tls: fix disconnects for sessions with pending data

TLS can enqueue events to itself when app session queue cannot be
entirely drained. If a pending disconnect is handled before any such
event, session layer may try to dequeue data on deallocated sessions.

Change-Id: I5bfc4d53ce95bc16b6a01e1b0e644aafa1ca311b
Signed-off-by: Florin Coras <fcoras@cisco.com>

3 files changed, 13 insertions, 4 deletions

diff --git a/src/vnet/session/session.c b/src/vnet/session/session.c
index 3eaf9846709..372a6f93a95 100644
--- a/src/vnet/session/session.c
+++ b/src/vnet/session/session.c
@@ -69,6 +69,7 @@ session_send_evt_to_thread (void *data, void *args, u32 thread_index,
     case FIFO_EVENT_BUILTIN_RX:
       evt->fifo = data;
       break;
+    case FIFO_EVENT_BUILTIN_TX:
     case FIFO_EVENT_DISCONNECT:
       evt->session_handle = session_handle ((stream_session_t *) data);
       break;
@@ -89,10 +90,10 @@ session_send_io_evt_to_thread (svm_fifo_t * f, session_evt_type_t evt_type)
 }
 
 int
-session_send_io_evt_to_thread_custom (svm_fifo_t * f, u32 thread_index,
+session_send_io_evt_to_thread_custom (void *data, u32 thread_index,
 				      session_evt_type_t evt_type)
 {
-  return session_send_evt_to_thread (f, 0, thread_index, evt_type);
+  return session_send_evt_to_thread (data, 0, thread_index, evt_type);
 }
 
 int
diff --git a/src/vnet/session/session.h b/src/vnet/session/session.h
index aa827556d45..1e08cccb6f7 100644
--- a/src/vnet/session/session.h
+++ b/src/vnet/session/session.h
@@ -38,6 +38,7 @@ typedef enum
   SESSION_IO_EVT_CT_TX,
   FIFO_EVENT_DISCONNECT,
   FIFO_EVENT_BUILTIN_RX,
+  FIFO_EVENT_BUILTIN_TX,
   FIFO_EVENT_RPC,
   SESSION_CTRL_EVT_BOUND,
   SESSION_CTRL_EVT_ACCEPTED,
@@ -557,7 +558,7 @@ void stream_session_disconnect_transport (stream_session_t * s);
 void stream_session_cleanup (stream_session_t * s);
 int session_send_io_evt_to_thread (svm_fifo_t * f,
 				   session_evt_type_t evt_type);
-int session_send_io_evt_to_thread_custom (svm_fifo_t * f, u32 thread_index,
+int session_send_io_evt_to_thread_custom (void *data, u32 thread_index,
 					  session_evt_type_t evt_type);
 void session_send_rpc_evt_to_thread (u32 thread_index, void *fp,
 				     void *rpc_args);
diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index e2a6f4c67c6..9a954bb127b 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -730,6 +730,8 @@ session_tx_fifo_dequeue_internal (vlib_main_t * vm,
 				  stream_session_t * s, int *n_tx_pkts)
 {
   application_t *app;
+  if (PREDICT_FALSE (s->session_state == SESSION_STATE_CLOSED))
+    return 0;
   app = application_get (s->t_app_index);
   svm_fifo_unset_event (s->server_tx_fifo);
   return app->cb_fns.builtin_app_tx_callback (s);
@@ -878,13 +880,18 @@ skip_dequeue:
 	  break;
 	case FIFO_EVENT_BUILTIN_RX:
 	  s = session_event_get_session (e, thread_index);
-	  if (PREDICT_FALSE (!s))
+	  if (PREDICT_FALSE (!s || s->session_state >= SESSION_STATE_CLOSING))
 	    continue;
 	  svm_fifo_unset_event (s->server_rx_fifo);
 	  app_wrk = app_worker_get (s->app_wrk_index);
 	  app = application_get (app_wrk->app_index);
 	  app->cb_fns.builtin_app_rx_callback (s);
 	  break;
+	case FIFO_EVENT_BUILTIN_TX:
+	  s = session_get_from_handle_if_valid (e->session_handle);
+	  if (PREDICT_TRUE (s != 0))
+	    session_tx_fifo_dequeue_internal (vm, node, e, s, &n_tx_packets);
+	  break;
 	case FIFO_EVENT_RPC:
 	  fp = e->rpc_args.fp;
 	  (*fp) (e->rpc_args.arg);