trafficserver-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From jplev...@apache.org
Subject svn commit: r1095424 - in /trafficserver/traffic/trunk: iocore/net/UnixNet.cc iocore/net/UnixNetAccept.cc iocore/net/UnixNetVConnection.cc lib/ts/ink_queue.cc
Date Wed, 20 Apr 2011 14:42:26 GMT
Author: jplevyak
Date: Wed Apr 20 14:42:25 2011
New Revision: 1095424

URL: http://svn.apache.org/viewvc?rev=1095424&view=rev
Log:
TS-716: bug where NetVC could be double free'd.

Modified:
    trafficserver/traffic/trunk/iocore/net/UnixNet.cc
    trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc
    trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc
    trafficserver/traffic/trunk/lib/ts/ink_queue.cc

Modified: trafficserver/traffic/trunk/iocore/net/UnixNet.cc
URL: http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNet.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNet.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNet.cc Wed Apr 20 14:42:25 2011
@@ -389,10 +389,8 @@ NetHandler::mainNetEvent(int event, Even
   pd->result = 0;
 
 #if defined(USE_EDGE_TRIGGER)
-  UnixNetVConnection *next_vc = NULL;
-  vc = read_ready_list.head;
-  while (vc) {
-    next_vc = vc->read.ready_link.next;
+ // UnixNetVConnection *
+  while ((vc = read_ready_list.dequeue())) {
     if (vc->closed)
       close_UnixNetVConnection(vc, trigger_event->ethread);
     else if (vc->read.enabled && vc->read.triggered)
@@ -407,12 +405,8 @@ NetHandler::mainNetEvent(int event, Even
       }
 #endif
     }
-    vc = next_vc;
   }
-  next_vc = NULL;
-  vc = write_ready_list.head;
-  while (vc) {
-    next_vc = vc->write.ready_link.next;
+  while ((vc = write_ready_list.dequeue())) {
     if (vc->closed)
       close_UnixNetVConnection(vc, trigger_event->ethread);
     else if (vc->write.enabled && vc->write.triggered)
@@ -427,7 +421,6 @@ NetHandler::mainNetEvent(int event, Even
       }
 #endif
     }
-    vc = next_vc;
   }
 #else /* !USE_EDGE_TRIGGER */
   while ((vc = read_ready_list.dequeue())) {

Modified: trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc
URL: http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNetAccept.cc Wed Apr 20 14:42:25 2011
@@ -524,7 +524,6 @@ NetAccept::acceptFastEvent(int event, vo
   } while (loop);
 
 Ldone:
-
   return EVENT_CONT;
 
 Lerror:

Modified: trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc
URL: http://svn.apache.org/viewvc/trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc (original)
+++ trafficserver/traffic/trunk/iocore/net/UnixNetVConnection.cc Wed Apr 20 14:42:25 2011
@@ -94,6 +94,7 @@ net_activity(UnixNetVConnection *vc, ETh
 void
 close_UnixNetVConnection(UnixNetVConnection *vc, EThread *t)
 {
+  NetHandler *nh = vc->nh;
   vc->cancel_OOB();
   vc->ep.stop();
   vc->con.close();
@@ -111,7 +112,6 @@ close_UnixNetVConnection(UnixNetVConnect
     vc->active_timeout = NULL;
   }
   vc->active_timeout_in = 0;
-  NetHandler *nh = vc->nh;
   nh->open_list.remove(vc);
   nh->read_ready_list.remove(vc);
   nh->write_ready_list.remove(vc);
@@ -673,6 +673,7 @@ UnixNetVConnection::reenable(VIO *vio)
     return;
   EThread *t = vio->mutex->thread_holding;
   ink_debug_assert(t == this_ethread());
+  ink_debug_assert(!closed);
   if (nh->mutex->thread_holding == t) {
     if (vio == &read.vio) {
       ep.modify(EVENTIO_READ);

Modified: trafficserver/traffic/trunk/lib/ts/ink_queue.cc
URL: http://svn.apache.org/viewvc/trafficserver/traffic/trunk/lib/ts/ink_queue.cc?rev=1095424&r1=1095423&r2=1095424&view=diff
==============================================================================
--- trafficserver/traffic/trunk/lib/ts/ink_queue.cc (original)
+++ trafficserver/traffic/trunk/lib/ts/ink_queue.cc Wed Apr 20 14:42:25 2011
@@ -75,6 +75,7 @@ inkcoreapi volatile int64_t fastalloc_me
 #ifdef DEBUG
 #define SANITY
 #define DEADBEEF
+// #define CHECK_DEADBEEF  // broken
 #endif
 
 // #define MEMPROTECT 1
@@ -298,7 +299,9 @@ ink_freelist_new(InkFreeList * f)
       for (i = 0; i < f->chunk_size; i++) {
         char *a = ((char *) FREELIST_POINTER(item)) + i * type_size;
 #ifdef DEADBEEF
-        memset(a, 0xDEADCAFE, type_size);
+        const char str[4] = { (char) 0xde, (char) 0xad, (char) 0xbe, (char) 0xef };
+        for (int j = 0; j < (int)type_size; j++)
+          a[j] = str[j % 4];
 #endif
         ink_freelist_free(f, a);
 #ifdef MEMPROTECT
@@ -402,7 +405,7 @@ ink_freelist_free(InkFreeList * f, void 
   {
     // set string to DEADBEEF
     const char str[4] = { (char) 0xde, (char) 0xad, (char) 0xbe, (char) 0xef };
-
+#ifdef CHECK_DEADBEEF
     // search for DEADBEEF anywhere after a pointer offset in the item
     char *position = (char *) item + sizeof(void *);    // start
     char *end = (char *) item + f->type_size;   // end
@@ -420,9 +423,10 @@ ink_freelist_free(InkFreeList * f, void 
       }
       i = (i + 1) & 0x3;
     }
-
+#endif
     // set the entire item to DEADBEEF
-    memset(item, 0xDEADBEEF, f->type_size);
+    for (int j = 0; j < (int)f->type_size; j++)
+      ((char*)item)[j] = str[j % 4];
   }
 #endif /* DEADBEEF */
 



Mime
View raw message