I think this should be Fix Version 4.2.0 with a back port suggestion for v4.1.3
> On Jan 15, 2014, at 3:48 PM, "Brian Geffon (JIRA)" <[email protected]> wrote: > > > [ > https://issues.apache.org/jira/browse/TS-2497?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel > ] > > Brian Geffon updated TS-2497: > ----------------------------- > > Fix Version/s: 4.1.3 > >> Failed post results in tunnel buffers being returned to freelist prematurely >> ---------------------------------------------------------------------------- >> >> Key: TS-2497 >> URL: https://issues.apache.org/jira/browse/TS-2497 >> Project: Traffic Server >> Issue Type: Bug >> Components: Core >> Reporter: Brian Geffon >> Assignee: Brian Geffon >> Fix For: 4.1.3 >> >> >> When a post fails to an origin server either the server died or the server >> returned a response without reading all of the post data, in either case, TS >> will destroy buffers too early. This normally does not result in a crash >> because the MIOBuffers are returned to the freelist and only with sufficient >> load will the race happen causing a crash. Additionally, even if a crash >> doesn't happen you might have data corruption across post requests from the >> buffers being used after being returned to the freelist. >> Thanks to Thomas Jackson for help reproducing and resolving this bug. >> An example stack trace, while we've seen other crashes in write_avail too. >> #0 0x00000000004eff14 in IOBufferBlock::read_avail (this=0x0) at >> ../iocore/eventsystem/I_IOBuffer.h:362 >> #1 0x000000000050d151 in MIOBuffer::append_block_internal >> (this=0x2aab38001130, b=0x2aab0c037200) at >> ../iocore/eventsystem/P_IOBuffer.h:946 >> #2 0x000000000050d39b in MIOBuffer::append_block (this=0x2aab38001130, >> asize_index=15) at ../iocore/eventsystem/P_IOBuffer.h:986 >> #3 0x000000000050d49b in MIOBuffer::add_block (this=0x2aab38001130) at >> ../iocore/eventsystem/P_IOBuffer.h:994 >> #4 0x000000000055cee2 in MIOBuffer::check_add_block (this=0x2aab38001130) >> at ../iocore/eventsystem/P_IOBuffer.h:1002 >> #5 0x000000000055d115 in MIOBuffer::write_avail (this=0x2aab38001130) at >> ../iocore/eventsystem/P_IOBuffer.h:1048 >> #6 0x00000000006c18f3 in read_from_net (nh=0x2aaafca0d208, >> vc=0x2aab1c009140, thread=0x2aaafca0a010) at UnixNetVConnection.cc:234 >> #7 0x00000000006c37bf in UnixNetVConnection::net_read_io >> (this=0x2aab1c009140, nh=0x2aaafca0d208, lthread=0x2aaafca0a010) at >> UnixNetVConnection.cc:816 >> #8 0x00000000006be392 in NetHandler::mainNetEvent (this=0x2aaafca0d208, >> event=5, e=0x271d8e0) at UnixNet.cc:380 >> #9 0x00000000004f05c4 in Continuation::handleEvent (this=0x2aaafca0d208, >> event=5, data=0x271d8e0) at ../iocore/eventsystem/I_Continuation.h:146 >> #10 0x00000000006e361e in EThread::process_event (this=0x2aaafca0a010, >> e=0x271d8e0, calling_code=5) at UnixEThread.cc:142 >> #11 0x00000000006e3b13 in EThread::execute (this=0x2aaafca0a010) at >> UnixEThread.cc:264 >> #12 0x00000000006e290b in spawn_thread_internal (a=0x2716400) at Thread.cc:88 >> #13 0x0000003372c077e1 in start_thread () from /lib64/libpthread.so.0 >> #14 0x00000033728e68ed in clone () from /lib64/libc.so.6 > > > > -- > This message was sent by Atlassian JIRA > (v6.1.5#6160)
