From: Florin Coras <fcoras@cisco.com>
Date: Fri, 19 Sep 2025 07:38:39 +0000 (-0400)
Subject: session svm: fix session migrate attach data corruption
X-Git-Tag: v26.02-rc0~8
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=refs%2Fchanges%2F23%2F43723%2F5;p=vpp.git

session svm: fix session migrate attach data corruption

Fifo ooo_deq is used when peeking. Consequently, when migrating a
udp session already scheduled for sending, the owner thread will read
corrupted data. Overload enq/deq rbtrees instead.

Type: fix

Change-Id: I5bf25355f64513911a349e42c056b3a9b6eb3523
Signed-off-by: Florin Coras <fcoras@cisco.com>
---

diff --git a/src/plugins/hs_apps/vcl/vcl_test_protos.c b/src/plugins/hs_apps/vcl/vcl_test_protos.c
index fd17c7b2c54..d53c69d7ff5 100644
--- a/src/plugins/hs_apps/vcl/vcl_test_protos.c
+++ b/src/plugins/hs_apps/vcl/vcl_test_protos.c
@@ -196,6 +196,13 @@ vt_udp_accept (int listen_fd, vcl_test_session_t *ts)
   ts->read = vcl_test_read;
   ts->write = vcl_test_write;
 
+  /* Help client sessions migrate if need be */
+  if (!ts->cfg.test_bytes)
+    {
+      char *buf[1];
+      ts->write (ts, buf, 1);
+    }
+
   return 0;
 }
 
diff --git a/src/svm/fifo_types.h b/src/svm/fifo_types.h
index e4b72eaf1ab..de642dfd19a 100644
--- a/src/svm/fifo_types.h
+++ b/src/svm/fifo_types.h
@@ -124,15 +124,21 @@ typedef struct _svm_fifo
 #endif
 } svm_fifo_t;
 
-/* To minimize size of svm_fifo_t reuse ooo pointers for tracking chunks and
+/* To minimize size of svm_fifo_t reuse ooo lookup for tracking chunks and
  * hdr at attach/detach. Fifo being migrated should not receive new data */
-#define svm_fifo_chunks_at_attach(f) f->ooo_deq
+#define svm_fifo_chunks_at_attach(f)                                          \
+  ((union {                                                                   \
+    rb_tree_t *tree;                                                          \
+    svm_fifo_chunk_t **chunks;                                                \
+  }){ .tree = &(f)->ooo_enq_lookup })                                         \
+    .chunks[0]
+
 #define svm_fifo_hdr_at_attach(f)                                             \
   ((union {                                                                   \
-     svm_fifo_shared_t *hdr;                                                  \
-     svm_fifo_chunk_t *ooo_enq;                                               \
-   } *) &f->ooo_enq)                                                          \
-    ->hdr
+    rb_tree_t *tree;                                                          \
+    svm_fifo_shared_t **hdr;                                                  \
+  }){ .tree = &(f)->ooo_deq_lookup })                                         \
+    .hdr[0]
 
 typedef struct fifo_segment_slice_
 {
diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 379ae53fb4a..6c1655147f7 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -1138,8 +1138,11 @@ session_tx_fill_buffer (session_worker_t *wrk, session_tx_context_t *ctx,
 	      offset = hdr->data_length + SESSION_CONN_HDR_LEN;
 	      svm_fifo_dequeue_drop (f, offset);
 	      if (ctx->left_to_snd > n_bytes_read)
-		svm_fifo_peek (ctx->s->tx_fifo, 0, sizeof (ctx->hdr),
-			       (u8 *) & ctx->hdr);
+		{
+		  svm_fifo_peek (ctx->s->tx_fifo, 0, sizeof (ctx->hdr),
+				 (u8 *) &ctx->hdr);
+		  ASSERT (hdr->data_length > hdr->data_offset);
+		}
 	    }
 	  else if (ctx->left_to_snd == n_bytes_read)
 	    svm_fifo_overwrite_head (ctx->s->tx_fifo, (u8 *) & ctx->hdr,