Fix crash due to incorrect event deletion of evport #14162
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) ✅ license/snyk check is complete. No issues have been found. (View Details) |
Member
|
you mean we call |
Collaborator
Author
yes, Just like the code in ae ae_epoll it's the responsibility for the aeApiDelEvent() to calculate the final mask. |
YaacovHazan
pushed a commit
to YaacovHazan/redis
that referenced
this pull request
Jul 3, 2025
This PR fixes redis#14056 (comment) ## Summary Because evport uses `eventLoop->events[fd].mask` to determine whether to remove the event, but in ae.c we call `aeApiDelEvent()` before updating `eventLoop->events[fd].mask`, this causes evport to always see the old value, and as a result, `port_dissociate()` is never called to remove the fd. This issue may not surface easily in a non-multithreaded, but since in the multi-threaded case we frequently reassign fds to different threads, it makes the crash much more likely to occur.
fcostaoliveira
pushed a commit
to filipecosta90/redis
that referenced
this pull request
Jul 4, 2025
This PR fixes redis#14056 (comment) ## Summary Because evport uses `eventLoop->events[fd].mask` to determine whether to remove the event, but in ae.c we call `aeApiDelEvent()` before updating `eventLoop->events[fd].mask`, this causes evport to always see the old value, and as a result, `port_dissociate()` is never called to remove the fd. This issue may not surface easily in a non-multithreaded, but since in the multi-threaded case we frequently reassign fds to different threads, it makes the crash much more likely to occur.
YaacovHazan
pushed a commit
that referenced
this pull request
Jul 6, 2025
This PR fixes #14056 (comment) ## Summary Because evport uses `eventLoop->events[fd].mask` to determine whether to remove the event, but in ae.c we call `aeApiDelEvent()` before updating `eventLoop->events[fd].mask`, this causes evport to always see the old value, and as a result, `port_dissociate()` is never called to remove the fd. This issue may not surface easily in a non-multithreaded, but since in the multi-threaded case we frequently reassign fds to different threads, it makes the crash much more likely to occur.
Merged
sundb
added a commit
that referenced
this pull request
Aug 4, 2025
This is the General Availability release of Redis Open Source 8.2. ### Major changes compared to 8.0 - Streams - new commands: `XDELEX` and `XACKDEL`; extension to `XADD` and `XTRIM` - Bitmap - `BITOP`: new operators: `DIFF`, `DIFF1`, `ANDOR`, and `ONE` - Query Engine - new SVS-VAMANA vector index type which supports vector compression - More than 15 performance and resource utilization improvements - New metrics: per-slot usage metrics, key size distributions for basic data types, and more ### Binary distributions - Alpine and Debian Docker images - https://hub.docker.com/_/redis - Install using snap - see https://github.com/redis/redis-snap - Install using brew - see https://github.com/redis/homebrew-redis - Install using RPM - see https://github.com/redis/redis-rpm - Install using Debian APT - see https://github.com/redis/redis-debian ### Operating systems we test Redis 8.2 on - Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat) - Rocky Linux 8.10, 9.5 - AlmaLinux 8.10, 9.5 - Debian 12 (Bookworm) - macOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia) ### Security fixes (compared to 8.2-RC1) - (CVE-2025-32023) Fix out-of-bounds write in `HyperLogLog` commands - (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error ### New Features (compared to 8.2-RC1) - #14141 Keyspace notifications - new event types: - `OVERWRITTEN` - the value of a key is completely overwritten - `TYPE_CHANGED` - key type change ### Bug fixes (compared to 8.2-RC1) - #14162 Crash when using evport with I/O threads - #14163 `EVAL` crash when error table is empty - #14144 Vector sets - RDB format is not compatible with big endian machines - #14165 Endless client blocking for blocking commands - #14164 Prevent `CLIENT UNBLOCK` from unblocking `CLIENT PAUSE` - #14216 TTL was not removed by the `SET` command - #14224 `HINCRBYFLOAT` removes field expiration on replica ### Performance and resource utilization improvements (compared to 8.2-RC1) - #14200 Store iterators on stack instead of on heap - #14144 Vector set - improve RDB loading / RESTORE speed by storing the worst link info - #Q6430 More compression variants for the SVS-VAMANA vector index - #Q6535 `SHARD_K_RATIO` parameter - favor network latency over accuracy for KNN vector query in a Redis cluster (unstable feature) (MOD-10359) ### Modules API - #14051 `RedisModule_Get*`, `RedisModule_Set*` - allow modules to access Redis configurations - #14114 `RM_UnsubscribeFromKeyspaceEvents` - unregister a module from specific keyspace notifications
funny-dog
pushed a commit
to funny-dog/redis
that referenced
this pull request
Sep 17, 2025
This PR fixes redis#14056 (comment) ## Summary Because evport uses `eventLoop->events[fd].mask` to determine whether to remove the event, but in ae.c we call `aeApiDelEvent()` before updating `eventLoop->events[fd].mask`, this causes evport to always see the old value, and as a result, `port_dissociate()` is never called to remove the fd. This issue may not surface easily in a non-multithreaded, but since in the multi-threaded case we frequently reassign fds to different threads, it makes the crash much more likely to occur.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes #14056 (comment)
Summary
Because evport uses
eventLoop->events[fd].maskto determine whether to remove the event, but in ae.c we callaeApiDelEvent()before updatingeventLoop->events[fd].mask, this causes evport to always see the old value, and as a result,port_dissociate()is never called to remove the fd.This issue may not surface easily in a non-multithreaded, but since in the multi-threaded case we frequently reassign fds to different threads, it makes the crash much more likely to occur.
Reproduce steps on SmartOS
Crash report