[Varnish] #1562: panic when retrying a short read of req.body - Wrong req_body_status in HTTP1_IterateReqBody()

[Varnish]

#1562: panic when retrying a short read of req.body - Wrong req_body_status in
HTTP1_IterateReqBody()
----------------------+---------------------
 Reporter:  slink     |      Owner:  slink
     Type:  defect    |     Status:  new
 Priority:  high      |  Milestone:
Component:  varnishd  |    Version:  unknown
 Severity:  critical  |   Keywords:
----------------------+---------------------
 I will attach a preliminary test case for this, of which the output is
 given below.

 The test case needs a change to vtc_http in order to prematurely close a
 client connection. The attached patch is not a proper solution to this vtc
 requirement.

 {{{
 ***  v1    1.5 debug| Child (18542) died signal=6\n
 ***  v1    1.5 debug| Child (18542) Panic message:\n
 ***  v1    1.5 debug| Wrong turn at cache/cache_http1_fsm.c:574:\n
 ***  v1    1.5 debug| Wrong req_body_status in HTTP1_IterateReqBody()\n
 ***  v1    1.5 debug| thread = (cache-worker)\n
 ***  v1    1.5 debug| ident =
 Linux,3.13-1-amd64,x86_64,-smalloc,-smalloc,-hcritbit,epoll\n
 ***  v1    1.5 debug| Backtrace:\n
 ***  v1    1.5 debug|   0x4323f8: pan_ic+0xd8\n
 ***  v1    1.5 debug|   0x42d3b8: HTTP1_IterateReqBody+0x178\n
 ***  v1    1.5 debug|   0x42b12d: V1F_fetch_hdr+0x10d\n
 ***  v1    1.5 debug|   0x41fe96: vbf_fetch_thread+0x10a6\n
 ***  v1    1.5 debug|   0x434fe9: Pool_Work_Thread+0x389\n
 ***  v1    1.5 debug|   0x4476cd: wrk_thread_real+0xad\n
 ***  v1    1.5 debug|   0x7fdee09d80ca: /lib/x86_64-linux-
 gnu/libpthread.so.0(+0x80ca) [0x7fdee09d80ca]\n
 ***  v1    1.5 debug|   0x7fdee070d06d: /lib/x86_64-linux-
 gnu/libc.so.6(clone+0x6d) [0x7fdee070d06d]\n
 ***  v1    1.5 debug|   busyobj = 0x7fdeb80008e0 {\n
 ***  v1    1.5 debug|     ws = 0x7fdeb80009a0 {\n
 ***  v1    1.5 debug|       id = "bo",\n
 ***  v1    1.5 debug|       {s,f,r,e} =
 {0x7fdeb80028c0,+112,(nil),+57376},\n
 ***  v1    1.5 debug|     },\n
 ***  v1    1.5 debug|   refcnt = 2\n
 ***  v1    1.5 debug|   retries = 1\n
 ***  v1    1.5 debug|   failed = 0\n
 ***  v1    1.5 debug|   state = 1\n
 ***  v1    1.5 debug|     is_do_stream\n
 ***  v1    1.5 debug|     is_do_pass\n
 ***  v1    1.5 debug|     is_uncacheable\n
 ***  v1    1.5 debug|     bodystatus = 0 (none),\n
 ***  v1    1.5 debug|     },\n
 ***  v1    1.5 debug|     http[bereq] = {\n
 ***  v1    1.5 debug|       ws = 0x7fdeb80009a0[bo]\n
 ***  v1    1.5 debug|         "POST",\n
 ***  v1    1.5 debug|         "/",\n
 ***  v1    1.5 debug|         "HTTP/1.1",\n
 ***  v1    1.5 debug|         "Content-Length: 10000",\n
 ***  v1    1.5 debug|         "X-Forwarded-For: 127.0.0.1",\n
 ***  v1    1.5 debug|         "X-Varnish: 1003",\n
 ***  v1    1.5 debug|         "Host: 127.0.0.1",\n
 ***  v1    1.5 debug|     },\n
 ***  v1    1.5 debug|     http[beresp] = {\n
 ***  v1    1.5 debug|       ws = 0x7fdeb80009a0[bo]\n
 ***  v1    1.5 debug|     },\n
 ***  v1    1.5 debug|     ws = 0x7fdeb8000b28 { BAD_MAGIC(0x00000000) },\n
 ***  v1    1.5 debug|     },\n
 ***  v1    1.5 debug|   objcore (FETCH) = 0x7fdea0000950 {\n
 ***  v1    1.5 debug|     refcnt = 2\n
 ***  v1    1.5 debug|     flags = 0x102\n
 ***  v1    1.5 debug|     objhead = 0xcfd420\n
 ***  v1    1.5 debug|   }\n
 ***  v1    1.5 debug|   }\n
 ***  v1    1.5 debug| \n
 ***  v1    1.5 debug| \n
 }}}

-- 
Ticket URL: <https://www.varnish-cache.org/trac/ticket/1562>
Varnish <https://varnish-cache.org/>
The Varnish HTTP Accelerator