bug: SessionContext.close() / DataFrame.close() race with concurrent JNI calls (use-after-free)

Offen

#40 erstellt am 13.5.2026 1 Kommentar 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

@andygrove arbeitet bereits daran.

Seit 06.8.2026.

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

bug

Describe the bug

SessionContext and DataFrame hold their native pointer in a plain
long nativeHandle. Every public method follows the pattern:

if (nativeHandle == 0) throw new IllegalStateException(...);
someNativeCall(nativeHandle, ...);

…and close() does:

if (nativeHandle != 0) {
    closeSessionContext(nativeHandle);
    nativeHandle = 0;
}

If thread A is mid-method on a context and thread B calls close() on
the same context, the read in A and the write+free in B race:

A reads nativeHandle (non-zero), passes it to JNI.
B sets nativeHandle = 0 and the Rust side drops the Box.
A's JNI call dereferences a freed *const SessionContext → UAF.

Even the nativeHandle == 0 guard is not safe — it's a TOCTOU. The
same shape applies to DataFrame (each method reads nativeHandle,
then calls JNI).

To Reproduce

No reproducer exists yet. A two-thread test running a tight loop of
ctx.sql(...).count() against ctx.close() on an ASan-instrumented
native build would surface it deterministically; can write one if the
maintainers want to see it first.

Expected behavior

One of:

Document the UB explicitly. Today the Javadoc says contexts are
"not thread-safe" and warns about concurrent sql / register* /
close, but the consequence ("can produce a use-after-free") is
already spelled out — so it's arguably already expected, and this
issue is just a tracking marker so a future maintainer doesn't get
surprised.
Atomic handle + reference count. Use AtomicLong for the
handle and reference-count on the Rust side so close() defers until
in-flight calls drain. Closer to what JNA-style bindings do.
Per-instance lock. Wrap every JNI call in a synchronized
block. Simplest, but kills any potential concurrency on independent
read-only operations.

Additional context

Not a regression — the documented contract already excludes concurrent
use. Filing for visibility ahead of the first multi-threaded user (a
server, a Flink/Spark integration, etc.) hitting it in production
rather than dev. Cross-references SessionContext.java and
DataFrame.java; same shape will need attention any time a new
long-lived handle is added.

Vorherrschende Sprache: Java
Sterne: 32
Forks: 12
PR-Merge-Kennzahlen: Keine gemergten PRs in 30 T.

Beitragsleitfaden

Beitragsleitfaden öffnen

Erste Schritte

Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
Forken Sie das Repository und arbeiten Sie in einem Branch.
Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus apache/datafusion-java

Support pluggable AWS credentials for the S3 object store (credentials provider callback) Offen

Schwierigkeit 5/5 Über eine Woche Anfängerfreundlichkeit 35/100

apache/datafusion-java#116 · Erstellt am 26.8.2026
Spark DataSource backed by a DataFusion TableProvider over ADBC Offen

Schwierigkeit 5/5 Über eine Woche Anfängerfreundlichkeit 25/100

apache/datafusion-java#112 · Erstellt am 30.6.2026
feat(dataframe): expose the executed physical plan with per-operator metrics Offen

enhancement

Schwierigkeit 5/5 Über eine Woche Anfängerfreundlichkeit 42/100

apache/datafusion-java#96 · Erstellt am 26.5.2026
feat(table): expose `registerStreamingTable` for push-mode batch ingest Offen

enhancement

Schwierigkeit 5/5 Über eine Woche Anfängerfreundlichkeit 38/100

apache/datafusion-java#95 · Erstellt am 26.5.2026
Create first release Offen

enhancement

Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 35/100

apache/datafusion-java#86 · 3 Kommentare · Erstellt am 25.5.2026

Alle Issues in apache/datafusion-java