hhvm-redis-bug

4.2.1.1   fgets

implement of fgets hphp/runtime/ext/ext_file.cpp

Variant f_fgets(const Resource& handle, int64_t length /* = 0 */) {
  if (length < 0) {
    throw_invalid_argument("length (negative): %" PRId64, length);
    return false;
  }
  CHECK_HANDLE(handle, f);
  String line = f->readLine(length);
  if (!line.isNull()) {
    return line;
  }
  return false;
}

hphp/runtime/base/file.cpp:readLine:

1   String File::readLine(int64_t maxlen /* = 0 */) {
2     size_t current_buf_size = 0;
3     size_t total_copied = 0;
4     char *ret = nullptr;
5     for (;;) {
6       int64_t avail = bufferedLen();
7       if (avail > 0) {
8         int64_t cpysz = 0;
9         bool done = false;
10
11        char *readptr = m_buffer + m_readpos;
12        const char *eol;
13        const char *cr;
14        const char *lf;
15        cr = (const char *)memchr(readptr, '\r', avail);
16        lf = (const char *)memchr(readptr, '\n', avail);
17        if (cr && lf != cr + 1 && !(lf && lf < cr)) {
18          /* mac */
19          eol = cr;
20        } else if ((cr && lf && cr == lf - 1) || (lf)) {
21          /* dos or unix endings */
22          eol = lf;
23        } else {
24          eol = cr;
25        }
26
27        if (eol) {
28          cpysz = eol - readptr + 1;
29          done = true;
30        } else {
31          cpysz = avail;
32        }
33        if (maxlen > 0 && maxlen <= cpysz) {
34          cpysz = maxlen;
35          done = true;
36        }
37
38        current_buf_size += cpysz + 1;
39        if (ret) {
40          ret = (char *)realloc(ret, current_buf_size);
41        } else {
42          ret = (char *)malloc(current_buf_size);
43        }
44        memcpy(ret + total_copied, readptr, cpysz);
45
46        m_position += cpysz;
47        m_readpos += cpysz;
48        maxlen -= cpysz;
49        total_copied += cpysz;
50
51        if (done) {
52          break;                              ////////////////////////// 1: eol 或者读到了maxlen
53        }
54      } else if (eof()) {
55        break;                                /////////////////////////  2: eof
56      } else {
57        if (m_buffer == nullptr) {
58          m_buffer = (char *)malloc(CHUNK_SIZE);
59          m_bufferSize = CHUNK_SIZE;
60        }
61        m_writepos = filteredReadToBuffer();
62        m_readpos = 0;
63        if (bufferedLen() == 0) {
64          break;                              /////////////////////////  3: 一次读返回空.
65        }
66      }
67    }
68
69    if (total_copied == 0) {
70      assert(ret == nullptr);
71      return String();
72    }
73
74    ret[total_copied] = '\0';
75    return String(ret, total_copied, AttachString);
76  }

看这个长函数, 有几个情况会返回, 我在代码中标了1, 2, 3. 根据fgets的定义, 1,2两处返回是合理的, 3不应该返回, 而应该继续读, 这就是 fgets的bug

这个函数的另一个问题是, 如果一个socket上发来 abc\r\n, 但是一次读只读到 abc\r 的时候, 它就会返回以 \r 结尾的一行, 这个问题, Redis.php已经针对它做了专门的适配, 这里不讨论:

protected function sockReadLine() {
  if (!$this->checkConnection()) {
    return false;
  }
  $line = fgets($this->connection);
  if (substr($line, -2) == "\r\n") {
    $line = substr($line, 0, -2);
  } else if (substr($line, -1) == "\r") {             //就是这里.
    $line = substr($line, 0, -1);
    $lf = fgetc($this->connection);
    if ($lf === false) {
      // A response must terminate with both CR and LF. Refuse to guess.
      return false;
    } else if ($lf !== "\n") {
      throw new RedisException("Protocol error: CR not followed by LF");
    }
  }

  return $line;
}

4.2.1.2   readImpl

上面的readLine会调用filteredReadToBuffer 来read more bytes, 实际上就是调用readImpl(), 下面我们分析readImpl可能返回空的情况:

int64_t File::filteredReadToBuffer() {
  int64_t bytes_read = readImpl(m_buffer, CHUNK_SIZE);
  if (LIKELY(m_readFilters.empty())) {
    return bytes_read;
  }

readImpl for Socket: hphp/runtime/base/socket.cpp::readImpl:

1   int64_t Socket::readImpl(char *buffer, int64_t length) {
2     assert(m_fd);
3     assert(length > 0);
4
5     IOStatusHelper io("socket::recv", m_address.c_str(), m_port);
6
7     int recvFlags = 0;
8     if (m_timeout > 0) {
9       int flags = fcntl(m_fd, F_GETFL, 0);  // ning: we will get into this.
10      if ((flags & O_NONBLOCK) == 0) {
11        if (!waitForData()) {
12          m_eof = true;
13          return 0;
14        }
15        recvFlags = MSG_DONTWAIT; // polled, so no need to wait any more
16      }
17    }
18
19    int64_t ret = recv(m_fd, buffer, length, recvFlags);
20    if (ret == 0 || (ret == -1 && errno != EWOULDBLOCK)) {
21      m_eof = true;
22    }
23    return (ret < 0) ? 0 : ret;
24  }
25
26  bool Socket::waitForData() {
27    m_timedOut = false;
28    while (true) {
29      struct pollfd fds[1];
30      fds[0].fd = m_fd;
31      fds[0].events = POLLIN|POLLERR|POLLHUP;
32      if (poll(fds, 1, m_timeout / 1000)) {
33        socklen_t lon = sizeof(int);
34        int valopt;
35        getsockopt(m_fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);
36        if (valopt == EINTR) continue;
37        return valopt == 0;
38      } else {
39        m_timedOut = true;
40        return true;
41      }
42    }
43    return false;
44  }

Socket::readImpl 会进入11行的waitForData函数(从strace结果看, 这里m_timeout是设为100*1000的):

recvfrom(7, 0x7fff5be32f00, 1, 66, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)
fcntl(7, F_GETFL)                       = 0x2 (flags O_RDWR)
poll([{fd=7, events=POLLIN|POLLERR|POLLHUP, revents=POLLIN}], 1, 100) = 1

我们可以先不管m_timeout怎么设置的, 这个值设为多大, 或者设为0, 都不影响分析, 看waitForData函数, 如果poll超时后没有收到事件, 就会设置m_timedOut=true, 并且return true.

所以此时 readImpl 进入 19行recv, 明显是返回 EAGAIN 的:

poll([{fd=7, events=POLLIN|POLLERR|POLLHUP}], 1, 100) = 0
recvfrom(7, 0x7f3a3d9e2000, 8192, 64, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)

EAGAIN就是EWOULDBLOCK, 所以这里没有进入21行, 而是进入23行, 返回 ret = 0 .