Azat Khuzhin
30f96dc525
Fix possible UAF from jobs in the ThreadPool on shutdown
...
ThreadPoolImpl<>::worker signaling that job is done while still storing
std::function<> object, and this can lead to problems on shutdown, since
in in this cast std::function<> can refers to some global/static object
that had been already destroyed (typical example is Logger).
I believe that this is exactly what TSAN reports about (decoded
manually, since llvm-symbolizer does not work in the test env):
<details>
```
- 2020-09-20 17:44:43 Write of size 8 at 0x7b1000008f78 by main thread (mutexes: write M1432):
operator delete(void*, unsigned long)
??:0:0
Poco::Logger::~Logger()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:39:1
non-virtual thunk to Poco::Logger::~Logger()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:0:0
Poco::RefCountedObject::release() const
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/include/Poco/RefCountedObject.h:82:24
Poco::Logger::shutdown()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:346:16
Poco::AutoLoggerShutdown::~AutoLoggerShutdown()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:459:4
cxa_at_exit_wrapper(void*)
??:0:0
```
```
- 2020-09-20 17:44:43 Previous atomic read of size 4 at 0x7b1000008f78 by thread T116:
__tsan_atomic32_load
??:0:0
int std::__1::__cxx_atomic_load<int>(std::__1::__cxx_atomic_base_impl<int> const*, std::__1::memory_order)
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/atomic:970:12
std::__1::__atomic_base<int, false>::load(std::__1::memory_order) const
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/atomic:1487:17
std::__1::__atomic_base<int, false>::operator int() const
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/atomic:1491:53
Poco::Logger::is(int) const
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/include/Poco/Logger.h:1264:9
MemoryTracker::logPeakMemoryUsage() const
/build/obj-x86_64-linux-gnu/../src/Common/MemoryTracker.cpp:59:5
MemoryTracker::~MemoryTracker()
/build/obj-x86_64-linux-gnu/../src/Common/MemoryTracker.cpp:46:13
DB::ThreadGroupStatus::~ThreadGroupStatus()
/build/obj-x86_64-linux-gnu/../src/Common/ThreadStatus.h:51:7
std::__1::__shared_ptr_emplace<DB::ThreadGroupStatus, std::__1::allocator<DB::ThreadGroupStatus> >::__on_zero_shared()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:3602:23
std::__1::__shared_count::__release_shared()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:3440:9
std::__1::__shared_weak_count::__release_shared()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:3482:27
std::__1::shared_ptr<DB::ThreadGroupStatus>::~shared_ptr()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:4207:19
DB::PipelineExecutor::executeImpl(unsigned long)::$_4::~$_4()
/build/obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:720:34
ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'()::~()
/build/obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:161:54
std::__1::__compressed_pair_elem<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'(), 0, false>::~__compressed_pair_elem()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:2188:8
std::__1::__function::__alloc_func<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'(), std::__1::allocator<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::Pip>
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1559:38
std::__1::__function::__func<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'(), std::__1::allocator<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineE>
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1706:10
std::__1::__function::__value_func<void ()>::~__value_func()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1828:19
std::__1::function<void ()>::~function()
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2460:43
ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>)
/build/obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:268:5
void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const
/build/obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:116:73
decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleI>
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3519:1
void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'(>
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:273:5
void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned lon>
/build/obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:284:5
__tsan_thread_start_func
??:0:0
```
```
- 2020-09-20 17:44:43 Mutex M1432 (0x0000181213a8) created at:
pthread_mutex_init
??:0:0
Poco::MutexImpl::MutexImpl()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Mutex_POSIX.cpp:64:6
Poco::Mutex::Mutex()
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Mutex.cpp:34:8
__cxx_global_var_init
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:28:15
_GLOBAL__sub_I_Logger.cpp
/build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Logger.cpp:0:0
__libc_csu_init
??:0:0
```
</details>
2020-09-20 23:46:28 +03:00
