mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: mux-quic: fix crash on reload during emission

Browse Source 
MUX QUIC restricts buffer allocation per connection based on the
underlying congestion window. If a QCS instance cannot allocate a new
buffer, it is put in a buf_wait list. Typically, this will cause stream
upper layer to subscribe for sending.

A BUG_ON() was present on snd_buf and nego_ff callback prologue to
ensure that these functions were not called if QCS is already in
buf_wait list. The objective was to guarantee that there is no wake up
on a stream if it cannot allocate a buffer.

However, this BUG_ON() is not correct, as it can be fired legitimely.
Indeed, stream layer can retry emission even if no wake up occured. This
case can happen on reload. Thus, BUG_ON() will cause an unexpected
crash.

Fix this by removing these BUG_ON(). Instead, snd_buf/nego_ff callbacks
ensure that QCS is not subscribed in buf_wait list. If this is the case,
a nul value will be returned, which is sufficient for the stream layer
to pause emission and subscribe if necessary.

Occurences for this crash have been reported on the mailing list. It is
also the subject of github issue #3080, which should be fixed with this
patch.

This must be backported up to 3.0.
This commit is contained in:
Amaury Denoyelle 2025-09-01 15:07:53 +02:00
parent 800ba73a9c
commit dcf2261612
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/mux_quic.c
View File

@ -4054,9 +4054,6 @@ static size_t qmux_strm_snd_buf(struct stconn *sc, struct buffer *buf,
TRACE_ENTER(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
/* Stream must not be woken up if already waiting for conn buffer. */
BUG_ON(LIST_INLIST(&qcs->el_buf));
/* Sending forbidden if QCS is locally closed (FIN or RESET_STREAM sent). */
BUG_ON(qcs_is_close_local(qcs) || (qcs->flags & QC_SF_TO_RESET));
@ -4070,6 +4067,11 @@ static size_t qmux_strm_snd_buf(struct stconn *sc, struct buffer *buf,
goto end;
}
if (LIST_INLIST(&qcs->el_buf)) {
TRACE_DEVEL("leaving on no buf avail", QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
goto end;
}
if (qfctl_sblocked(&qcs->qcc->tx.fc)) {
TRACE_DEVEL("leaving on connection flow control",
QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
@ -4120,9 +4122,6 @@ static size_t qmux_strm_nego_ff(struct stconn *sc, struct buffer *input,
TRACE_ENTER(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
/* Stream must not be woken up if already waiting for conn buffer. */
BUG_ON(LIST_INLIST(&qcs->el_buf));
/* Sending forbidden if QCS is locally closed (FIN or RESET_STREAM sent). */
BUG_ON(qcs_is_close_local(qcs) || (qcs->flags & QC_SF_TO_RESET));
@ -4144,6 +4143,12 @@ static size_t qmux_strm_nego_ff(struct stconn *sc, struct buffer *input,
goto end;
}
if (LIST_INLIST(&qcs->el_buf)) {
TRACE_DEVEL("leaving on no buf avail", QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
qcs->sd->iobuf.flags |= IOBUF_FL_FF_BLOCKED;
goto end;
}
if (qfctl_sblocked(&qcs->qcc->tx.fc)) {
TRACE_DEVEL("leaving on connection flow control", QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
if (!LIST_INLIST(&qcs->el_fctl)) {