daemon/{session2,worker}: relax a few kr_require() cases

These cases aren't obviously impossible,
and I fail to see why force a crash there.

diff --git a/NEWS b/NEWS
index fab6cf9aec69211036f30fe3ed26fac20f347f62..04da1372587b0f4c74c51ac3a360f1b21f249cc3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ Security
 --------
 - DoS: fix more rare crashes with `requirement` failing (#930, !1696)
   [system] requirement "session2_is_empty(s)" failed in session2_transport_event
+  (and others not observed in practice)
 
 Bugfixes
 --------

diff --git a/daemon/session2.c b/daemon/session2.c
index 450796ded22de00e0fba81a00c6629620d61bafb..997e54544d5419b3479321332cf68b6a93397825 100644 (file)
--- a/daemon/session2.c
+++ b/daemon/session2.c
@@ -1094,7 +1094,8 @@ void session2_tasklist_finalize(struct session2 *session, int status)
                defer_sample_start(&defer_prev_sample_state);
                do {
                        struct qr_task *t = session2_tasklist_del_first(session, false);
-                       kr_require(worker_task_numrefs(t) > 0);
+                       if (kr_fails_assert(worker_task_numrefs(t) > 0))
+                               continue; // t has been freed already?
                        worker_task_finalize(t, status);
                        worker_task_unref(t);
                        defer_sample_restart();
@@ -1686,7 +1687,7 @@ static inline int session2_transport_push(struct session2 *s,
 static void on_session2_handle_close(uv_handle_t *handle)
 {
        struct session2 *session = handle->data;
-       kr_require(session->transport.type == SESSION2_TRANSPORT_IO &&
+       kr_assert(session->transport.type == SESSION2_TRANSPORT_IO &&
                        session->transport.io.handle == handle);
        io_free(handle);
 }

diff --git a/daemon/worker.c b/daemon/worker.c
index 16191a8e0e973558279160cf6a89a929c82caec4..f7d2532342805ba28e4b7515c3b59326d6d5b3c5 100644 (file)
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -502,10 +502,9 @@ static void qr_task_free(struct qr_task *task)
 {
        struct request_ctx *ctx = task->ctx;
 
-       if (kr_fails_assert(ctx))
+       if (kr_fails_assert(ctx && ctx->task == NULL))
                return;
 
-       kr_require(ctx->task == NULL);
        request_free(ctx);
 
        /* Update stats */
@@ -549,7 +548,7 @@ static void qr_task_complete(struct qr_task *task)
 
        struct session2 *s = ctx->source.session;
        if (s) {
-               kr_require(!s->outgoing && session2_waitinglist_is_empty(s));
+               kr_assert(!s->outgoing && session2_waitinglist_is_empty(s));
                ctx->source.session = NULL;
                session2_tasklist_del(s, task);
        }