Skip to content

fix(kafka): fix use-after-free on task cancellation during kafka producer Send #1299

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
disaykin wants to merge 2 commits into from
+141 −10
Closed

fix(kafka): fix use-after-free on task cancellation during kafka producer Send #1299

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efd71f2
fix(kafka): fix use-after-free on task cancellation during kafka prod…
disaykin Jul 17, 2026
36e9363
ubuntu_install_kafka.sh: update kafka download URL
disaykin Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 17 additions & 5 deletions kafka/src/kafka/producer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#include <userver/kafka/producer.hpp>

#include <userver/engine/task/cancel.hpp>
#include <userver/formats/json/value_builder.hpp>
#include <userver/formats/serialize/common_containers.hpp>
#include <userver/kafka/impl/configuration.hpp>
Expand Down Expand Up @@ -106,6 +107,17 @@ void HandleDeliveryErrors(const std::vector<impl::DeliveryResult>& delivery_resu
}
}

void RunAsyncTask(auto name, auto& task_processor, auto code_block) {
engine::current_task::CancellationPoint();

{
const engine::TaskCancellationBlocker cancellation_blocker;
utils::Async(task_processor, name, code_block).Get();
}

engine::current_task::CancellationPoint();
}

} // namespace

Producer::Producer(
Expand Down Expand Up @@ -136,9 +148,9 @@ void Producer::Send(
std::optional<std::uint32_t> partition,
HeaderViews headers
) const {
utils::Async(producer_task_processor_, "producer_send", [this, topic_name, key, message, partition, &headers] {
RunAsyncTask("producer_send", producer_task_processor_, [this, topic_name, key, message, partition, &headers] {
SendImpl(topic_name, key, message, partition, impl::HeadersHolder{headers});
}).Get();
});
}

void Producer::SendWrapper(
Expand All @@ -148,13 +160,13 @@ void Producer::SendWrapper(
std::optional<std::uint32_t> partition,
HeaderViews headers
) const {
utils::Async(
producer_task_processor_,
RunAsyncTask(
"producer_send_bulk",
producer_task_processor_,
[this, topic_name, key, &messages, partition, &headers] {
SendImpl(topic_name, key, messages, partition, BuildHeaderHolders(headers, messages.Size()));
}
).Get();
);
}

engine::TaskWithResult<void> Producer::SendAsync(
Expand Down
122 changes: 121 additions & 1 deletion kafka/tests/producer_kafkatest.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ UTEST_F(ProducerTest, LargeMessages) {

const kafka::impl::ProducerConfiguration producer_configuration{};

auto producer = MakeProducer("kafka-producer");
auto producer = MakeProducer("kafka-producer", producer_configuration);
const std::string topic = GenerateTopic();

const std::string big_message(producer_configuration.message_max_bytes / 2, 'm');
Expand Down Expand Up @@ -526,4 +526,124 @@ UTEST_F_MT(ProducerTest, OneProducerManySendAsyncMt, 1 + 4) {
UEXPECT_NO_THROW(engine::WaitAllChecked(*results_lock));
}

UTEST_F(ProducerTest, NoUseAfterFreeOnTaskCancellationBeforeSendCall) {
kafka::impl::ProducerConfiguration producer_configuration{};
producer_configuration.delivery_timeout = std::chrono::seconds{2};
producer_configuration.queue_buffering_max = std::chrono::seconds{1};
producer_configuration.queue_buffering_max_messages = 100;

auto producer = MakeProducer("kafka-producer", producer_configuration);
const std::string topic = GenerateTopic();

bool sendThrowsTaskCancelledException = false;

auto send_task = utils::Async("send_task", [&] {
const std::string key = "test-key";
const std::string message = "test-msg";

engine::current_task::RequestCancel();

try {
producer.Send(topic, key, message);
} catch (...) {
sendThrowsTaskCancelledException = true;
throw;
}
});

UEXPECT_THROW(send_task.Get(), engine::TaskCancelledException);
EXPECT_TRUE(sendThrowsTaskCancelledException);
}

UTEST_F(ProducerTest, NoUseAfterFreeOnTaskCancellationAfterSendCall) {
kafka::impl::ProducerConfiguration producer_configuration{};
producer_configuration.delivery_timeout = std::chrono::seconds{2};
producer_configuration.queue_buffering_max = std::chrono::seconds{1};
producer_configuration.queue_buffering_max_messages = 100;

auto producer = MakeProducer("kafka-producer", producer_configuration);
const std::string topic = GenerateTopic();

bool sendThrowsTaskCancelledException = false;

auto send_task = utils::Async("send_task", [&] {
const std::string key = "test-key";
const std::string message = "test-msg";

try {
producer.Send(topic, key, message);
} catch (...) {
sendThrowsTaskCancelledException = true;
throw;
}
});

engine::SleepFor(std::chrono::milliseconds(10));

send_task.RequestCancel();

UEXPECT_THROW(send_task.Get(), engine::TaskCancelledException);
EXPECT_TRUE(sendThrowsTaskCancelledException);
}

UTEST_F(ProducerTest, NoUseAfterFreeOnTaskCancellationBeforeBulkSendCall) {
kafka::impl::ProducerConfiguration producer_configuration{};
producer_configuration.delivery_timeout = std::chrono::seconds{2};
producer_configuration.queue_buffering_max = std::chrono::seconds{1};
producer_configuration.queue_buffering_max_messages = 100;

auto producer = MakeProducer("kafka-producer", producer_configuration);
const std::string topic = GenerateTopic();

bool sendThrowsTaskCancelledException = false;

auto send_task = utils::Async("send_task", [&] {
const std::string key = "test-key";
const std::vector<std::string> messages{"test-msg-1", "test-msg-2", "test-msg-3"};

engine::current_task::RequestCancel();

try {
producer.Send(topic, key, messages);
} catch (...) {
sendThrowsTaskCancelledException = true;
throw;
}
});

UEXPECT_THROW(send_task.Get(), engine::TaskCancelledException);
EXPECT_TRUE(sendThrowsTaskCancelledException);
}

UTEST_F(ProducerTest, NoUseAfterFreeOnTaskCancellationAfterBulkSendCall) {
kafka::impl::ProducerConfiguration producer_configuration{};
producer_configuration.delivery_timeout = std::chrono::seconds{2};
producer_configuration.queue_buffering_max = std::chrono::seconds{1};
producer_configuration.queue_buffering_max_messages = 100;

auto producer = MakeProducer("kafka-producer", producer_configuration);
const std::string topic = GenerateTopic();

bool sendThrowsTaskCancelledException = false;

auto send_task = utils::Async("send_task", [&] {
const std::string key = "test-key";
const std::vector<std::string> messages{"test-msg-1", "test-msg-2", "test-msg-3"};

try {
producer.Send(topic, key, messages);
} catch (...) {
sendThrowsTaskCancelledException = true;
throw;
}
});

engine::SleepFor(std::chrono::milliseconds(10));

send_task.RequestCancel();

UEXPECT_THROW(send_task.Get(), engine::TaskCancelledException);
EXPECT_TRUE(sendThrowsTaskCancelledException);
}

USERVER_NAMESPACE_END
7 changes: 3 additions & 4 deletions scripts/kafka/ubuntu_install_kafka.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,11 @@
# Exit on any error and treat unset variables as errors, print all commands
set -o errexit -o nounset -o pipefail -o posix -x

KAFKA_VERSION=4.0.1
KAFKA_VERSION=4.3.1

@ArkadyRudenko ArkadyRudenko Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you increas it?

@disaykin disaykin Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Старая ссылка для установки кафки больше не работает. Заменил на ссылку для скачивания с их официального сайта

@disaykin disaykin Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Предлагаете оформить это отдельным запросом на влитие? Или претензия именно к изменению версии? Старая версия у меня вроде бы не захотела скачиваться по новой ссылке...

@ArkadyRudenko ArkadyRudenko Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Если у них на сайте теперь написано, что надо так, то окей

@disaykin disaykin Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

тогда предлагаю считать, что все сделано правильно

KAFKA_HOME=/etc/kafka
KAFKA_URL="https://www.apache.org/dyn/closer.lua/kafka/${KAFKA_VERSION}/kafka_2.13-${KAFKA_VERSION}.tgz?action=download"

DEBIAN_FRONTEND=noninteractive sudo apt install -y openjdk-17-jdk

curl "https://dlcdn.apache.org/kafka/$KAFKA_VERSION/kafka_2.13-$KAFKA_VERSION.tgz" -o kafka.tgz
mkdir -p "$KAFKA_HOME"
tar -xzf kafka.tgz --directory="$KAFKA_HOME" --strip-components=1
rm kafka.tgz
curl -fsSL "$KAFKA_URL" | tar -xzf - --directory="$KAFKA_HOME" --strip-components=1
Loading