You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "Sudheer Vinukonda (JIRA)" <ji...@apache.org> on 2015/12/16 18:26:46 UTC
[jira] [Updated] (TS-3949) Ignore timeout event on PluginVC after
it's already closed.
[ https://issues.apache.org/jira/browse/TS-3949?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Sudheer Vinukonda updated TS-3949:
----------------------------------
Fix Version/s: (was: 6.1.0)
6.2.0
> Ignore timeout event on PluginVC after it's already closed.
> -----------------------------------------------------------
>
> Key: TS-3949
> URL: https://issues.apache.org/jira/browse/TS-3949
> Project: Traffic Server
> Issue Type: Bug
> Components: Core, Plugins
> Reporter: Sudheer Vinukonda
> Assignee: Sudheer Vinukonda
> Fix For: 6.2.0
>
>
> When a plugin sets TS_EVENT_VCONN_ACTIVE_TIMEOUT on Plugin VC, it looks like, in some race conditions, the active timer event could still get fired after the Plugin VC is already closed, leading *INKContInternal::handle_event* to assert a use-after-free.
> Note: The plugin VC's process_close does cancel the active timeout event, so, this doesn't happen every time. It might happen in some race conditions or when the timeout and close are on different threads (?)..
> Below's the fatal log and gdb info of the assert for the timeout event after a close.
> {code}
> Sep 26 21:54:54 my_dev_host traffic_server[20653]: FATAL: InkAPI.cc:990: failed assert `!"Plugin tries to use a continuation which is deleted"`
> gdb stack trace:
> Core was generated by `/home/y/bin/traffic_server -M --httpport 80:fd=8,443:fd=9:ssl'.
> Program terminated with signal 6, Aborted.
> #0 0x00000038fb432625 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> 64 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
> (gdb) bt
> #0 0x00000038fb432625 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #1 0x00000038fb433e05 in abort () at abort.c:92
> #2 0x00002ad27ce81018 in ink_die_die_die (retval=1) at ink_error.cc:43
> #3 0x00002ad27ce810e5 in ink_fatal_va(int, const char *, typedef __va_list_tag __va_list_tag *) (return_code=1, message_format=0x2ad27ce8fd78 "%s:%d: failed assert `%s`", ap=0x2ad27f7159f0)
> at ink_error.cc:65
> #4 0x00002ad27ce811ae in ink_fatal (return_code=1, message_format=0x2ad27ce8fd78 "%s:%d: failed assert `%s`") at ink_error.cc:73
> #5 0x00002ad27ce7fd20 in _ink_assert (expression=0x770ba0 "!\"Plugin tries to use a continuation which is deleted\"", file=0x770b3d "InkAPI.cc", line=990) at ink_assert.cc:37
> #6 0x000000000050d6bc in INKContInternal::handle_event (this=0x2ad37b27e500, event=106, edata=0x2ad3d0000ad0) at InkAPI.cc:990
> #7 0x00000000004f8d4c in Continuation::handleEvent (this=0x2ad37b27e500, event=106, data=0x2ad3d0000ad0) at ../iocore/eventsystem/I_Continuation.h:146
> #8 0x000000000053478b in PluginVC::process_timeout (this=0x2ad3d00009d0, e=0x2ad360081ef0, event_to_send=106, our_eptr=0x2ad3d0000b88) at PluginVC.cc:762
> #9 0x00000000005327b1 in PluginVC::main_handler (this=0x2ad3d00009d0, event=2, data=0x2ad360081ef0) at PluginVC.cc:193
> #10 0x00000000004f8d4c in Continuation::handleEvent (this=0x2ad3d00009d0, event=2, data=0x2ad360081ef0) at ../iocore/eventsystem/I_Continuation.h:146
> #11 0x000000000076080a in EThread::process_event (this=0x2ad27eb0b010, e=0x2ad360081ef0, calling_code=2) at UnixEThread.cc:145
> #12 0x0000000000760b25 in EThread::execute (this=0x2ad27eb0b010) at UnixEThread.cc:224
> #13 0x000000000075fd7c in spawn_thread_internal (a=0x2fc9f80) at Thread.cc:88
> #14 0x00002ad27d4009d1 in start_thread (arg=0x2ad27f716700) at pthread_create.c:301
> #15 0x00000038fb4e88fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
> (gdb) bt
> #0 0x00000038fb432625 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #1 0x00000038fb433e05 in abort () at abort.c:92
> #2 0x00002ad27ce81018 in ink_die_die_die (retval=1) at ink_error.cc:43
> #3 0x00002ad27ce810e5 in ink_fatal_va(int, const char *, typedef __va_list_tag __va_list_tag *) (return_code=1, message_format=0x2ad27ce8fd78 "%s:%d: failed assert `%s`", ap=0x2ad27f7159f0)
> at ink_error.cc:65
> #4 0x00002ad27ce811ae in ink_fatal (return_code=1, message_format=0x2ad27ce8fd78 "%s:%d: failed assert `%s`") at ink_error.cc:73
> #5 0x00002ad27ce7fd20 in _ink_assert (expression=0x770ba0 "!\"Plugin tries to use a continuation which is deleted\"", file=0x770b3d "InkAPI.cc", line=990) at ink_assert.cc:37
> #6 0x000000000050d6bc in INKContInternal::handle_event (this=0x2ad37b27e500, event=106, edata=0x2ad3d0000ad0) at InkAPI.cc:990
> #7 0x00000000004f8d4c in Continuation::handleEvent (this=0x2ad37b27e500, event=106, data=0x2ad3d0000ad0) at ../iocore/eventsystem/I_Continuation.h:146
> #8 0x000000000053478b in PluginVC::process_timeout (this=0x2ad3d00009d0, e=0x2ad360081ef0, event_to_send=106, our_eptr=0x2ad3d0000b88) at PluginVC.cc:762
> #9 0x00000000005327b1 in PluginVC::main_handler (this=0x2ad3d00009d0, event=2, data=0x2ad360081ef0) at PluginVC.cc:193
> #10 0x00000000004f8d4c in Continuation::handleEvent (this=0x2ad3d00009d0, event=2, data=0x2ad360081ef0) at ../iocore/eventsystem/I_Continuation.h:146
> #11 0x000000000076080a in EThread::process_event (this=0x2ad27eb0b010, e=0x2ad360081ef0, calling_code=2) at UnixEThread.cc:145
> #12 0x0000000000760b25 in EThread::execute (this=0x2ad27eb0b010) at UnixEThread.cc:224
> #13 0x000000000075fd7c in spawn_thread_internal (a=0x2fc9f80) at Thread.cc:88
> #14 0x00002ad27d4009d1 in start_thread (arg=0x2ad27f716700) at pthread_create.c:301
> #15 0x00000038fb4e88fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
> (gdb) f
> #6 0x000000000050d6bc in INKContInternal::handle_event (this=0x2ad37b27e500, event=106, edata=0x2ad3d0000ad0) at InkAPI.cc:990
> 990 in InkAPI.cc
> (gdb) p *this
> $5 = {<DummyVConnection> = {<VConnection> = {<Continuation> = {<force_VFPT_to_top> = {_vptr.force_VFPT_to_top = 0x2ad36b9a1190}, handler = (int (Continuation::*)(Continuation *, int,
> void *)) 0x50d686 <INKContInternal::handle_event(int, void*)>, mutex = {m_ptr = 0x0}, link = {<SLink<Continuation>> = {next = 0x0}, prev = 0x0}}, lerrno = 0}, <No data fields>},
> mdata = 0x2ad72815ed20, m_event_func = 0x2ad356aa9843 <send_response_handler(TSCont, TSEvent, void*)>, m_event_count = 0, m_closed = 1, m_deletable = 1, m_deleted = 1,
> m_free_magic = INKCONT_INTERN_MAGIC_DEAD}
> (gdb)
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)