Mailing List Archive

commit 57155c045e9a0027c230880657815a3d56394664
Author: Nils Goroll <nils.goroll@uplex.de>
Date: Wed Sep 29 17:04:47 2021 +0200

Close potential race: Do not access a request after HSH_BUSY

Conceptually, when HSH_Lookup() returns with HSH_BUSY, ownership of
the request has been ceded: Right after Lck_Unlock(&oh->mtx) in
HSH_Lookup(), it could have got picked up from the waitinglist by
another thread and, in the extreme, could already be done with when
HSH_Lookup() returns.

diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index 24c87bd1b..cb4d3fa1a 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -555,10 +555,6 @@ cnt_lookup(struct worker *wrk, struct req *req)
had_objhead = 1;
wrk->strangelove = 0;
lr = HSH_Lookup(req, &oc, &busy);
- assert(wrk->strangelove >= 0);
- if ((unsigned)wrk->strangelove >= cache_param->vary_notice)
- VSLb(req->vsl, SLT_Notice, "vsl: High number of variants (%d)",
- wrk->strangelove);
if (lr == HSH_BUSY) {
/*
* We lost the session to a busy object, disembark the
@@ -568,6 +564,10 @@ cnt_lookup(struct worker *wrk, struct req *req)
*/
return (REQ_FSM_DISEMBARK);
}
+ assert(wrk->strangelove >= 0);
+ if ((unsigned)wrk->strangelove >= cache_param->vary_notice)
+ VSLb(req->vsl, SLT_Notice, "vsl: High number of variants (%d)",
+ wrk->strangelove);
if (had_objhead)
VSLb_ts_req(req, "Waitinglist", W_TIM_real(wrk));

_______________________________________________
varnish-commit mailing list
varnish-commit@varnish-cache.org
https://www.varnish-cache.org/lists/mailman/listinfo/varnish-commit