Fix numerous thread/socket lifecycle crashes and TLS/epoll write-stall busy-loop

Thread/EPoll lifecycle:
- Thread::~Thread() now actually joins/frees its worker thread (was
  empty - the OS thread kept running against already-freed EPoll/Socket
  objects on any early teardown, a confirmed "double free" crash)
- EPoll::~EPoll() calls stop() if never explicitly stopped, for the
  same reason
- epoll_wait() now uses a 1s timeout instead of blocking forever, so a
  worker thread can actually notice isStopping() and let itself be
  joined
- EPoll::processCommand() iterated threads by value, silently
  double-freeing the real vector's Thread the moment each copy went
  out of scope
- ThreadScope gained onThreadStart()/onThreadEnd() hooks (actually
  wired up now - the constructor that was supposed to store the scope
  discarded it) for per-thread C-library init (e.g. MySQL client)

Socket/TCPSocket/TLS:
- Socket::writeSocket(): give up and shut down a connection after 50
  consecutive zero-progress sends instead of retrying forever -
  SSL_ERROR_WANT_READ on a write needs a READ to make progress, but
  resetSocket() re-arms EPOLLWRNORM regardless, which an
  already-writable TCP socket satisfies immediately - a real stuck
  connection generated 55GB, then 12.9GB of debug log this way before
  being caught
- Socket::writeSocket() now honors sendData()'s actual return value
  (previously discarded, entry popped unconditionally after one call) -
  a large response could get silently truncated past what fit in one
  write()/SSL_write() call
- TLS::registerSocket()/sendData()/receiveData(): `initialized` now
  only goes true once SSL_set_fd() has actually succeeded, and
  sendData()/receiveData() check it first - fixes a real SIGSEGV where
  a new session's own queued greeting could reach SSL_write() on a
  different epoll thread before this session's handshake setup had run
- TCPServer::connectionRequest() now performs the TLS handshake ON THE
  ACCEPTED SESSION, not the listening server itself (was building SSL
  state on the wrong object, leaving every session's own `ssl`
  uninitialized)
- TCPServer::receiveData() always uses the plain (non-TLS) read path -
  the listening socket is never itself a TLS peer
- TCPSocket's block-mode literal reading used an unset `blockLength`
  field instead of `blockSize`, and could busy-spin forever on a
  multi-packet literal
- TCPSocket line scanning replaced an unbounded strcspn() (assumes a
  NUL-terminated buffer; read past a non-NUL-terminated receive buffer
  into adjacent heap memory) with a bounds-checked memchr() scan

Protocol/session handling:
- CommandList::processRequest() now case-folds the command keyword
  before lookup - SMTP/POP3/IMAP commands are spec-required to be
  case-insensitive; a client sending "Mail From:" instead of
  "MAIL FROM:" previously failed to dispatch at all
- TCPSession::protocol() no longer drops blank lines while a handler
  has grabbed input (e.g. __SMTP_DATA reading a message body, an IMAP
  APPEND literal) - those handlers depend on seeing blank lines as
  real content, not commands; this silently corrupted any message body
  containing a blank line
- TCPSession's uuid alias fixed: streaming a raw uuid_t via operator<<
  triggered libstdc++'s unsigned-char* overload (strlen() on 16 binary
  bytes, a real stack-buffer-overflow read), and `alias` pointed at a
  stack-local that was already destroyed by the time the constructor
  returned
- INotify::processEvent() only treats event->name as a NUL-terminated
  string when event->len > 0 (per inotify(7)) instead of unconditional
  strlen() on a field the kernel doesn't guarantee is even present -
  a confirmed heap-buffer-overflow read that had been misdiagnosed as
  a MySQL thread-safety issue
This commit is contained in:
Brad Arant committed 2026-09-03 05:17:41 +00:00
1 parent a51a486560
commit c3e8d70774
14 files changed
+627 -89

No files matched your search

+35 -5
View File
@@ -14,11 +14,27 @@ namespace core {
maxSockets = 1000;
epfd = epoll_create1(0);
terminateThreads = false;
started = false;
}
EPoll::~EPoll() {}
// Was empty - if this EPoll's worker pool was started but stop() was
// never explicitly called (e.g. an exception unwinding the stack
// during startup, before the caller's own normal shutdown path could
// run), the pool just kept running against this object's - and every
// Socket registered with it's - soon-to-be-freed memory. stop() itself
// is what actually joins every worker thread before anything gets
// torn down; see Thread::~Thread()'s doc comment for the crash this
// was confirmed to cause. Guarded by `started` so a never-started
// EPoll (numberOfThreads/threads still default) doesn't call stop()
// over a garbage thread count, and by `!terminateThreads` so an
// EPoll that already went through a normal stop() doesn't do it
// (and close an already-closed epfd) twice.
EPoll::~EPoll() {
if (started && !terminateThreads)
stop();
}
bool EPoll::start(int numberOfThreads, int maxSockets) {
bool EPoll::start(int numberOfThreads, int maxSockets, ThreadScope *scope) {
coreutils::Log(coreutils::LOG_DEBUG_2) << "Starting epoll event processing.";
@@ -32,15 +48,20 @@ namespace core {
//----------------------------------------------------------------------
// Create thread objects into vector for number of threads requested.
// Hand all the threads a pointer to the EPoll object so they can run
// the socket handlers.
// the socket handlers - and, if given, the same shared ThreadScope
// so each one runs its onThreadStart()/onThreadEnd() hooks (see
// ThreadScope's own doc comment for why - e.g. MySQL client library
// per-thread init).
//----------------------------------------------------------------------
for(int ix = 0; ix < numberOfThreads; ++ix)
threads.emplace_back(*this);
threads.emplace_back(*this, scope);
for(int ix = 0; ix < numberOfThreads; ++ix)
threads[ix].start();
started = true;
return true;
}
@@ -74,7 +95,16 @@ namespace core {
int EPoll::processCommand(coreutils::ZString &request, TCPSession &session) {
int sequence = 0;
for(auto threadx : threads) {
// Was `for(auto threadx : threads)` - copied each live, running
// Thread by value. Harmless while ~Thread() was empty, but now
// that it actually joins and deletes the underlying std::thread*
// (see its own doc comment), a copy going out of scope at the end
// of each iteration would join and free the SAME thread the real
// vector entry still owns and expects to keep running - a
// double-free the next time anything lists threads on a live
// server (this method is reachable via the console's own command
// dispatch).
for(auto &threadx : threads) {
session.out << "|" << ++sequence;
threadx.output(session.out);
session.out << "|" << std::endl;