[PATCH v3 http-server 0/1] fix pveproxy OOM in websocket and spice proxy handlers

Kefu Chai
2026-04-24T12:19:31Z

see v2's cover letter [1] for the problem description and the approach.

Changes since v2:

* extract handle_proxy_eof(); the four on_eof sites were copy-paste of
each other with only $reader and the peer handle differing.

* fix a busy-loop in the on_eof drain loop: v2's unguarded
`while length($hdl->{rbuf})` spins when the reader's
`return if !$peer` short-circuits without consuming rbuf. reachable
on a ws client close that sets block_disconnect on the backend
handle, so a final reply from the backend pins the worker at 100%
CPU instead of completing teardown. the new loop bails on
peer-gone or zero progress.

* clear on_drain in apply_read_backpressure() after firing instead of
leaving the wrapper installed when prev_on_drain is undef. no
functional impact (idempotent re-set of on_read) but stops pinning
a reader reference for the rest of the connection.

both of the above are verified with the same synthetic AnyEvent setup
used for v1/v2. reverting just the busy-loop guard reproduces a spin
that trips a 2 s alarm; reverting just the on_drain clear leaves the
wrapper installed after the drain.

on the peer-gone branch the drain loop no-ops and rbuf is released on
handle teardown, same as the pre-v2 behavior (before this series added
on_eof draining, rbuf at on_eof was always discarded). I audited the
users:

* PDM migration's control tunnel (mtunnel) completes each command
synchronously via write_tunnel, so its teardown carries no protocol
data; disk data goes over separate NBD-over-ws tunnels set up by
forward_unix_socket, and a connection drop there surfaces as a clean
migration abort on the source side rather than silent corruption.
* NoVNC and SPICE display (plus termproxy shell output) lose at most a
final frame or line, cosmetic.
* SPICE USB passthrough is the one case with potential real data loss,
but that requires an abrupt ws client close mid-transfer, which is rare.

[1] https://lore.proxmox.com/pve-devel/20260413125650.2569621-1-k.chai@proxmox.com/

Kefu Chai (1):
fix #7483: apiserver: add backpressure to proxy handlers

src/PVE/APIServer/AnyEvent.pm | 178 +++++++++++++++++++++++++---------
1 file changed, 133 insertions(+), 45 deletions(-)

--
2.47.3