Author: jplevyak
Date: Wed Apr 20 14:42:25 2011
New Revision: 1095424
URL: http://svn.apache.org/viewvc?rev=1095424&view=rev
Log:
TS-716: bug where NetVC could be double free'd.
Modified:
trafficserver/traffic/trunk/iocore/net/UnixNet.cc
trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc
trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc
trafficserver/traffic/trunk/lib/ts/ink_queue.cc
Modified: trafficserver/traffic/trunk/iocore/net/UnixNet.cc
URL:
http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNet.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNet.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNet.cc Wed Apr 20 14:42:25 2011
@@ -389,10 +389,8 @@ NetHandler::mainNetEvent(int event, Even
pd->result = 0;
#if defined(USE_EDGE_TRIGGER)
- UnixNetVConnection *next_vc = NULL;
- vc = read_ready_list.head;
- while (vc) {
- next_vc = vc->read.ready_link.next;
+ // UnixNetVConnection *
+ while ((vc = read_ready_list.dequeue())) {
if (vc->closed)
close_UnixNetVConnection(vc, trigger_event->ethread);
else if (vc->read.enabled && vc->read.triggered)
@@ -407,12 +405,8 @@ NetHandler::mainNetEvent(int event, Even
}
#endif
}
- vc = next_vc;
}
- next_vc = NULL;
- vc = write_ready_list.head;
- while (vc) {
- next_vc = vc->write.ready_link.next;
+ while ((vc = write_ready_list.dequeue())) {
if (vc->closed)
close_UnixNetVConnection(vc, trigger_event->ethread);
else if (vc->write.enabled && vc->write.triggered)
@@ -427,7 +421,6 @@ NetHandler::mainNetEvent(int event, Even
}
#endif
}
- vc = next_vc;
}
#else /* !USE_EDGE_TRIGGER */
while ((vc = read_ready_list.dequeue())) {
Modified: trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc
URL:
http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc Wed Apr 20 14:42:25
2011
@@ -524,7 +524,6 @@ NetAccept::acceptFastEvent(int event, vo
} while (loop);
Ldone:
-
return EVENT_CONT;
Lerror:
Modified: trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc
URL:
http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc Wed Apr 20
14:42:25 2011
@@ -94,6 +94,7 @@ net_activity(UnixNetVConnection *vc, ETh
void
close_UnixNetVConnection(UnixNetVConnection *vc, EThread *t)
{
+ NetHandler *nh = vc->nh;
vc->cancel_OOB();
vc->ep.stop();
vc->con.close();
@@ -111,7 +112,6 @@ close_UnixNetVConnection(UnixNetVConnect
vc->active_timeout = NULL;
}
vc->active_timeout_in = 0;
- NetHandler *nh = vc->nh;
nh->open_list.remove(vc);
nh->read_ready_list.remove(vc);
nh->write_ready_list.remove(vc);
@@ -673,6 +673,7 @@ UnixNetVConnection::reenable(VIO *vio)
return;
EThread *t = vio->mutex->thread_holding;
ink_debug_assert(t == this_ethread());
+ ink_debug_assert(!closed);
if (nh->mutex->thread_holding == t) {
if (vio == &read.vio) {
ep.modify(EVENTIO_READ);
Modified: trafficserver/traffic/trunk/lib/ts/ink_queue.cc
URL:
http://svn.apache.org/viewvc/trafficserver/traffic/trunk/lib/ts/ink_queue.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/lib/ts/ink_queue.cc (original)
+++ trafficserver/traffic/trunk/lib/ts/ink_queue.cc Wed Apr 20 14:42:25 2011
@@ -75,6 +75,7 @@ inkcoreapi volatile int64_t fastalloc_me
#ifdef DEBUG
#define SANITY
#define DEADBEEF
+// #define CHECK_DEADBEEF // broken
#endif
// #define MEMPROTECT 1
@@ -298,7 +299,9 @@ ink_freelist_new(InkFreeList * f)
for (i = 0; i < f->chunk_size; i++) {
char *a = ((char *) FREELIST_POINTER(item)) + i * type_size;
#ifdef DEADBEEF
- memset(a, 0xDEADCAFE, type_size);
+ const char str[4] = { (char) 0xde, (char) 0xad, (char) 0xbe, (char)
0xef };
+ for (int j = 0; j < (int)type_size; j++)
+ a[j] = str[j % 4];
#endif
ink_freelist_free(f, a);
#ifdef MEMPROTECT
@@ -402,7 +405,7 @@ ink_freelist_free(InkFreeList * f, void
{
// set string to DEADBEEF
const char str[4] = { (char) 0xde, (char) 0xad, (char) 0xbe, (char) 0xef };
-
+#ifdef CHECK_DEADBEEF
// search for DEADBEEF anywhere after a pointer offset in the item
char *position = (char *) item + sizeof(void *); // start
char *end = (char *) item + f->type_size; // end
@@ -420,9 +423,10 @@ ink_freelist_free(InkFreeList * f, void
}
i = (i + 1) & 0x3;
}
-
+#endif
// set the entire item to DEADBEEF
- memset(item, 0xDEADBEEF, f->type_size);
+ for (int j = 0; j < (int)f->type_size; j++)
+ ((char*)item)[j] = str[j % 4];
}
#endif /* DEADBEEF */
