[Backport stable-25-3-1] PR #30257: heap-use-after-free in a PQ tablet (#30260)

ydbot · web-flow · commit 20ebf5c14c71 · 2025-12-06T19:25:16.000+01:00
diff --git a/ydb/core/persqueue/pqtablet/pq_impl.cpp b/ydb/core/persqueue/pqtablet/pq_impl.cpp
@@ -5204,8 +5204,10 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr
         PQ_LOG_TX_D("Already deleting WriteInfo");
         return;
     }
+    writeInfo.Deleting = true;
     if (writeInfo.Partitions.empty()) {
         TryDeleteWriteId(writeId, writeInfo, ActorContext());
+        TxWritesChanged = true;
     } else {
         for (auto& [_, partitionId] : writeInfo.Partitions) {
             PQ_ENSURE(Partitions.contains(partitionId));
@@ -5214,7 +5216,6 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr
             Send(partition.Actor, new TEvPQ::TEvDeletePartition);
         }
     }
-    writeInfo.Deleting = true;
 }
 
 void TPersQueue::BeginDeletePartitions(const TDistributedTransaction& tx)

Original file line number	Diff line number	Diff line change
`@@ -5204,8 +5204,10 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr`
`5204`	`5204`	`PQ_LOG_TX_D("Already deleting WriteInfo");`
`5205`	`5205`	`return;`
`5206`	`5206`	`}`
	`5207`	`+ writeInfo.Deleting = true;`
`5207`	`5208`	`if (writeInfo.Partitions.empty()) {`
`5208`	`5209`	`TryDeleteWriteId(writeId, writeInfo, ActorContext());`
	`5210`	`+ TxWritesChanged = true;`
`5209`	`5211`	`} else {`
`5210`	`5212`	`for (auto& [_, partitionId] : writeInfo.Partitions) {`
`5211`	`5213`	`PQ_ENSURE(Partitions.contains(partitionId));`
`@@ -5214,7 +5216,6 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr`
`5214`	`5216`	`Send(partition.Actor, new TEvPQ::TEvDeletePartition);`
`5215`	`5217`	`}`
`5216`	`5218`	`}`
`5217`		`- writeInfo.Deleting = true;`
`5218`	`5219`	`}`
`5219`	`5220`
`5220`	`5221`	`void TPersQueue::BeginDeletePartitions(const TDistributedTransaction& tx)`