[10.2][remap] Data race on shared RemapPluginInfo plugin-context save/restore slot

Branch: 10.2.x (10.2.1, commit 31f1f2f3b) · Severity: high · ✓ adversarially verified
Location: src/proxy/http/remap/RemapPluginInfo.cc:278

What's wrong

setPluginContext() / resetPluginContext() save the previous thread-local pluginThreadContext into a plain instance member PluginThreadContext *_tempContext (RemapPluginInfo.h:113), not a stack variable. RemapPluginInfo::doRemap() runs concurrently on every net thread for every remapped request through the same RemapPluginInfo object, and indicatePreReload()/indicatePostReload() run on the reload thread concurrently with in-flight doRemap() calls. All of them read/write the single shared _tempContext with no synchronization — an unconditional data race. When the saved previous context differs between threads, one thread can restore another thread's value, leaving a wrong or null pluginThreadContext; a subsequent TSContCreate then fails to take (or misattributes) the DSO refcount.

Fix

Save the previous context in a stack local at each entry point and pass it back to resetPluginContext; delete the _tempContext member. PR attached.

Testing

Compiles cleanly on 10.2.x (dev preset); libhttp_remap.a builds. clang-format clean.

Verification

Re-traced on the 10.2.1 tree and confirmed: no mutex guards these paths, concurrent HttpSMs hold distinct mutexes, and the reload callbacks run over the same object concurrently with doRemap. The plugin-api reviewer noted this "has a fix in the development tree that was never carried into this 10.2 release branch."

From an automated multi-lens audit of the 10.2.x branch. Full report on branch claude/codebase-audit-review-9nw7vz (CODEBASE_AUDIT_10.2.md).

Start in src/proxy/http/remap/RemapPluginInfo.cc around line 278 and RemapPluginInfo.h around line 113; trace setPluginContext(), resetPluginContext(), doRemap(), indicatePreReload(), and indicatePostReload(). Build the 10.2.x dev preset and libhttp_remap.a, then verify the shared temporary context is no longer used and clang-format remains clean.