session svm: fix session migrate attach data corruption

Fifo ooo_deq is used when peeking. Consequently, when migrating a
udp session already scheduled for sending, the owner thread will read
corrupted data. Overload enq/deq rbtrees instead.

Type: fix

Change-Id: I5bf25355f64513911a349e42c056b3a9b6eb3523
Signed-off-by: Florin Coras <[email protected]>

diff --git a/src/plugins/hs_apps/vcl/vcl_test_protos.c b/src/plugins/hs_apps/vcl/vcl_test_protos.c
index fd17c7b..d53c69d 100644 (file)
--- a/src/plugins/hs_apps/vcl/vcl_test_protos.c
+++ b/src/plugins/hs_apps/vcl/vcl_test_protos.c
@@ -196,6 +196,13 @@ vt_udp_accept (int listen_fd, vcl_test_session_t *ts)
   ts->read = vcl_test_read;
   ts->write = vcl_test_write;
 
+  /* Help client sessions migrate if need be */
+  if (!ts->cfg.test_bytes)
+    {
+      char *buf[1];
+      ts->write (ts, buf, 1);
+    }
+
   return 0;
 }
 

diff --git a/src/svm/fifo_types.h b/src/svm/fifo_types.h
index e4b72ea..de642df 100644 (file)
--- a/src/svm/fifo_types.h
+++ b/src/svm/fifo_types.h
@@ -124,15 +124,21 @@ typedef struct _svm_fifo
 #endif
 } svm_fifo_t;
 
-/* To minimize size of svm_fifo_t reuse ooo pointers for tracking chunks and
+/* To minimize size of svm_fifo_t reuse ooo lookup for tracking chunks and
  * hdr at attach/detach. Fifo being migrated should not receive new data */
-#define svm_fifo_chunks_at_attach(f) f->ooo_deq
+#define svm_fifo_chunks_at_attach(f)                                          \
+  ((union {                                                                   \
+    rb_tree_t *tree;                                                          \
+    svm_fifo_chunk_t **chunks;                                                \
+  }){ .tree = &(f)->ooo_enq_lookup })                                         \
+    .chunks[0]
+
 #define svm_fifo_hdr_at_attach(f)                                             \
   ((union {                                                                   \
-     svm_fifo_shared_t *hdr;                                                  \
-     svm_fifo_chunk_t *ooo_enq;                                               \
-   } *) &f->ooo_enq)                                                          \
-    ->hdr
+    rb_tree_t *tree;                                                          \
+    svm_fifo_shared_t **hdr;                                                  \
+  }){ .tree = &(f)->ooo_deq_lookup })                                         \
+    .hdr[0]
 
 typedef struct fifo_segment_slice_
 {

diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 379ae53..6c16551 100644 (file)
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -1138,8 +1138,11 @@ session_tx_fill_buffer (session_worker_t *wrk, session_tx_context_t *ctx,
              offset = hdr->data_length + SESSION_CONN_HDR_LEN;
              svm_fifo_dequeue_drop (f, offset);
              if (ctx->left_to_snd > n_bytes_read)
-               svm_fifo_peek (ctx->s->tx_fifo, 0, sizeof (ctx->hdr),
-                              (u8 *) & ctx->hdr);
+               {
+                 svm_fifo_peek (ctx->s->tx_fifo, 0, sizeof (ctx->hdr),
+                                (u8 *) &ctx->hdr);
+                 ASSERT (hdr->data_length > hdr->data_offset);
+               }
            }
          else if (ctx->left_to_snd == n_bytes_read)
            svm_fifo_overwrite_head (ctx->s->tx_fifo, (u8 *) & ctx->hdr,