BUG/MEDIUM: mux-quic: remove pacing status when everything is sent

TASK_F_USR1 is used by MUX tasklet when emission has been interrupted
due to pacing. When the tasklet runs again, only qcc_purge_sending()
will be called as an optimization.

Pacing status is only removed via qcc_wakeup(). Until then, TASK_F_USR1
is not cleared. This causes an issue after emission with pacing
completion if the MUX tasklet is woken up for a recv subscribe, as
qcc_wakeup() is not used by quic-conn layer. The tasklet will
incorrectly run only for pacing emission, without handling reception
process. Worst, a crash will occur if QCC tx frames list is empty, due
to a BUG_ON() in qcc_purge_sending().

Recv subscribe is only used for 0-RTT, when QUIC MUX is instantiated
before quic-conn handshake completion. Thus, this bug can only be
reproduced with 0-rtt. Furthermore, MUX must already have emitted at
least a few response bytes with pacing, before QUIC handshake
completion. It cannot easily be reproduced, at least with CLI clients
where the handshake is always already completed before MUX exchanges.

To fix this, remove TASK_F_USR1 when pacing emission has been completed.
At least, this prevents BUG_ON() on qcc_purge_sending() as it won't be
called with an empty QCC Tx frame list anymore. However, this bug has
revealed that MUX tasklet architecture is not suitable when both
handling reception and emission part. This will be improved in a future
serie of patches.

This should fix github issue #2796.

This must be backported up to 3.1.

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 182a531dae41d32ba0ad1cb4d2b8b34a6d5a1e6f..a06b36ddf0d87c0e7f05aee18facbfb74350250e 100644 (file)
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -2449,6 +2449,10 @@ static int qcc_io_send(struct qcc *qcc)
                /* Deallocate frames that the transport layer has rejected. */
                qcc_tx_frms_free(qcc);
        }
+       else {
+               /* Everything sent */
+               HA_ATOMIC_AND(&qcc->wait_event.tasklet->state, ~TASK_F_USR1);
+       }
 
        /* Re-insert on-error QCS at the end of the send-list. */
        if (!LIST_ISEMPTY(&qcs_failed)) {
@@ -2823,8 +2827,13 @@ static void qcc_purge_sending(struct qcc *qcc)
                qcc_subscribe_send(qcc);
        }
        else {
-               if (!LIST_ISEMPTY(frms))
+               if (!LIST_ISEMPTY(frms)) {
                        qcc_subscribe_send(qcc);
+               }
+               else {
+                       /* Everything sent */
+                       HA_ATOMIC_AND(&qcc->wait_event.tasklet->state, ~TASK_F_USR1);
+               }
        }
 }