyncSnapshotSender *pSender) { memcpy(pMsg->data, pSender->pCurrentBlock, pSender->blockLen); } + // event log + sSDebug(pSender, "snapshot sender resend, seq:%d", pSender->seq); + syncLogSendSyncSnapshotSend(pSender->pSyncNode, pMsg, "snapshot sender resend"); + // send msg if (syncNodeSendMsgById(&pMsg->destId, pSender->pSyncNode, &rpcMsg) != 0) { sSError(pSender, "snapshot sender resend msg failed since %s", terrstr()); @@ -259,10 +264,6 @@ int32_t snapshotReSend(SSyncSnapshotSender *pSender) { } pSender->lastSendTime = taosGetTimestampMs(); - - // event log - sSDebug(pSender, "snapshot sender resend, seq:%d", pSender->seq); - syncLogSendSyncSnapshotSend(pSender->pSyncNode, pMsg, "snapshot sender resend"); return 0; } @@ -748,6 +749,7 @@ static int32_t syncNodeOnSnapshotTransfering(SSyncNode *pSyncNode, SyncSnapshotS sRError(pReceiver, "snapshot receiver send resp failed since %s", terrstr()); return -1; } + return 0; } From 6e7e3139b11bcab4c2e21a5a45a1707fd0cd5357 Mon Sep 17 00:00:00 2001 From: Shengliang Guan Date: Wed, 21 Dec 2022 17:33:34 +0800 Subject: [PATCH 4/4] fix: heap-use-after-free while alter vnode replicas --- source/libs/sync/src/syncMain.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source/libs/sync/src/syncMain.c b/source/libs/sync/src/syncMain.c index 9d749d8e58..f1aa9312c6 100644 --- a/source/libs/sync/src/syncMain.c +++ b/source/libs/sync/src/syncMain.c @@ -1294,10 +1294,6 @@ void syncNodeClose(SSyncNode* pSyncNode) { syncNodeStopElectTimer(pSyncNode); syncNodeStopHeartbeatTimer(pSyncNode); - if (pSyncNode->pFsm != NULL) { - taosMemoryFree(pSyncNode->pFsm); - } - for (int32_t i = 0; i < TSDB_MAX_REPLICA; ++i) { if ((pSyncNode->senders)[i] != NULL) { sSTrace((pSyncNode->senders)[i], "snapshot sender destroy while close, data:%p", (pSyncNode->senders)[i]); @@ -1320,6 +1316,10 @@ void syncNodeClose(SSyncNode* pSyncNode) { pSyncNode->pNewNodeReceiver = NULL; } + if (pSyncNode->pFsm != NULL) { + taosMemoryFree(pSyncNode->pFsm); + } + taosMemoryFree(pSyncNode); }