redis-plus-plus icon indicating copy to clipboard operation
redis-plus-plus copied to clipboard

[BUG] coredump happened in case connect_callback with exception for async mode

Open lisay-yan opened this issue 8 months ago • 6 comments

Describe the bug

in AsyncConnection::connect_callback, there throw error during handle different state, my case is throw error during State::CONNECTING, then program fire SegV.

To Reproduce To simple reproduce, you can use TLS, provide CA file which didn't exist, then , core dump will happen

Expected behavior Program shouldn't crash.

Environment:

  • OS: [e.g. ubuntu]
  • Compiler: [e.g. gcc 7.3.1, clang 3.9.1]
  • hiredis version: [e.g. v1.0.0, master]
  • redis-plus-plus version: [e.g. 1.3.2, master, commit b0a42e]

Additional context I think it is a multiple thread issues. AsyncConnection::connect_callback, handle exception via AsyncConnection::disconnect, then redisAsyncContext is freed. While, it seems libuv still not aware of context invalid, and still try to access, then segV.

bt #0 0x00007f1a8a28799e in redisAsyncHandleWrite (ac=0x7f1a8000dee0) at async.c:687 #1 0x00007f1a884f6f2b in uv__io_poll (loop=loop@entry=0x153e100, timeout=) at src/unix/linux.c:1526 #2 0x00007f1a884e5a4b in uv_run (loop=0x153e100, mode=UV_RUN_DEFAULT) at src/unix/core.c:447 #3 0x00007f1a89e27330 in std::(anonymous namespace)::execute_native_thread_routine (__p=) at ../../../../../libstdc++-v3/src/c++11/thread.cc:84 #4 0x00007f1a8b24bea5 in start_thread (arg=0x7f1a86a1b700) at pthread_create.c:307 #5 0x00007f1a8958ab0d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 (gdb) f 0 #0 0x00007f1a8a28799e in redisAsyncHandleWrite (ac=0x7f1a8000dee0) at async.c:687 687 c->funcs->async_write(ac);

Below shown details, c->funcs had been invalid.

p *(redisAsyncContext *)ac $3 = {c = {funcs = 0xffffffffffffffff, err = -1,...

All in all, redis-plus-plus seems is not thread safe when interact with libuv at rainy cases.

lisay-yan avatar Jun 21 '24 03:06 lisay-yan