http2: canceled upload leaves session memory accounting over budget #66742

Activity

1. fatihguzeldev commented on Oct 15, 2026

   

   fatihguzeldev

   on Oct 15, 2026

   More actions

   still happens on main (38aa1f38819), even after the deferred cleanup runs.

   the cleanup clears the write queue but leaves the unsent bytes in the session memory count. should RemoveStream() subtract the remaining available_outbound_length_?
2. emerzon commented on Oct 18, 2026

   

   emerzon

   on Oct 18, 2026

   More actions

   The missing release is still present at f88a1d25e9d. It also shows up on the server when a response is still queued.

   DoWrite charges the session through IncrementAvailableOutboundLength. Provider::OnRead releases that credit as nghttp2 pulls data. CompleteDestroyCleanup then drops whatever is left in the queue and never calls DecrementAvailableOutboundLength. RemoveStream runs before that drain, so subtracting there is the wrong place: OnRead may already have released credit for bytes that are still sitting in the queue. The amount to release is the remaining available_outbound_length_, next to the queue drop. That is what #66784 does. Its test covers a canceled upload. The same counter leak happens for a server response.

   Once current_session_memory_ stays above maxSessionMemory, CanAddStream refuses new streams with RST_STREAM / NGHTTP2_ENHANCE_YOUR_CALM (11). max_rejected_streams is 100. After 101 such refusals, OnBeginHeadersCallback returns NGHTTP2_ERR_CALLBACK_FAILURE and the session ends with GOAWAY INTERNAL_ERROR (2) / ERR_HTTP2_ERROR. The documented default maxSessionMemory is 10.

   Reproduced with a 256 KiB response, client initialWindowSize: 4096, and req.destroy() after 8 KiB:

   {"MSM":2,"firstReject":8,"rejected":101,"death":109,"goaway":2,"serverError":"ERR_HTTP2_ERROR"}
   {"MSM":10,"firstReject":40,"rejected":101,"death":141,"goaway":2,"serverError":"ERR_HTTP2_ERROR"}
   {"MSM":32,"firstReject":126,"rejected":101,"death":227,"goaway":2,"serverError":"ERR_HTTP2_ERROR"}
   

   A client that keeps the default window and reads the body does not hit this. nghttp2 drains the queue, and OnRead has already released the credit by the time the stream is destroyed.

   'use strict';
   const http2 = require('node:http2');
   
   const BODY = Buffer.alloc(256 * 1024, 0x78);
   const MSM = Number(process.env.MSM || 10);
   const server = http2.createServer({
     maxSessionMemory: MSM,
     settings: { initialWindowSize: 65535 },
   });
   let serverError = null;
   server.on('session', (session) => {
     session.on('error', (error) => { serverError = error.code; });
   });
   server.on('stream', (stream) => {
     stream.on('error', () => {});
     stream.respond({ ':status': 200 });
     stream.end(BODY);
   });
   
   server.listen(0, '127.0.0.1', async () => {
     const session = http2.connect(`http://127.0.0.1:${server.address().port}`, {
       settings: { initialWindowSize: 4096 },
     });
     let goaway = null;
     session.on('error', () => {});
     session.on('goaway', (code) => { goaway = code; });
   
     let firstReject = null;
     let rejected = 0;
     for (let i = 0; i < 500; i++) {
       if (session.destroyed || session.closed) break;
       const req = session.request({ ':path': `/${i}` });
       let rst = null;
       let got = 0;
       req.on('error', (error) => { rst = error.code; });
       req.on('data', (chunk) => {
         got += chunk.length;
         if (got > 8000) req.destroy();
       });
       await new Promise((resolve) => {
         req.on('close', resolve);
         setTimeout(resolve, 1500);
       });
       if (rst === 'ERR_HTTP2_STREAM_ERROR') {
         rejected++;
         if (firstReject === null) firstReject = i;
       }
       if (goaway !== null) {
         console.log(JSON.stringify({
           MSM, firstReject, rejected, death: i, goaway, serverError,
         }));
         break;
       }
     }
     session.destroy();
     server.close();
   });