Changeset 198429 in webkit

Timestamp:

Mar 18, 2016, 10:58:45 AM (10 years ago)

Author:

Antti Koivisto

Message:

Protect against excessive cache traversal
​https://bugs.webkit.org/show_bug.cgi?id=155635
rdar://problem/24241008

Reviewed by Darin Adler.

We can't handle unlimited number of parallel cache traversal requests from the client.
We'll run out of dispatch queues and other system resources. CPU will spin.

• NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::traverse):

Add limit of maximum 3 traversals. When exceeded return nothing and log an error.

• NetworkProcess/cache/NetworkCache.h:

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/cache/NetworkCache.cpp (modified) (1 diff)
• NetworkProcess/cache/NetworkCache.h (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-03-18  Antti Koivisto  <antti@apple.com>
+
+        Protect against excessive cache traversal
+        https://bugs.webkit.org/show_bug.cgi?id=155635
+        rdar://problem/24241008
+
+        Reviewed by Darin Adler.
+
+        We can't handle unlimited number of parallel cache traversal requests from the client.
+        We'll run out of dispatch queues and other system resources. CPU will spin.
+
+        * NetworkProcess/cache/NetworkCache.cpp:
+        (WebKit::NetworkCache::Cache::traverse):
+
+            Add limit of maximum 3 traversals. When exceeded return nothing and log an error.
+
+        * NetworkProcess/cache/NetworkCache.h:
+
 2016-03-18  Darin Adler  <darin@apple.com>
 

trunk/Source/WebKit2/NetworkProcess/cache/NetworkCache.cpp

@@ -522 +522 @@
     ASSERT(isEnabled());
 
-    m_storage->traverse(resourceType(), 0, [traverseHandler](const Storage::Record* record, const Storage::RecordInfo& recordInfo) {
+    // Protect against clients making excessive traversal requests.
+    const unsigned maximumTraverseCount = 3;
+    if (m_traverseCount >= maximumTraverseCount) {
+        WTFLogAlways("Maximum parallel cache traverse count exceeded. Ignoring traversal request.");
+
+        RunLoop::main().dispatch([traverseHandler] {
+            traverseHandler(nullptr);
+        });
+        return;
+    }
+
+    ++m_traverseCount;
+
+    m_storage->traverse(resourceType(), 0, [this, traverseHandler](const Storage::Record* record, const Storage::RecordInfo& recordInfo) {
         if (!record) {
+            --m_traverseCount;
             traverseHandler(nullptr);
             return;

trunk/Source/WebKit2/NetworkProcess/cache/NetworkCache.h

@@ -136 +136 @@
 #endif
     std::unique_ptr<Statistics> m_statistics;
+
+    unsigned m_traverseCount { 0 };
 };