bryancall commented on code in PR #13844:
URL: https://github.com/apache/trafficserver/pull/13844#discussion_r4301707001
##########
src/iocore/net/SSLSecret.cc:
##########
@@ -34,6 +35,12 @@ namespace
DbgCtl dbg_ctl_ssl_secret{"ssl_secret"};
DbgCtl dbg_ctl_ssl_secret_err{"ssl_secret_err"};
+// Parallel ssl_multicert loading reaches loadSecret() from several
std::threads
+// at once. Those are not EThreads, so a hook continuation's mutex does not
+// exclude them, and plugins written for one call at a time corrupt their own
+// state. This lock keeps the SSL_SECRET hooks to one caller at a time.
+std::mutex secret_hook_mutex;
Review Comment:
Good catch, and your trace matches what I found. tls_secret_update_default
hung at the serial reload on every run with this lock. dc9f9e56be switches to a
recursive mutex, so the thread already inside the hook can re-enter while other
loader threads still wait their turn. cda47decfb adds a unit test whose hook
calls getOrLoadSecret() from inside the hook. It fails with the plain mutex and
passes with the recursive one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
