<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Vortex Team, <br>
<br>
we are currently using a relatively old vortex version 1.0.5.b2830.g2831 in our applications/services.
<br>
A few weeks ago we got a bug report, one of our services was acting weird, it got dis-functional or even worse it segfaults over the day.
<br>
After a lot of investigation work, we were able to reproduce it. <br>
<br>
Most of the time it happens in the in the region of vortex reader. <br>
The reader struggles after trying to dispatch a previously freed connection. Classic invalid memory access.
<br>
Our service uses multiple threads to establish secure TLS connections. Due to stability and other paranoid reasons, this is done before every data transmission.<br>
The more threads are doing communication work, the bigger the possibility to crash.
<br>
<br>
<br>
So this is my explanation:<br>
The connection gets renewed during TLS negotiation. A new "object" would be allocated and the other one get marked as not connected and waiting for destruction (unref).<br>
If I understood the process of the reader correctly, a new connection gets add to the watching queue and epoll is waiting till new data is available on a socket.
<br>
<br>
If the connection "object" exchange exactly happens during the run of the reader worker thread, it could happen that it frees the "object" to soon, resulting in strange behaviours I mentioned before.
<br>
Seems the watching of the former connection was not already finished and needs at least one run through of __vortex_reader_run.
<br>
The object got freed during __vortex_reader_build_set_to_watch but it's reference still remaining as an reference entry in the private area on epoll.<br>
What would lead to an invalid memory access during vortex_io_waiting_invoke_dispatch in further consequence.
<br>
<br>
Attached you'll find a short patch, where we moved the finally destruction of the connection towards the place dispatching finished.<br>
This fixed out issues. <br>
Would be possible that this issue is also present in the last release of version 1.0 (I think 1.0.17), would be cool if you could check on this.
<br>
<br>
<br>
<br>
Best Regards, <br>
David <br>
<br>
<br>
<br>
<br>
<div class="moz-signature">-- <br>
<style type="text/css">
body {
font-family: arial;
font-size: 10px;
}
p {
padding-top: 0;
padding-bottom: 0;
margin-top: 0;
margin-bottom: 0.2em;
}
</style>
<p style="font-weight:bold;">David Drusowitsch</p>
<p style="font-style:italic;">Software Engineer</p>
<p>Lassallestrasse 7A / Unit 4 / 2 • 1020 Vienna • Austria</p>
<p>o: +43 508-100 | <a class="moz-txt-link-abbreviated" href="mailto:ddrusowitsch@barracuda.com">ddrusowitsch@barracuda.com</a></p>
<p>Connect with us: <a href="https://www.barracuda.com/connect">barracuda.com/connect</a></p>
<img src="cid:part2.03000505.09030708@barracuda.com"> </div>
<div><span style="color: #808080; font-family: Arial,sans-serif; font-size: xx-small;">
<hr>
Barracuda Networks AG<br>
Vorsitzender des Aufsichtsrates/ Chairman of the supervisory board: Dr. Klaus Perktold<br>
Vorstand/ Executive Board: Dr. Wieland Alge, Mag. Guenter Klausner<br>
Sitz der Gesellschaft/ Registered office: 6020 Innsbruck, Austria<br>
Handelsgericht Innsbruck Firmenbuch/ Registration Number: 184392s<br>
UID-Nr/ VAT Number: ATU47509003<br>
<br>
Zweigniederlassung Deutschland/ Office Germany: Radlkoferstr. 2, 81373 München<br>
Handelsregister München / Registration Number: HRB 171749<br>
UID-Nr/ VAT Number: DE237607533</span></div>
<br><div>
<font face="Helvetica">
<hr>
<br>
<p><b><span style="font-size:12.0pt;font-family:"Calibri",sans-serif">Considering Office 365? Barracuda security and storage solutions can help. Learn more about Barracuda solutions for Office 365 at <a href="http://barracuda.com/office365">http://barracuda.com/office365</a>.</span></b></p>
<br>
</div>
<div>
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><b>DISCLAIMER:</b> This e-mail and any attachments to it contain confidential and proprietary material of Barracuda, its affiliates or agents, and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.</span></p>
<br>
<hr>
</font>
</div>
</body>
</html>