Bug ID 454583: SPDY may cause the TMM to crash if it aborts while there are stalled streams.

Last Modified: Nov 07, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.10, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1

Fixed In:
11.6.0, 11.5.4 HF2, 11.4.1 HF4

Opened: Mar 28, 2014
Severity: 2-Critical
Related Article:
K16432

Symptoms

If SPDY has a stalled stream and it is being aborted, it may cause the TMM to crash due to referencing cleared state. 100 Continue messages appeared in response bodies. 100 Continue responses sent in the same packet as the response could stall the stream.

Impact

Traffic disrupted while tmm restarts.

Conditions

SPDY aborts due to a miss-ordered event. SPDY then sees egress, and marks the stream as stalled. SPDY aborts the connection to the client, and marks the stream as unknown. Finally, the stream aborts again and dereferences the NULL pointer to the client when it tries to unstall itself. A 100 Continue message in a response, either by itself, or in the same packet as the response body.

Workaround

This issue has no workaround at this time.

Fix Information

SPDY will no longer cause a TMM crash when it aborts, followed by egress, followed by a second abort. SPDY will handle 100 Continue messages correctly by ignoring them.

Behavior Change