Observed below crash with trafficserver 9.2.13
#0 MIOBufferAccessor::reader_for (areader=0x0, this=0x55aeaad6de88) at /iocore/eventsystem/P_IOBuffer.h:1037
#1 INKVConnInternal::do_io_write (this=0x55aeaad6dd80, c=0x7f22cc7a9d78, nbytes=0, buf=0x0, owner=false) at traffic_server/InkAPI.cc:1219
#2 in HttpTunnel::abort_tunnel (this=this@entry=0x7f22cc7a9d78) at HttpTunnel.cc:608
#3 in HttpSM::state_read_server_response_header (this=0x7f22cc7a8d60, event=100, data=0x55aeaac5ba10) at HttpSM.cc:2083
#4 in HttpSM::main_handler (this=0x7f22cc7a8d60, event=100, data=0x55aeaac5ba10) at HttpSM.cc:2763
#5 in Continuation::handleEvent (data=0x55aeaac5ba10, event=100, this=0x7f22cc7a8d60) at /iocore/eventsystem/I_Continuation.h:227
#6 Continuation::handleEvent (data=0x55aeaac5ba10, event=100, this=0x7f22cc7a8d60) at /iocore/eventsystem/I_Continuation.h:223
#7 read_signal_and_update (event=100, vc=0x55aeaac5b820) at UnixNetVConnection.cc:83
#8 in UnixNetVConnection::readSignalAndUpdate (this=<optimized out>, event=<optimized out>) at UnixNetVConnection.cc:972
#9 in SSLNetVConnection::net_read_io (this=0x55aeaac5b820, nh=0x7f22cffc2410, lthread=<optimized out>) at SSLNetVConnection.cc:691
#10 in NetHandler::process_ready_list (this=this@entry=0x7f22cffc2410) at UnixNet.cc:428
#11 in NetHandler::waitForActivity (this=0x7f22cffc2410, timeout=<optimized out>) at UnixNet.cc:565
#12 in EThread::execute_regular (this=this@entry=0x7f22cffbe010) at UnixEThread.cc:292
#13 in EThread::execute (this=0x7f22cffbe010) at UnixEThread.cc:353
#14 in spawn_thread_internal (a=0x55aeaa92e3d0) at Thread.cc:78
#15 in start_thread () from /lib/x86_64/libc.so.6
#16 in clone3 () from /lib/x86_64/libc.so.6
Environment Details:
ATS Version: 9.2.13
Platform: Linux x86_64
Compiler: g++ 11.5.0
In ATS 9.2.13, When an origin responds before ATS has finished forwarding a request body,HttpTunnel::abort_tunnel() can cancel the request transform by calling INKVConnInternal::do_io_write() with a null IOBufferReader. It calls reader_for(buf) unconditionally. Passingbuf == nullptr therefore causes a null-pointer dereference and SIGSEGV.
Reproduced crash using below script
reproduce_ats_crash.cpp
Observed below crash with trafficserver 9.2.13
Environment Details:
ATS Version: 9.2.13
Platform: Linux x86_64
Compiler: g++ 11.5.0
In ATS 9.2.13, When an origin responds before ATS has finished forwarding a request body,
HttpTunnel::abort_tunnel()can cancel the request transform by callingINKVConnInternal::do_io_write()with a nullIOBufferReader. It callsreader_for(buf)unconditionally. Passingbuf == nullptrtherefore causes a null-pointer dereference and SIGSEGV.Reproduced crash using below script
reproduce_ats_crash.cpp