[tarantool-patches] [PATCH 1/1] iproto: on input discard do nothing for closed con

[tarantool-patches] [PATCH 1/1] iproto: on input discard do nothing for closed con

[Vladislav Shpilevoy]

When a connection is closed, some of long-poll requests still may
by in TX thread with non-discarded input. If a connection is
closed, and then an input is discarded, then connection must not
try to read new data.

The bug was introduced here:
f4d66dae85a59f5ba667f405ad7b67649f3dec7b by me.

Closes #3400
---
Branch: https://github.com/tarantool/tarantool/tree/gh-3400-iproto-crash
Issue: https://github.com/tarantool/tarantool/issues/3400

 src/box/iproto.cc         |  5 ++++-
 test/box/net.box.result   | 29 +++++++++++++++++++++++++++++
 test/box/net.box.test.lua | 17 +++++++++++++++++
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/src/box/iproto.cc b/src/box/iproto.cc
index 1e6c615da..6624b8d73 100644
--- a/src/box/iproto.cc
+++ b/src/box/iproto.cc
@@ -1160,7 +1160,8 @@ net_discard_input(struct cmsg *m)
 	msg->p_ibuf->rpos += msg->len;
 	msg->len = 0;
 	con->long_poll_requests++;
-	if (! ev_is_active(&con->input) && rlist_empty(&con->in_stop_list))
+	if (evio_has_fd(&con->input) && !ev_is_active(&con->input) &&
+	    rlist_empty(&con->in_stop_list))
 		ev_feed_event(con->loop, &con->input, EV_READ);
 }
 
@@ -1669,6 +1670,8 @@ iproto_on_accept(struct evio_service * /* service */, int fd,
 	cpipe_push(&tx_pipe, &msg->base);
 	return;
 error_msg:
+	ev_io_stop(con->loop, &con->input);
+	ev_io_stop(con->loop, &con->output);
 	mempool_free(&iproto_connection_pool, con);
 error_conn:
 	close(fd);
diff --git a/test/box/net.box.result b/test/box/net.box.result
index 2e6be0e64..1674c27e1 100644
--- a/test/box/net.box.result
+++ b/test/box/net.box.result
@@ -3033,6 +3033,35 @@ box.space.test2:drop()
 box.space.test3:drop()
 ---
 ...
+--
+-- gh-3400: long-poll input discard must not touch event loop of
+-- a closed connection.
+--
+function long() fiber.yield() return 100 end
+---
+...
+c = net.connect(box.cfg.listen)
+---
+...
+c:ping()
+---
+- true
+...
+-- Create batch of two requests. First request is sent to TX
+-- thread, second one terminates connection. The preceeding
+-- request discards input, and this operation must not trigger
+-- new attempts to read any data - the connection is closed
+-- already.
+--
+f = fiber.create(c._transport.perform_request, nil, nil, 'call_17', 'long', {}) c._transport.perform_request(nil, nil, 'inject', '\x80')
+---
+...
+while f:status() ~= 'dead' do fiber.sleep(0.01) end
+---
+...
+c:close()
+---
+...
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
 ---
 ...
diff --git a/test/box/net.box.test.lua b/test/box/net.box.test.lua
index cb9a3dc69..c34616aec 100644
--- a/test/box/net.box.test.lua
+++ b/test/box/net.box.test.lua
@@ -1209,4 +1209,21 @@ box.space.test1:drop()
 box.space.test2:drop()
 box.space.test3:drop()
 
+--
+-- gh-3400: long-poll input discard must not touch event loop of
+-- a closed connection.
+--
+function long() fiber.yield() return 100 end
+c = net.connect(box.cfg.listen)
+c:ping()
+-- Create batch of two requests. First request is sent to TX
+-- thread, second one terminates connection. The preceeding
+-- request discards input, and this operation must not trigger
+-- new attempts to read any data - the connection is closed
+-- already.
+--
+f = fiber.create(c._transport.perform_request, nil, nil, 'call_17', 'long', {}) c._transport.perform_request(nil, nil, 'inject', '\x80')
+while f:status() ~= 'dead' do fiber.sleep(0.01) end
+c:close()
+
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
-- 
2.15.1 (Apple Git-101)