Skip to content

[fix](file cache) Avoid accessing expired HDFS profile during prefetch - #67293

Open
bobhan1 wants to merge 1 commit into
apache:branch-4.1from
bobhan1:fix/doris-28268-hdfs-prefetch-profile-uaf
Open

[fix](file cache) Avoid accessing expired HDFS profile during prefetch#67293
bobhan1 wants to merge 1 commit into
apache:branch-4.1from
bobhan1:fix/doris-28268-hdfs-prefetch-profile-uaf

Conversation

@bobhan1

@bobhan1 bobhan1 commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: DORIS-28268

Related PR: None

Problem Summary:

CachedRemoteFileReader::prefetch_range() submits fire-and-forget dry-run tasks. A running task keeps the cached reader and its underlying HdfsFileReader alive, but it does not keep the query RuntimeProfile alive. HdfsFileReader::read_at_impl() previously always updated _total_read_time, so a delayed prefetch read could access that counter after the query profile had been freed.

Skip the query-profile timer for dry-run reads. Normal HDFS reads keep their existing profile accounting, and prefetch/cache-population behavior is unchanged.

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
      • ./build.sh --be -j100 is running; the result will be updated after completion.
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes. Dry-run HDFS reads no longer update the query HdfsIO timer; data reads and file-cache population are unchanged.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen

Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@bobhan1
bobhan1 marked this pull request as ready for review August 28, 2026 10:35
@bobhan1
bobhan1 requested a review from yiguolei as a code owner August 28, 2026 10:35
@bobhan1

bobhan1 commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

run buildall

@hello-stephen

Copy link
Copy Markdown
Contributor

BE UT Coverage Report

Increment line coverage 0.00% (0/2) 🎉

Increment coverage report
Complete coverage report

Category Coverage
Function Coverage 59.44% (25664/43178)
Line Coverage 43.92% (262338/597307)
Region Coverage 39.87% (207942/521536)
Branch Coverage 41.32% (95810/231879)

@hello-stephen

Copy link
Copy Markdown
Contributor

BE Regression && UT Coverage Report

Increment line coverage 0.00% (0/2) 🎉

Increment coverage report
Complete coverage report

Category Coverage
Function Coverage 74.13% (31187/42071)
Line Coverage 58.32% (345707/592815)
Region Coverage 55.13% (288214/522815)
Branch Coverage 55.95% (129591/231613)

@gavinchou
gavinchou self-requested a review August 30, 2026 12:51
Status HdfsFileReader::read_at_impl(size_t offset, Slice result, size_t* bytes_read,
const IOContext* io_ctx) {
SCOPED_TIMER(_total_read_time);
auto* read_timer = io_ctx != nullptr && io_ctx->is_dryrun ? nullptr : _total_read_time;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems read_timer may still endup with nullptr?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants