Skip to content

Commit

Permalink
MINOR: quic: Add BUG_ON() on QUIC RX packet struct member values
Browse files Browse the repository at this point in the history
Add BUG_ON() on ->pn_node.node.leaf_p and ->list quic_rx_packet struct member values
before freeing such objects. They must not be in any list or ebtree.
Modify quic_rx_pkts_del() to trace the RX packet addresses it has to inspect.
Dump the RX packet addresses before freeing the pointed object.
  • Loading branch information
haproxyFred committed Aug 31, 2023
1 parent 0c4bb01 commit 11159ab
Showing 1 changed file with 10 additions and 4 deletions.
14 changes: 10 additions & 4 deletions src/quic_rx.c
Original file line number Diff line number Diff line change
Expand Up @@ -1230,7 +1230,7 @@ static void qc_rm_hp_pkts(struct quic_conn *qc, struct quic_enc_level *el)
quic_rx_packet_refinc(pqpkt);
TRACE_PROTO("RX hp removed", QUIC_EV_CONN_ELRMHP, qc, pqpkt);
}
LIST_DELETE(&pqpkt->list);
LIST_DEL_INIT(&pqpkt->list);
quic_rx_packet_refdec(pqpkt);
}

Expand Down Expand Up @@ -2336,8 +2336,8 @@ static void quic_rx_pkts_del(struct quic_conn *qc)

list_for_each_entry_safe(pkt, pktback, &qc->rx.pkt_list, qc_rx_pkt_list) {
TRACE_PRINTF(TRACE_LEVEL_DEVELOPER, QUIC_EV_CONN_LPKT, qc, 0, 0, 0,
"pkt #%lld(type=%d,len=%llu,rawlen=%llu,refcnt=%u) (diff: %zd)",
(long long)pkt->pn_node.key,
"pkt@%p #%lld(type=%d,len=%llu,rawlen=%llu,refcnt=%u) (diff: %zd)",
pkt, (long long)pkt->pn_node.key,
pkt->type, (ull)pkt->len, (ull)pkt->raw_len, pkt->refcnt,
(unsigned char *)b_head(&qc->rx.buf) - pkt->data);
if (pkt->data != (unsigned char *)b_head(&qc->rx.buf)) {
Expand All @@ -2357,7 +2357,10 @@ static void quic_rx_pkts_del(struct quic_conn *qc)
break;

b_del(&qc->rx.buf, pkt->raw_len);
LIST_DELETE(&pkt->qc_rx_pkt_list);
LIST_DEL_INIT(&pkt->qc_rx_pkt_list);
BUG_ON(LIST_INLIST(&pkt->list));
BUG_ON(pkt->pn_node.node.leaf_p);
TRACE_DEVEL("freeing RX packet", QUIC_EV_CONN_LPKT, qc, pkt);
pool_free(pool_head_quic_rx_packet, pkt);
}

Expand Down Expand Up @@ -2583,6 +2586,9 @@ int quic_dgram_parse(struct quic_dgram *dgram, struct quic_conn *from_qc,
/* Free rejected packets */
if (!pkt->refcnt) {
BUG_ON(LIST_INLIST(&pkt->qc_rx_pkt_list));
BUG_ON(LIST_INLIST(&pkt->list));
BUG_ON(pkt->pn_node.node.leaf_p);
TRACE_DEVEL("freeing RX packet", QUIC_EV_CONN_LPKT, NULL, pkt);
pool_free(pool_head_quic_rx_packet, pkt);
}
} while (pos < end);
Expand Down

0 comments on commit 11159ab

Please sign in to comment.