• P
    Fix heap use-after-free race with DropColumnFamily (#9730) · cad80997
    Peter Dillinger 提交于
    Summary:
    Although ColumnFamilySet comments say that DB mutex can be
    freed during iteration, as long as you hold a ref while releasing DB
    mutex, this is not quite true because UnrefAndTryDelete might delete cfd
    right before it is needed to get ->next_ for the next iteration of the
    loop.
    
    This change solves the problem by making a wrapper class that makes such
    iteration easier while handling the tricky details of UnrefAndTryDelete
    on the previous cfd only after getting next_ in operator++.
    
    FreeDeadColumnFamilies should already have been obsolete; this removes
    it for good. Similarly, ColumnFamilySet::iterator doesn't need to check
    for cfd with 0 refs, because those are immediately deleted.
    
    Pull Request resolved: https://github.com/facebook/rocksdb/pull/9730
    
    Test Plan:
    was reported with ASAN on unit tests like
    DBLogicalBlockSizeCacheTest.CreateColumnFamily (very rare); keep watching
    
    Reviewed By: ltamasi
    
    Differential Revision: D35038143
    
    Pulled By: pdillinger
    
    fbshipit-source-id: 0a5478d5be96c135343a00603711b7df43ae19c9
    cad80997
column_family.cc 61.1 KB