bryancall commented on issue #13145: URL: https://github.com/apache/trafficserver/issues/13145#issuecomment-4828331319
Thanks for the detailed analysis and the standalone reproduction. Your reading is correct: in the 8.x/9.x ProcessManager::signalManager path, the message header is enqueued onto mgmt_signal_queue and then mh->msg_id is read afterward, so the process-manager thread can dequeue and free the same header before the sender's read completes. That is a genuine use-after-free race. The reason this is no longer an issue is that the entire traffic_manager process and the ProcessManager inter-process message queue were removed in Apache Traffic Server 10.0.0. On the current master branch, signalManager, mgmt_signal_queue, RecMessageSend, and send_push_message no longer exist, and mgmt/ProcessManager.cc has been deleted (it is still present in 9.2.x but gone in 10.0.x). The crashing code path simply does not exist in supported releases anymore. ATS 8.1.x is end of life and will not receive further fixes. Please upgrade to a current 10.x release, where this race cannot occur. I am closing this as resolved by the management process removal, but feel free to reopen if you can reproduce anything similar on 10.x. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
