Influxdata
/
influxdb
mirror of https://github.com/influxdata/influxdb.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix(tsi): close series id iterator after merging (#19936) 

This use-after-free bug may lead to segfault. The iterators that have
reference to the underlying index files were closed too early while
the bitmaps were still used afterwards. If a compaction occurs
concurrently and removes the index files, it would result in accessing
unmap'd memory address.
pull/20585/head^2
Tristan Su 2021-02-10 23:13:07 +08:00 committed by GitHub
parent 262cdbaec2
commit c9965e56ca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -3,11 +3,12 @@
### Features ### Features
1. [19811](https://github.com/influxdata/influxdb/pull/19811): Add Geo graph type to be able to store in Dashboard cells. 1. [19811](https://github.com/influxdata/influxdb/pull/19811): Add Geo graph type to be able to store in Dashboard cells.
1. [20621](https://github.com/influxdata/influxdb/pull/20621): Add Swift client library to the data loading section of the UI 1. [20621](https://github.com/influxdata/influxdb/pull/20621): Add Swift client library to the data loading section of the UI.
### Bug Fixes ### Bug Fixes
1. [20705](https://github.com/influxdata/influxdb/pull/20705): Repair swagger to match implementation of DBRPs type. 1. [20705](https://github.com/influxdata/influxdb/pull/20705): Repair swagger to match implementation of DBRPs type.
1. [19936](https://github.com/influxdata/influxdb/pull/19936): Fix use-after-free bug in series ID iterator. Thanks @foobar!
## v2.0.4 [2021-02-08] ## v2.0.4 [2021-02-08]

13
tsdb/index.go
View File

@ -557,9 +557,11 @@ func IntersectSeriesIDIterators(itr0, itr1 SeriesIDIterator) SeriesIDIterator {
// Create series id set, if available. // Create series id set, if available.
if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil { if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil {
ss := a[0].SeriesIDSet().And(a[1].SeriesIDSet())
// `a` holds references to itr0/itr1 so itr0/itr1 should not be closed when `a` is still in use
itr0.Close() itr0.Close()
itr1.Close() itr1.Close()
return NewSeriesIDSetIterator(a[0].SeriesIDSet().And(a[1].SeriesIDSet())) return NewSeriesIDSetIterator(ss)
} }
return &seriesIDIntersectIterator{itrs: [2]SeriesIDIterator{itr0, itr1}} return &seriesIDIntersectIterator{itrs: [2]SeriesIDIterator{itr0, itr1}}
@ -646,10 +648,11 @@ func UnionSeriesIDIterators(itr0, itr1 SeriesIDIterator) SeriesIDIterator {
// Create series id set, if available. // Create series id set, if available.
if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil { if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil {
itr0.Close()
itr1.Close()
ss := NewSeriesIDSet() ss := NewSeriesIDSet()
ss.Merge(a[0].SeriesIDSet(), a[1].SeriesIDSet()) ss.Merge(a[0].SeriesIDSet(), a[1].SeriesIDSet())
// `a` holds references to itr0/itr1 so itr0/itr1 should not be closed when `a` is still in use
itr0.Close()
itr1.Close()
return NewSeriesIDSetIterator(ss) return NewSeriesIDSetIterator(ss)
} }
@ -733,9 +736,11 @@ func DifferenceSeriesIDIterators(itr0, itr1 SeriesIDIterator) SeriesIDIterator {
// Create series id set, if available. // Create series id set, if available.
if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil { if a := NewSeriesIDSetIterators([]SeriesIDIterator{itr0, itr1}); a != nil {
ss := a[0].SeriesIDSet().AndNot(a[1].SeriesIDSet())
// `a` holds references to itr0/itr1 so itr0/itr1 should not be closed when `a` is still in use
itr0.Close() itr0.Close()
itr1.Close() itr1.Close()
return NewSeriesIDSetIterator(a[0].SeriesIDSet().AndNot(a[1].SeriesIDSet())) return NewSeriesIDSetIterator(ss)
} }
return &seriesIDDifferenceIterator{itrs: [2]SeriesIDIterator{itr0, itr1}} return &seriesIDDifferenceIterator{itrs: [2]SeriesIDIterator{itr0, itr1}}