[DISPATCH-1776] HTTP/2 - grpc call causes segfault

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.15.0
• Component/s: Protocol Adaptors
• Sprint: Multi-Protocol Support
• Assignee: Ganesh Murthy
• Reporter: Gordon Sim
• Created: 18/Sep/20 09:30
• Updated: 11/Feb/21 17:55
• Resolved: 08/Feb/21 15:30

Description

Running a simple grpc echo (over http2) through the router causes a segfault.

To reproduce run router with (you can change the ports if desired, just be consistent with the server and client):

router {
    mode: interior
}

listener {
    host: 0.0.0.0
    port: amqp
    authenticatePeer: no
    saslMechanisms: ANONYMOUS
}

httpListener {
    host: 0.0.0.0
    port: 9090
    address: foo
    protocolVersion: HTTP2
}

httpConnector {
    host: 127.0.0.1
    port: 8080
    address: foo
    protocolVersion: HTTP2
}

log {
    module: HTTP_ADAPTOR
    enable: trace+
}

Then run grpc server with podman (or docker):

podman run -it -p8080:9000 quay.io/mhausenblas/yages:0.1.0

Then run grpc client, again with podman (or docker):

podman run -it --network=host quay.io/mhausenblas/gump:0.1 grpcurl --plaintext 127.0.0.1:9090 yages.Echo.Ping

I see segfault with following backtrace:

Thread 4 "qdrouterd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffeedb5700 (LWP 3841832)]
0x00007ffff7f4a417 in qd_compose_end_map () at /home/gordon/projects/dispatch/src/compose.c:179
179	    DEQ_INSERT_HEAD(field->fieldStack, comp);
Missing separate debuginfos, use: dnf debuginfo-install cyrus-sasl-lib-2.1.27-2.fc31.x86_64 keyutils-libs-1.6-3.fc31.x86_64 krb5-libs-1.17-46.fc31.x86_64 libcom_err-1.45.5-1.fc31.x86_64 libev-4.27-1.fc31.x86_64 libffi-3.1-23.fc31.x86_64 libnghttp2-1.41.0-1.fc31.x86_64 libselinux-2.9-5.fc31.x86_64 libuv-1.34.2-1.fc31.x86_64 libwebsockets-3.2.1-1.fc31.x86_64 libxcrypt-4.4.15-1.fc31.x86_64 openssl-libs-1.1.1d-2.fc31.x86_64 pcre2-10.34-8.fc31.x86_64 python3-libs-3.7.6-2.fc31.x86_64 zlib-1.2.11-20.fc31.x86_64
(gdb) bt
#0  0x00007ffff7f4a417 in qd_compose_end_map () at /home/gordon/projects/dispatch/src/compose.c:179
#1  0x00007ffff7f4008a in on_frame_recv_callback (session=<optimized out>, frame=0x64ea70, user_data=0x64a308) at /home/gordon/projects/dispatch/src/adaptors/http2/http2_adaptor.c:702
#2  0x00007ffff7a8c32e in nghttp2_session_mem_recv () from /lib64/libnghttp2.so.14
#3  0x00007ffff7f41bdd in handle_incoming_http (conn=0x64a308) at /home/gordon/projects/dispatch/src/adaptors/http2/http2_adaptor.h:149
#4  handle_connection_event (e=<optimized out>, qd_server=<optimized out>, context=0x64a308) at /home/gordon/projects/dispatch/src/adaptors/http2/http2_adaptor.c:1456
#5  0x00007ffff7f933f1 in handle_event_with_context (context=<optimized out>, qd_server=<optimized out>, e=<optimized out>) at /home/gordon/projects/dispatch/src/server.c:781
#6  do_handle_raw_connection_event (qd_server=<optimized out>, e=<optimized out>) at /home/gordon/projects/dispatch/src/server.c:787
#7  handle (qd_server=qd_server@entry=0x4371d0, e=e@entry=0x7fffe4000c20, pn_conn=pn_conn@entry=0x0, ctx=ctx@entry=0x0) at /home/gordon/projects/dispatch/src/server.c:1067
#8  0x00007ffff7f942c8 in thread_run (arg=0x4371d0) at /home/gordon/projects/dispatch/src/server.c:1099
#9  0x00007ffff7e7f4e2 in start_thread () from /lib64/libpthread.so.0
#10 0x00007ffff79b46d3 in clone () from /lib64/libc.so.6