Skip to content

[Bug] Fix TOCTOU race condition and unsafe lazy init in CacheItem.initConfigGrayIfEmpty()#14934

Open
LiyunZhang10 wants to merge 1 commit intoalibaba:developfrom
LiyunZhang10:fix-cacheitem-toctou-race-condition
Open

[Bug] Fix TOCTOU race condition and unsafe lazy init in CacheItem.initConfigGrayIfEmpty()#14934
LiyunZhang10 wants to merge 1 commit intoalibaba:developfrom
LiyunZhang10:fix-cacheitem-toctou-race-condition

Conversation

@LiyunZhang10
Copy link
Copy Markdown
Contributor

Issue Description

In CacheItem.java, configCacheGray was lazily initialized using a non-thread-safe HashMap and without synchronization (missing Double-Checked Locking). When multiple threads call initConfigGrayIfEmpty(grayName) concurrently, multiple HashMaps could be created, overwriting each other and causing memory leak and data loss.

Additionally, the method used a check-then-act pattern (containsKey + put) which is not atomic. In high-concurrency gray release configurations, this could lead to multiple createConfigCacheGray() executions for the same grayName, and throwing ConcurrentModificationException due to the non-thread-safe HashMap implementation.

Proposed Changes

  • Added Double-Checked Locking (DCL) around the lazy initialization of configCacheGray (which is already volatile).
  • Changed configCacheGray's underlying implementation from HashMap to ConcurrentHashMap to ensure thread safety during concurrent structural modifications.
  • Replaced the containsKey + put pattern with computeIfAbsent() to guarantee that ConfigCacheFactoryDelegate.createConfigCacheGray() is executed exactly once per grayName, effectively eliminating the TOCTOU hazard and preventing corrupted pointers that could lead to NPE in the routing layer.

General Checklist

  • Logic change explained clearly
  • No changes to public API surface
  • No additional dependencies introduced

@github-actions
Copy link
Copy Markdown

Thanks for your this PR. 🙏
Please check again for your PR changes whether contains any usage/api/configuration change such as Add new API , Add new configuration, Change default value of configuration.
If so, please add or update documents(markdown type) in docs/next/ for repository nacos-group/nacos-group.github.io


感谢您提交的PR。 🙏
请再次查看您的PR内容,确认是否包含任何使用方式/API/配置参数的变更,如:新增API新增配置参数修改默认配置等操作。
如果是,请确保在提交之前,在仓库nacos-group/nacos-group.github.io中的docs/next/目录下添加或更新文档(markdown格式)。

@LiyunZhang10 LiyunZhang10 force-pushed the fix-cacheitem-toctou-race-condition branch from e5913a3 to cedbe4d Compare April 16, 2026 02:30
@codecov-commenter
Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
...m/alibaba/nacos/config/server/model/CacheItem.java 83.33% 0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants