[MESOS-209] A race bug in ProcessManager::spawn in libprocess.

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.9.0
• Fix Version/s: 0.10.0
• Component/s: c++ api
• Labels: libprocess

Environment

All platforms.

• Assignee: Unassigned
• Reporter: Jie Yu
• Created: 18/Jun/12 23:55
• Updated: 22/May/13 01:13
• Resolved: 19/Jun/12 19:04

Description

This is a race bug found in ProcessManager::spawn in libprocess. Below is the description of this bug.

------------------------------------------------------------------------------------------------------
UPID ProcessManager::spawn(ProcessBase* process, bool manage)
{
...

// Use the garbage collector if requested.
if (manage)

{ dispatch(gc, &GarbageCollector::manage<ProcessBase>, process); }

// Add process to the run queue (so 'initialize' will get invoked).
enqueue(process);

VLOG(2) << "Spawned process " << process->self();

return process->self();
}
------------------------------------------------------------------------------------------------------

If a user spawns a process which is very short and sets 'manage' to true. It is likely that the pointer 'process' becomes a dangling pointer after enqueue(..) is called. As a result, a random segfault will be thrown when 'process->self()' is called.