heap-use-after-free in a PQ tablet (#30257)

Alek5andr-Kotov · web-flow · commit 25029c1058de · 2025-12-06T11:23:11.000Z
diff --git a/ydb/core/persqueue/pqtablet/pq_impl.cpp b/ydb/core/persqueue/pqtablet/pq_impl.cpp
@@ -5217,8 +5217,10 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr
         PQ_LOG_TX_D("Already deleting WriteInfo");
         return;
     }
+    writeInfo.Deleting = true;
     if (writeInfo.Partitions.empty()) {
         TryDeleteWriteId(writeId, writeInfo, ActorContext());
+        TxWritesChanged = true;
     } else {
         for (auto& [_, partitionId] : writeInfo.Partitions) {
             PQ_ENSURE(Partitions.contains(partitionId));
@@ -5227,7 +5229,6 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr
             Send(partition.Actor, new TEvPQ::TEvDeletePartition);
         }
     }
-    writeInfo.Deleting = true;
 }
 
 void TPersQueue::BeginDeletePartitions(const TDistributedTransaction& tx)

Original file line number	Diff line number	Diff line change
`@@ -5217,8 +5217,10 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr`
`5217`	`5217`	`PQ_LOG_TX_D("Already deleting WriteInfo");`
`5218`	`5218`	`return;`
`5219`	`5219`	`}`
	`5220`	`+ writeInfo.Deleting = true;`
`5220`	`5221`	`if (writeInfo.Partitions.empty()) {`
`5221`	`5222`	`TryDeleteWriteId(writeId, writeInfo, ActorContext());`
	`5223`	`+ TxWritesChanged = true;`
`5222`	`5224`	`} else {`
`5223`	`5225`	`for (auto& [_, partitionId] : writeInfo.Partitions) {`
`5224`	`5226`	`PQ_ENSURE(Partitions.contains(partitionId));`
`@@ -5227,7 +5229,6 @@ void TPersQueue::BeginDeletePartitions(const TWriteId& writeId, TTxWriteInfo& wr`
`5227`	`5229`	`Send(partition.Actor, new TEvPQ::TEvDeletePartition);`
`5228`	`5230`	`}`
`5229`	`5231`	`}`
`5230`		`- writeInfo.Deleting = true;`
`5231`	`5232`	`}`
`5232`	`5233`
`5233`	`5234`	`void TPersQueue::BeginDeletePartitions(const TDistributedTransaction& tx)`