Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug](runtime-filter) fix bloom_filter_func use after free on get_build_bf_cardinality #47034

Merged
merged 1 commit into from
Jan 16, 2025

Conversation

BiteTheDDDDt
Copy link
Contributor

@BiteTheDDDDt BiteTheDDDDt commented Jan 15, 2025

What problem does this PR solve?

fix bloom_filter_func use after free on get_build_bf_cardinality

In #46789 we release memory after rf disabled, but fuzzy_disable_runtime_filter_in_be will disable all rf at join_operator::open() and lead use after free

/root/doris/be/src/exprs/runtime_filter.cpp:376:49: runtime error: member call on null pointer of type 'doris::BloomFilterFuncBase'
19:06:00   *** Query id: a1c642ea781748a7-964e332695678128 ***
19:06:00   *** is nereids: 1 ***
19:06:00   *** tablet id: 0 ***
19:06:00   *** Aborted at 1736938943 (unix time) try "date -d @1736938943" if you are using GNU date ***
19:06:00   *** Current BE git commitID: e3f29ba692 ***
19:06:00   *** SIGSEGV address not mapped to object (@0x0) received by PID 1874761 (TID 1877271 OR 0x7fb56c5c7700) from PID 0; stack trace: ***
19:06:00    0# doris::signal::(anonymous namespace)::FailureSignalHandler(int, siginfo_t*, void*) at /root/doris/be/src/common/signal_handler.h:421
19:06:00    1# PosixSignals::chained_handler(int, siginfo_t*, void*) [clone .part.0] in /usr/lib/jvm/java-17-openjdk-amd64/lib/server/libjvm.so
19:06:00    2# JVM_handle_linux_signal in /usr/lib/jvm/java-17-openjdk-amd64/lib/server/libjvm.so
19:06:00    3# 0x00007FB7232D9090 in /lib/x86_64-linux-gnu/libc.so.6
19:06:00    4# doris::RuntimePredicateWrapper::get_build_bf_cardinality() const at /root/doris/be/src/exprs/runtime_filter.cpp:376
19:06:00    5# doris::IRuntimeFilter::need_sync_filter_size() at /root/doris/be/src/exprs/runtime_filter.cpp:1634
19:06:00    6# doris::VRuntimeFilterSlots::send_filter_size(doris::RuntimeState*, unsigned long, std::shared_ptr<doris::pipeline::CountedFinishDependency>) at /root/doris/be/src/exprs/runtime_filter_slots.h:50
19:06:00    7# doris::pipeline::HashJoinBuildSinkLocalState::close(doris::RuntimeState*, doris::Status) at /root/doris/be/src/pipeline/exec/hashjoin_build_sink.cpp:156
19:06:00    8# doris::pipeline::DataSinkOperatorXBase::close(doris::RuntimeState*, doris::Status) at /root/doris/be/src/pipeline/exec/operator.h:497
19:06:00    9# doris::pipeline::PipelineTask::close(doris::Status, bool) at /root/doris/be/src/pipeline/pipeline_task.cpp:468
19:06:00   10# doris::pipeline::_close_task(doris::pipeline::PipelineTask*, doris::Status) at /root/doris/be/src/pipeline/task_scheduler.cpp:90
19:06:00   11# doris::pipeline::TaskScheduler::_do_work(int) at /root/doris/be/src/pipeline/task_scheduler.cpp:175

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen
Copy link
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@BiteTheDDDDt
Copy link
Contributor Author

run buildall

@BiteTheDDDDt
Copy link
Contributor Author

run buildall

1 similar comment
@BiteTheDDDDt
Copy link
Contributor Author

run buildall

Gabriel39
Gabriel39 previously approved these changes Jan 16, 2025
@BiteTheDDDDt
Copy link
Contributor Author

run buildall

Copy link
Contributor

PR approved by anyone and no changes requested.

Copy link
Contributor

PR approved by at least one committer and no changes requested.

@github-actions github-actions bot added the approved Indicates a PR has been approved by one committer. label Jan 16, 2025
@BiteTheDDDDt BiteTheDDDDt merged commit 3749b7b into apache:master Jan 16, 2025
25 of 27 checks passed
BiteTheDDDDt added a commit that referenced this pull request Jan 16, 2025
yiguolei pushed a commit that referenced this pull request Jan 16, 2025
lzyy2024 pushed a commit to lzyy2024/doris that referenced this pull request Feb 21, 2025
…ld_bf_cardinality (apache#47034)

### What problem does this PR solve?
fix bloom_filter_func use after free on get_build_bf_cardinality

In apache#46789 we release memory after rf
disabled, but fuzzy_disable_runtime_filter_in_be will disable all rf at
join_operator::open() and lead use after free

```cpp
/root/doris/be/src/exprs/runtime_filter.cpp:376:49: runtime error: member call on null pointer of type 'doris::BloomFilterFuncBase'
19:06:00   *** Query id: a1c642ea781748a7-964e332695678128 ***
19:06:00   *** is nereids: 1 ***
19:06:00   *** tablet id: 0 ***
19:06:00   *** Aborted at 1736938943 (unix time) try "date -d @1736938943" if you are using GNU date ***
19:06:00   *** Current BE git commitID: e3f29ba692 ***
19:06:00   *** SIGSEGV address not mapped to object (@0x0) received by PID 1874761 (TID 1877271 OR 0x7fb56c5c7700) from PID 0; stack trace: ***
19:06:00    0# doris::signal::(anonymous namespace)::FailureSignalHandler(int, siginfo_t*, void*) at /root/doris/be/src/common/signal_handler.h:421
19:06:00    1# PosixSignals::chained_handler(int, siginfo_t*, void*) [clone .part.0] in /usr/lib/jvm/java-17-openjdk-amd64/lib/server/libjvm.so
19:06:00    2# JVM_handle_linux_signal in /usr/lib/jvm/java-17-openjdk-amd64/lib/server/libjvm.so
19:06:00    3# 0x00007FB7232D9090 in /lib/x86_64-linux-gnu/libc.so.6
19:06:00    4# doris::RuntimePredicateWrapper::get_build_bf_cardinality() const at /root/doris/be/src/exprs/runtime_filter.cpp:376
19:06:00    5# doris::IRuntimeFilter::need_sync_filter_size() at /root/doris/be/src/exprs/runtime_filter.cpp:1634
19:06:00    6# doris::VRuntimeFilterSlots::send_filter_size(doris::RuntimeState*, unsigned long, std::shared_ptr<doris::pipeline::CountedFinishDependency>) at /root/doris/be/src/exprs/runtime_filter_slots.h:50
19:06:00    7# doris::pipeline::HashJoinBuildSinkLocalState::close(doris::RuntimeState*, doris::Status) at /root/doris/be/src/pipeline/exec/hashjoin_build_sink.cpp:156
19:06:00    8# doris::pipeline::DataSinkOperatorXBase::close(doris::RuntimeState*, doris::Status) at /root/doris/be/src/pipeline/exec/operator.h:497
19:06:00    9# doris::pipeline::PipelineTask::close(doris::Status, bool) at /root/doris/be/src/pipeline/pipeline_task.cpp:468
19:06:00   10# doris::pipeline::_close_task(doris::pipeline::PipelineTask*, doris::Status) at /root/doris/be/src/pipeline/task_scheduler.cpp:90
19:06:00   11# doris::pipeline::TaskScheduler::_do_work(int) at /root/doris/be/src/pipeline/task_scheduler.cpp:175
```

### Check List (For Author)

- Test <!-- At least one of them must be included. -->
    - [ ] Regression test
    - [ ] Unit Test
    - [ ] Manual test (add detailed scripts or steps below)
    - [x] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
        - [x] Previous test can cover this change.
        - [ ] No code files have been changed.
        - [ ] Other reason <!-- Add your reason?  -->

- Behavior changed:
    - [x] No.
    - [ ] Yes. <!-- Explain the behavior change -->

- Does this need documentation?
    - [x] No.
- [ ] Yes. <!-- Add document PR link here. eg:
apache/doris-website#1214 -->

### Check List (For Reviewer who merge this PR)

- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR
should merge into -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by one committer. dev/2.1.8-merged dev/3.0.4-merged reviewed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants