Updated Branches: refs/heads/3.0.x 2bdf44fc2 -> 9dde9dc23
TS-1114: crash from access to CacheVC::write_vector without vol lock. Review: jplevyak, zym, zwoop, Backport: briang Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/9dde9dc2 Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/9dde9dc2 Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/9dde9dc2 Branch: refs/heads/3.0.x Commit: 9dde9dc230d8e6ba4ed9af37a2692a09e9a73260 Parents: 2bdf44f Author: Brian Geffon <[email protected]> Authored: Thu Apr 12 15:39:14 2012 -0700 Committer: Brian Geffon <[email protected]> Committed: Thu Apr 12 15:39:14 2012 -0700 ---------------------------------------------------------------------- CHANGES | 3 + STATUS | 5 -- iocore/cache/CacheWrite.cc | 100 ++++++++++++++++++++------------------- 3 files changed, 54 insertions(+), 54 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/9dde9dc2/CHANGES ---------------------------------------------------------------------- diff --git a/CHANGES b/CHANGES index 3f8b17c..b5eb5d2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,7 @@ -*- coding: utf-8 -*- +Changes with Apache Traffic Server 3.0.5 + *) [TS-1114] crash from access to CacheVC::write_vector without vol lock. + Changes with Apache Traffic Server 3.0.4 *) [TS-1154] quick_filter on HEAD does not work Author: weijin http://git-wip-us.apache.org/repos/asf/trafficserver/blob/9dde9dc2/STATUS ---------------------------------------------------------------------- diff --git a/STATUS b/STATUS index 89d67cd..bf69bb0 100644 --- a/STATUS +++ b/STATUS @@ -41,11 +41,6 @@ A list of all bugs open for the next v3.0.4 release can be found at PATCHES ACCEPTED TO BACKPORT FROM TRUNK: - *) crash from access to CacheVC::write_vector without vol lock. - master SHA: f51778f70df68271b5073a1c5fbb8cd384784999 - Jira: https://issues.apache.org/jira/browse/TS-1114 - +1: jplevyak, zym, zwoop - *) race condition UnixNetVConnection::mainEvent() when handling an inactivity timeout master SHA: b1f2e984379d6dc11cb70136ba33d46527a317d3 http://git-wip-us.apache.org/repos/asf/trafficserver/blob/9dde9dc2/iocore/cache/CacheWrite.cc ---------------------------------------------------------------------- diff --git a/iocore/cache/CacheWrite.cc b/iocore/cache/CacheWrite.cc index e0d61ec..975c899 100644 --- a/iocore/cache/CacheWrite.cc +++ b/iocore/cache/CacheWrite.cc @@ -1487,67 +1487,69 @@ CacheVC::openWriteStartDone(int event, Event *e) return EVENT_CONT; set_io_not_in_progress(); } - if (_action.cancelled && (!od || !od->has_multiple_writers())) - goto Lcancel; + { + CACHE_TRY_LOCK(lock, vol->mutex, mutex->thread_holding); + if (!lock) + VC_LOCK_RETRY_EVENT(); - if (event == AIO_EVENT_DONE) { // vector read done - Doc *doc = (Doc *) buf->data(); - if (!io.ok()) { - err = ECACHE_READ_FAIL; - goto Lfailure; - } + if (_action.cancelled && (!od || !od->has_multiple_writers())) + goto Lcancel; - /* INKqa07123. - A directory entry which is nolonger valid may have been overwritten. - We need to start afresh from the beginning by setting last_collision - to NULL. - */ - if (!dir_valid(vol, &dir)) { - DDebug("cache_write", - "OpenReadStartDone: Dir not valid: Write Head: %d, Dir: %d", - offset_to_vol_offset(vol, vol->header->write_pos), dir_offset(&dir)); - last_collision = NULL; - goto Lcollision; + if (event == AIO_EVENT_DONE) { // vector read done + Doc *doc = (Doc *) buf->data(); + if (!io.ok()) { + err = ECACHE_READ_FAIL; + goto Lfailure; } - if (!(doc->first_key == first_key)) - goto Lcollision; - if (doc->magic != DOC_MAGIC) { - err = ECACHE_BAD_META_DATA; - goto Lfailure; - } - if (!doc->hlen) { - err = ECACHE_BAD_META_DATA; - goto Lfailure; - } - ink_assert((((uintptr_t) &doc->hdr()[0]) & HDR_PTR_ALIGNMENT_MASK) == 0); + /* INKqa07123. + A directory entry which is nolonger valid may have been overwritten. + We need to start afresh from the beginning by setting last_collision + to NULL. + */ + if (!dir_valid(vol, &dir)) { + DDebug("cache_write", + "OpenReadStartDone: Dir not valid: Write Head: %lld, Dir: %"PRId64, + (long long)offset_to_vol_offset(vol, vol->header->write_pos), dir_offset(&dir)); + last_collision = NULL; + goto Lcollision; + } + if (!(doc->first_key == first_key)) + goto Lcollision; + if (doc->magic != DOC_MAGIC) { + err = ECACHE_BAD_META_DATA; + goto Lfailure; + } + if (!doc->hlen) { + err = ECACHE_BAD_META_DATA; + goto Lfailure; + } + ink_assert((((uintptr_t) &doc->hdr()[0]) & HDR_PTR_ALIGNMENT_MASK) == 0); - if (write_vector->get_handles(doc->hdr(), doc->hlen, buf) != doc->hlen) { - err = ECACHE_BAD_META_DATA; - goto Lfailure; - } - ink_debug_assert(write_vector->count() > 0); - od->first_dir = dir; - first_dir = dir; - if (doc->single_fragment()) { - // fragment is tied to the vector - od->move_resident_alt = 1; - od->single_doc_key = doc->key; - dir_assign(&od->single_doc_dir, &dir); - dir_set_tag(&od->single_doc_dir, od->single_doc_key.word(2)); + if (write_vector->get_handles(doc->hdr(), doc->hlen, buf) != doc->hlen) { + err = ECACHE_BAD_META_DATA; + goto Lfailure; + } + ink_debug_assert(write_vector->count() > 0); + od->first_dir = dir; + first_dir = dir; + if (doc->single_fragment()) { + // fragment is tied to the vector + od->move_resident_alt = 1; + od->single_doc_key = doc->key; + dir_assign(&od->single_doc_dir, &dir); + dir_set_tag(&od->single_doc_dir, od->single_doc_key.word(2)); + } } first_buf = buf; goto Lsuccess; - } + Lcollision: - { + int if_writers = ((uintptr_t) info == CACHE_ALLOW_MULTIPLE_WRITES); - CACHE_TRY_LOCK(lock, vol->mutex, mutex->thread_holding); - if (!lock) - VC_LOCK_RETRY_EVENT(); if (!od) { if ((err = vol->open_write( - this, if_writers, cache_config_http_max_alts > 1 ? cache_config_http_max_alts : 0)) > 0) + this, if_writers, cache_config_http_max_alts > 1 ? cache_config_http_max_alts : 0)) > 0) goto Lfailure; if (od->has_multiple_writers()) { MUTEX_RELEASE(lock);
