github-actions[bot] commented on code in PR #66810:
URL: https://github.com/apache/doris/pull/66810#discussion_r3824432618
##########
be/src/exec/sink/writer/paimon/jni_paimon_write_backend.cpp:
##########
@@ -234,12 +163,12 @@ Status JniPaimonWriteBackend::close() {
<<
PrettyPrinter::print_bytes(_memory_manager->memory_limit()) << ", peak="
<<
PrettyPrinter::print_bytes(_memory_manager->native_peak_allocated_bytes());
}
- // Paimon may still have asynchronous flush or compaction tasks using
- // MemorySegments backed by these pages. Retain ownership until process
- // exit and reject new writers below. Retention is therefore limited to
- // writers which were already open when the first close failure
occurred.
+ // Paimon may still have asynchronous flush or compaction tasks using
MemorySegments backed
+ // by these pages. Retain this failed writer's ownership until process
exit to prevent UAF,
+ // but keep unrelated Paimon writers available on this BE.
Review Comment:
[P1] Bound retained pools before admitting new writers
A failed Java close moves this manager into a process-lifetime vector
because its pages cannot be reclaimed safely. This PR removes the `open()`
failure fence and explicitly admits later writers, so a repeatable close
failure (including an `IOManager` close failure) can pin another query
`ResourceContext` and that writer's allocated native pages on every subsequent
query, up to the 512 MiB per-writer cap. Since the vector has no aggregate
byte/count bound or reclamation path, sequential failed queries permanently
consume BE memory until service disruption. Please either stop admitting new
Paimon writers after retention begins, or enforce a hard aggregate quarantine
bound with a proven-safe reclamation signal.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
