Project

General

Profile

Bug #11408

Concurrency issues that thread sanitizer found

Added by Roel Standaert 18 days ago. Updated 18 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
Start date:
03/07/2023
Due date:
% Done:

0%

Estimated time:

Description

Running test.http with thread sanitizer yields a few issues:

  • Wt::Http::Client: concurrent reads and writes of the impl_ weak_ptr: abort() can be called concurrently with emitDone(), and abort() calls impl_.lock() while emitDone reset()s it. Since we don't have a std::atomic<std::weak_ptr<...>> in C++14 we should probably guard it with a mutex. (Note: while the reference count itself is atomic for a shared_ptr and weak_ptr, the operations on a specific weak_ptr are NOT atomic.) (log 1)
  • Wt::Http::ResponseContinuation: concurrent reads and writes to waiting_: haveMoreData() reads waiting_ while waitForMoreData() writes to it
  • ResponseContinuation::resource_ is read in haveMoreData() (while we have a lock on mutex_), while Response::createContinuation() may write to it (log 1)
  • WebController: concurrent reads and writes to running_: when WServer::stop() is called running_ is set to false (mutex_ is locked there). handleRequest and requestDataReceived check running_ without locking mutex_. Either we need to add an appropriate lock when checking running_, or running_ should be turned into an std::atomic_bool.
  • http_client_server_test4 checks isDone(), which reads done_ without a lock, while onDone may be writing to it. We can grab the doneMutex_ when checking isDone(). (log 1)
  • Signal-related races that I think might be test-specific. (log 1)

I found these when looking into issues #11301 and #11302.


Files

out1.log.gz (117 KB) out1.log.gz Log of test.http with thread sanitizer Roel Standaert, 03/08/2023 12:31 PM

Related issues

Related to Bug #11301: test.http server race can result in use-after-freeReview02/01/2023

Actions
Related to Bug #11302: Race when closing HTTP listening sockets can result in use-after-freeInProgressRoel Standaert02/02/2023

Actions
#1

Updated by Roel Standaert 18 days ago

  • Related to Bug #11301: test.http server race can result in use-after-free added
#2

Updated by Roel Standaert 18 days ago

  • Related to Bug #11302: Race when closing HTTP listening sockets can result in use-after-free added
#3

Updated by Roel Standaert 18 days ago

  • Description updated (diff)

Also available in: Atom PDF