cloudflare / quiche

🥧 Savoury implementation of the QUIC transport protocol and HTTP/3
https://docs.quic.tech/quiche/
BSD 2-Clause "Simplified" License
9.44k stars 716 forks source link

a crash happened in quic connection #870

Open lilongyan-huawei opened 3 years ago

lilongyan-huawei commented 3 years ago

(gdb) bt

0 0x00007f0aa37ed2c7 in raise () from /lib64/libc.so.6

1 0x00007f0aa37ee9b8 in abort () from /lib64/libc.so.6

2 0x00007f0aa382fe17 in __libc_message () from /lib64/libc.so.6

3 0x00007f0aa3838609 in _int_free () from /lib64/libc.so.6

4 0x0000000000478be1 in ngx_destroy_pool (pool=pool@entry=0x2baf7f0) at src/core/ngx_palloc.c:85

5 0x00000000004a3c74 in ngx_quic_close_connection (c=0x7f0a9d946aa0) at src/event/ngx_event_quic.c:709

6 0x00000000004a43ef in ngx_quic_shutdown_handler (ev=0x7f0a9cfce970) at src/event/ngx_event_quic.c:641

7 0x000000000049675d in ngx_event_recvmsg (ev=) at src/event/ngx_event_udp.c:263

8 0x000000000049e124 in ngx_epoll_process_events (cycle=, timer=, flags=) at src/event/modules/ngx_epoll_module.c:902

9 0x0000000000495492 in ngx_process_events_and_timers (cycle=cycle@entry=0x16d7720) at src/event/ngx_event.c:242

10 0x000000000049c504 in ngx_worker_process_cycle (cycle=0x16d7720, data=) at src/os/unix/ngx_process_cycle.c:750

11 0x000000000049ac42 in ngx_spawn_process (cycle=cycle@entry=0x16d7720, proc=proc@entry=0x49c493 , data=data@entry=0x0, name=name@entry=0x80894d "worker process",

respawn=respawn@entry=-3) at src/os/unix/ngx_process.c:199

12 0x000000000049b7cb in ngx_start_worker_processes (cycle=cycle@entry=0x16d7720, n=3, type=type@entry=-3) at src/os/unix/ngx_process_cycle.c:359

13 0x000000000049cc01 in ngx_master_process_cycle (cycle=cycle@entry=0x16d7720) at src/os/unix/ngx_process_cycle.c:131

14 0x00000000004776c5 in main (argc=, argv=) at src/core/nginx.c:408

lilongyan-huawei commented 3 years ago

static void ngx_quic_shutdown_handler(ngx_event_t ev) { ngx_connection_t c; ngx_connection_handler_pt handler;

c = ev->data;
handler = c->quic->handler;

if (ev->timedout) {
    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic alarm fired");

    quiche_conn_on_timeout(c->quic->conn);

    ev->timedout = 0;
}

ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "quic shutdown handler");

if (ngx_quic_shutdown(c) == NGX_AGAIN) {
    return;
}

line 641: handler(c); }

ngx_quic_close_connection(ngx_connection_t c) { ngx_pool_t pool;

ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
               "close quic connection: %d", c->fd);

if (c->quic) {
    if (ngx_quic_shutdown(c) == NGX_AGAIN) {
        c->quic->handler = ngx_quic_close_connection;
        return;
    }

    if (c->destroyed) {
        return;
    }
}

if (NGX_STAT_STUB)

(void) ngx_atomic_fetch_add(ngx_stat_active, -1);

endif

c->destroyed = 1;

pool = c->pool;

ngx_close_connection(c);

line 709: ngx_destroy_pool(pool); }

lilongyan-huawei commented 3 years ago

occurred again yesterday, do you have any ideas? thanks @LPardue