RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-25 06:02:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON

Browse Source 
A recent fix was introduced to ensure unsent data are deleted when a
QUIC MUX stream releases its qc_stream_desc instance. This is necessary
to ensure all used buffers will be liberated once all ACKs are received.
This is implemented by the following patch :

  commit ad6b13d317 (quic-dev/qns)
  BUG/MEDIUM: quic: remove unsent data from qc_stream_desc buf

Before this patch, buffer removal was done only on ACK reception. ACK
handling is only done in order from the oldest one. A BUG_ON() statement
is present to ensure this assertion remains valid.

This is however not true anymore since the above patch. Indeed, after
unsent data removal, the current buffer may be empty if it did not
contain yet any sent data. In this case, it is not the oldest buffer,
thus the BUG_ON() statement will be triggered.

To fix this, simply remove this BUG_ON() statement. It should not have
any impact as it is safe to remove buffers in any order.

Note that several conditions must be met to trigger this BUG_ON crash :
* a QUIC MUX stream is destroyed before transmitting all of its data
* several buffers must have been previously allocated for this stream so
  it happens only for transfers bigger than bufsize
* latency should be high enough to delay ACK reception

This must be backported wherever the above patch is (currently targetted
to 2.6).
This commit is contained in:
Amaury Denoyelle 2024-01-29 09:18:08 +01:00
parent 7d22c4956c
commit a13989f109
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/quic_stream.c
View File

@ -24,11 +24,10 @@ static void qc_stream_buf_free(struct qc_stream_desc *stream,
struct buffer *buf = &(*stream_buf)->buf;
LIST_DEL_INIT(&(*stream_buf)->list);
if (*stream_buf == stream->buf) {
/* current buf must always be last entry in buflist */
BUG_ON(!LIST_ISEMPTY(&stream->buf_list));
/* Reset current buf ptr if deleted instance is the same one. */
if (*stream_buf == stream->buf)
stream->buf = NULL;
}
b_free(buf);
offer_buffers(NULL, 1);