Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vrt_vcl: Minor polish of director code #4241

Closed
wants to merge 2 commits into from

Conversation

dridi
Copy link
Member

@dridi dridi commented Dec 9, 2024

I was in the neighborhood for a quick loop polish and after a couple rounds of confusion I put my finger on a race and an unsafe sequence of events. I think I fixed one and have a suggestion to fix the other one.

It probably needs more homework.

dridi added 2 commits December 9, 2024 18:11
I had to stop and think twice to realize that I was looking at a simple
search loop extracting the result inside its critical section.

Isn't the real problem a TOCTOU race between VRT_LookupDirector() and
VRT_Assign_Backend()?
Consider the following VCL statement:

    set bereq.backend = bereq.backend;

The director's refcount will be decremented before it is incremented. If
that bereq.backend was holding the last reference of a dynamic backend,
the backend is retired and grab a reference afterwards.

While this scenario is highly unlikely, we cannot discard the risk of
assigning a director to a destination that already held a reference to
the same director.
@nigoroll
Copy link
Member

#3949 ?

@@ -336,6 +336,8 @@ VRT_Assign_Backend(VCL_BACKEND *dst, VCL_BACKEND src)
AN(dst);
CHECK_OBJ_ORNULL((*dst), DIRECTOR_MAGIC);
CHECK_OBJ_ORNULL(src, DIRECTOR_MAGIC);
if (*dst == src)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you should just push this one to master

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dridi
Copy link
Member Author

dridi commented Dec 10, 2024

#3949 ?

Apologies, I was not aware of this issue. I'm closing this pull request as my goal was initially to make the loop more straightforward before I noticed the dst==src case. I'll leave it alone since there may be activity in this area related to #3949.

@dridi dridi closed this Dec 10, 2024
@dridi dridi deleted the vdir_race branch December 10, 2024 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants