From 45a8ca0e7a1ae7ec4f7769919e9f3e007113d5ad Mon Sep 17 00:00:00 2001 From: Vladimir Homutov Date: Wed, 9 Feb 2022 15:51:42 +0300 Subject: [PATCH] QUIC: fixed in-flight bytes accounting. Initially, frames are genereated and stored in ctx->frames. Next, ngx_quic_output() collects frames to be sent in in ctx->sending. On failure, ngx_quic_revert_sned() returns frames into ctx->frames. On success, the ngx_quic_commit_send() moves ack-eliciting frames into ctx->sent and frees non-ack-eliciting frames. This function also updates in-flight bytes counter, so only actually sent frames are accounted. The counter is decremented in the following cases: - acknowledgment is received - packet was declared lost - we are discarding context completely In each of this cases frame is removed from ctx->sent queue and in-flight counter is accordingly decremented. The patch fixes the case of discarding context - only removing frames from ctx->sent must be followed by in-flight bytes counter decrement, otherwise cg->in_flight could experience type underflow. The issue appeared in b1676cd64dc9. --- src/event/quic/ngx_event_quic.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/event/quic/ngx_event_quic.c b/src/event/quic/ngx_event_quic.c index 2a51c79a7..66f63fe0e 100644 --- a/src/event/quic/ngx_event_quic.c +++ b/src/event/quic/ngx_event_quic.c @@ -1092,7 +1092,6 @@ ngx_quic_discard_ctx(ngx_connection_t *c, enum ssl_encryption_level_t level) ngx_queue_remove(q); f = ngx_queue_data(q, ngx_quic_frame_t, queue); - ngx_quic_congestion_ack(c, f); ngx_quic_free_frame(c, f); }