Set nullptr to ua_session after it is destoryed #1455
Conversation
|
We need to backport this to 7.1.x ( I'll send another PR after we verified this works well) |
|
FreeBSD build successful! See https://ci.trafficserver.apache.org/job/freebsd-github/1559/ for details. |
|
Linux build successful! See https://ci.trafficserver.apache.org/job/linux-github/1454/ for details. |
|
clang-analyzer build successful! See https://ci.trafficserver.apache.org/job/clang-analyzer-github/124/ for details. |
masaori335
force-pushed
the
fix_h2_bad_access
branch
from
16d3672
to
c0fbc4b
Compare
|
FreeBSD build successful! See https://ci.trafficserver.apache.org/job/freebsd-github/1561/ for details. |
|
Linux build successful! See https://ci.trafficserver.apache.org/job/linux-github/1455/ for details. |
Issue: Crash by EXC_BAD_ACCESS in Http2ConnectionState::release_stream() under heavy load Cause: While total_connections_in is larger than max_connections_per_thread_in (in NetHandler::manage_keep_alive_queue()), Http2ConnectionState::release_stream() is called recurcively from add_to_keep_alive_queue(). At the bottom of recursion, ua_session is destroyed and Http2ConnectionState::release_stream() access to it. Fix: 1. Set nullptr to ua_session after it is destoryed 2. Swap calls of add_to_keep_alive_queue() and cancel_active_timeout() for ua_session nullptr check 3. Check m_active of ua_session to reduce recursion
masaori335
force-pushed
the
fix_h2_bad_access
branch
from
c0fbc4b
to
a8c389f
Compare
|
clang-analyzer build successful! See https://ci.trafficserver.apache.org/job/clang-analyzer-github/126/ for details. |
|
FreeBSD build successful! See https://ci.trafficserver.apache.org/job/freebsd-github/1562/ for details. |
|
Linux build successful! See https://ci.trafficserver.apache.org/job/linux-github/1456/ for details. |
|
clang-analyzer build successful! See https://ci.trafficserver.apache.org/job/clang-analyzer-github/127/ for details. |
|
I cherry-picked this to 7.1.x, so no need to make an additional PR. |
Issue:
Crash by EXC_BAD_ACCESS in Http2ConnectionState::release_stream() under heavy load
Cause:
While total_connections_in is larger than max_connections_per_thread_in (in NetHandler::manage_keep_alive_queue()),
Http2ConnectionState::release_stream() is called recurcively from add_to_keep_alive_queue().
At the bottom of recursion, ua_session is destroyed and Http2ConnectionState::release_stream() access to it.
Fix: