{"action":"created","issue":{"url":"https://api.github.com/repos/natsys/tempesta/issues/320","labels_url":"https://api.github.com/repos/natsys/tempesta/issues/320/labels{/name}","comments_url":"https://api.github.com/repos/natsys/tempesta/issues/320/comments","events_url":"https://api.github.com/repos/natsys/tempesta/issues/320/events","html_url":"https://github.com/natsys/tempesta/issues/320","id":112458972,"number":320,"title":"BUG at /root/tempesta/tempesta_fw/str.c:340","user":{"login":"krizhanovsky","id":884694,"avatar_url":"https://avatars.githubusercontent.com/u/884694?v=3","gravatar_id":"","url":"https://api.github.com/users/krizhanovsky","html_url":"https://github.com/krizhanovsky","followers_url":"https://api.github.com/users/krizhanovsky/followers","following_url":"https://api.github.com/users/krizhanovsky/following{/other_user}","gists_url":"https://api.github.com/users/krizhanovsky/gists{/gist_id}","starred_url":"https://api.github.com/users/krizhanovsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krizhanovsky/subscriptions","organizations_url":"https://api.github.com/users/krizhanovsky/orgs","repos_url":"https://api.github.com/users/krizhanovsky/repos","events_url":"https://api.github.com/users/krizhanovsky/events{/privacy}","received_events_url":"https://api.github.com/users/krizhanovsky/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/natsys/tempesta/labels/bug","name":"bug","color":"eb6420"},{"url":"https://api.github.com/repos/natsys/tempesta/labels/crucial","name":"crucial","color":"ff1010"}],"state":"open","locked":false,"assignee":{"login":"krizhanovsky","id":884694,"avatar_url":"https://avatars.githubusercontent.com/u/884694?v=3","gravatar_id":"","url":"https://api.github.com/users/krizhanovsky","html_url":"https://github.com/krizhanovsky","followers_url":"https://api.github.com/users/krizhanovsky/followers","following_url":"https://api.github.com/users/krizhanovsky/following{/other_user}","gists_url":"https://api.github.com/users/krizhanovsky/gists{/gist_id}","starred_url":"https://api.github.com/users/krizhanovsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krizhanovsky/subscriptions","organizations_url":"https://api.github.com/users/krizhanovsky/orgs","repos_url":"https://api.github.com/users/krizhanovsky/repos","events_url":"https://api.github.com/users/krizhanovsky/events{/privacy}","received_events_url":"https://api.github.com/users/krizhanovsky/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/natsys/tempesta/milestones/3","html_url":"https://github.com/natsys/tempesta/milestones/0.5.0%20Web%20Server","labels_url":"https://api.github.com/repos/natsys/tempesta/milestones/3/labels","id":1015684,"number":3,"title":"0.5.0 Web Server","description":"","creator":{"login":"krizhanovsky","id":884694,"avatar_url":"https://avatars.githubusercontent.com/u/884694?v=3","gravatar_id":"","url":"https://api.github.com/users/krizhanovsky","html_url":"https://github.com/krizhanovsky","followers_url":"https://api.github.com/users/krizhanovsky/followers","following_url":"https://api.github.com/users/krizhanovsky/following{/other_user}","gists_url":"https://api.github.com/users/krizhanovsky/gists{/gist_id}","starred_url":"https://api.github.com/users/krizhanovsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krizhanovsky/subscriptions","organizations_url":"https://api.github.com/users/krizhanovsky/orgs","repos_url":"https://api.github.com/users/krizhanovsky/repos","events_url":"https://api.github.com/users/krizhanovsky/events{/privacy}","received_events_url":"https://api.github.com/users/krizhanovsky/received_events","type":"User","site_admin":false},"open_issues":38,"closed_issues":43,"state":"open","created_at":"2015-03-10T23:31:23Z","updated_at":"2015-11-12T13:52:21Z","due_on":"2016-01-31T21:00:00Z","closed_at":null},"comments":1,"created_at":"2015-10-20T20:57:32Z","updated_at":"2015-11-12T19:22:54Z","closed_at":null,"body":" kernel:Kernel panic - not syncing: Fatal exception in interrupt\r\nOct 20 07:07:03 vip-1 kernel: kernel BUG at /root/tempesta/tempesta_fw/str.c:340!\r\nOct 20 07:07:03 vip-1 kernel: RIP  [<ffffffffa023c586>] tfw_str_eq_cstr+0xf6/0x100 [tempesta_fw]\r\nOct 20 07:07:03 vip-1 kernel: ---[ end trace d6e1045fde362742 ]---\r\nOct 20 07:07:03 vip-1 kernel: Kernel panic - not syncing: Fatal exception in interrupt\r\nOct 20 07:07:03 vip-1 kernel: drm_kms_helper: panic occurred, switching back to text console\r\nOct 20 07:07:03 vip-1 kernel: ------------[ cut here ]------------\r\nOct 20 07:07:03 vip-1 kernel: WARNING: at kernel/rcutree.c:388 rcu_eqs_enter+0x8b/0xa0()\r\nOct 20 07:07:03 vip-1 kernel: ---[ end trace d6e1045fde362743 ]---\r\nOct 20 07:07:03 vip-1 kernel: ------------[ cut here ]------------\r\nOct 20 07:07:03 vip-1 kernel: WARNING: at kernel/rcutree.c:528 rcu_eqs_exit+0x89/0xa0()\r\nOct 20 07:07:03 vip-1 kernel: ---[ end trace d6e1045fde362744 ]---\r\n[10:27:09 PM] zuer rong: system  hung .\r\n"},"comment":{"url":"https://api.github.com/repos/natsys/tempesta/issues/comments/156207731","html_url":"https://github.com/natsys/tempesta/issues/320#issuecomment-156207731","issue_url":"https://api.github.com/repos/natsys/tempesta/issues/320","id":156207731,"user":{"login":"krizhanovsky","id":884694,"avatar_url":"https://avatars.githubusercontent.com/u/884694?v=3","gravatar_id":"","url":"https://api.github.com/users/krizhanovsky","html_url":"https://github.com/krizhanovsky","followers_url":"https://api.github.com/users/krizhanovsky/followers","following_url":"https://api.github.com/users/krizhanovsky/following{/other_user}","gists_url":"https://api.github.com/users/krizhanovsky/gists{/gist_id}","starred_url":"https://api.github.com/users/krizhanovsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krizhanovsky/subscriptions","organizations_url":"https://api.github.com/users/krizhanovsky/orgs","repos_url":"https://api.github.com/users/krizhanovsky/repos","events_url":"https://api.github.com/users/krizhanovsky/events{/privacy}","received_events_url":"https://api.github.com/users/krizhanovsky/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T19:22:54Z","updated_at":"2015-11-12T19:22:54Z","body":"My investigations:\r\n\r\n* ```TFW_STR_DUPLICATE``` is set only in ```tfw_http_msg_hdr_close()``` which is called for headers only and only after ```tfw_http_msg_hdr_chunk_fixup()```, so ```tfw_http_msg_field_chunk_fixup()``` (cause of #328) can't face ```TFW_STR_DUPLICATE```;\r\n\r\n* Moreover, ```tfw_http_msg_hdr_close()``` checks ```parser.hdr``` for duplicates;\r\n\r\n* Integer overflow of chunks number in flags is also unlike since this is about 16M (2^24) chunks, so allocator will return NULL earlier than we reach the chunks limit. ```TFW_STR_CHUNKN_SUB()``` is also called only on getting header value, which happens after header parsing, so again ```tfw_http_msg_field_chunk_fixup()``` can't face ```TFW_STR_DUPLICATE```;\r\n\r\n* We also allocate ```TfwHttpReq``` with zeroing as well as zero h_tbl and ```parser.hdr```, so there shouldn't be dirty data.\r\n\r\nSince  two different functions, ```tfw_http_msg_field_chunk_fixup()``` (#328) and ```tfw_str_eq_cstr()``` (this issues), fail at the same assertion while there were not crashes on other TfwStr members (like ```len```, ```skb``` or ```ptr```) it seems that the bug affects ```flags``` only... Moreover, #328 and this issue happen at different time and tests, so probability of improper build is actually small.\r\n\r\nOne more interesting thing is that workload for the crash was pretty simple: just ```ab``` or ```wrk``` benchmarking. These tools send very simple requests without duplicate or long fields. The requests are:\r\n\r\n         GET / HTTP/1.0\r\n         Host: 172.16.0.5\r\n         User-Agent: ApacheBench/2.3\r\n         Accept: */*\r\n\r\n         GET / HTTP/1.1^M\r\n         Host: 172.16.0.5^M\r\n\r\nfor ```ab``` and ```wrk``` correspondingly.\r\n\r\nNow I add couple of checks to harden manipulations with chunks number in ```TfwStr.flags``` and leave the issue open for further investigation."}}