[
https://issues.apache.org/jira/browse/GUACAMOLE-2265?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mike Jumper updated GUACAMOLE-2265:
-----------------------------------
Fix Version/s: (was: 1.6.1 [staging])
> Worker process leak after client disconnect under resource pressure
> -------------------------------------------------------------------
>
> Key: GUACAMOLE-2265
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2265
> Project: Guacamole
> Issue Type: Bug
> Components: guacamole-server
> Affects Versions: 1.6.0
> Reporter: escra
> Priority: Major
>
> Worker processes may remain alive indefinitely after all users have
> disconnected, particularly under resource pressure (e.g. cgroup pids-limit).
> The root cause is threefold:
> *1. pthread_create() failure ignored in guacd_proc_add_user()*
> When thread creation fails with EAGAIN (common under cgroup pids-limit), the
> user thread never runs, so guacd_proc_stop() is never called and the worker
> blocks in recvmsg() forever.
> *2. Worker main loop blocks indefinitely in recvmsg()*
> The loop in guacd_exec_proc() calls guacd_recv_fd() with no timeout or health
> check. If guacd_proc_stop() is not triggered for any reason, the worker hangs
> at 0% CPU consuming a PID slot indefinitely.
> *3. RDP fail path does not clean up resources*
> guac_rdp_handle_connection() does not free the display, FreeRDP instance,
> keyboard, or SVC list on the fail path, leaking resources on every failed
> connection attempt.
> *Observable symptoms:*
> - Process count grows steadily over days/weeks
> - Stale guacd child processes at 0% CPU that never exit
> - Under cgroup pids-limit, new connections fail with EAGAIN while stale
> workers hold PID slots
> - {{ps aux | grep guacd}} shows many child processes with long ELAPSED times
> *Fix:*
> - Handle pthread_create() failure by closing the FD, freeing params, and
> calling guacd_proc_stop()
> - Replace the bare recvmsg() loop with a poll()-based loop that checks client
> state every 5 seconds. Workers exit when the client has stopped or all users
> have disconnected. An absolute safety timeout (30s) handles edge cases where
> cleanup is blocked.
> - Add resource cleanup to the fail label in guac_rdp_handle_connection()
> *Related:* GUACAMOLE-2118, GUACAMOLE-2143
> PR: https://github.com/apache/guacamole-server/pull/TBD
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
