Repository navigation
Unlink the RPC from waiting_for_bufs in homa_rpc_alloc_server errors - #135
Open
Stuartwastaken wants to merge 1 commit into
Open
Stuartwastaken wants to merge 1 commit into
Stuartwastaken wants to merge 1 commit into
Conversation
* When the pool is full, homa_pool_alloc_msg queues the new RPC on waiting_for_bufs and returns 0. If the socket is then found to be shut down, the error path freed the RPC while it was still on the list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the receive pool is full, homa_pool_alloc_msg puts a new server RPC on waiting_for_bufs and returns 0. If homa_rpc_alloc_server then finds the socket shut down, its error path calls homa_pool_release, which doesn't touch buf_links, and kfrees the RPC while it is still on the list. Later list operations on waiting_for_bufs read and write the freed RPC: homa_pool_check_waiting when buffers free up during reaping, and homa_pool_unlink on its neighbours at shutdown. It needs a full pool plus a close() racing with an arriving request, which a restart of a busy server can hit.
This calls homa_pool_unlink on the error path; the bucket lock is held there, and since 5fbfc52 homa_pool_unlink takes the pool lock and returns early if the RPC isn't queued. The new homa_rpc_alloc_server__socket_shutdown_while_waiting_for_bufs test fills the pool and shuts the socket down: without the fix AddressSanitizer reports a heap-use-after-free on the freed RPC (freed at homa_rpc.c:221), and with it all 885 unit tests and the smoke tests pass.