grpc 1.81.0 → 1.82.0.pre1

data/src/core/ext/transport/chttp2/server/chttp2_server.h

@@ -26,11 +26,14 @@
 
 #include <functional>
 
+#include "src/core/ext/transport/chttp2/transport/http2_server_transport.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
 #include "src/core/handshaker/handshaker.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/server/server.h"
+#include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
 
@@ -131,7 +134,8 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
     // Set by HandshakingState before the handshaking begins and set to a valid
     // transport when handshaking is done successfully.
     std::variant<OrphanablePtr<HandshakingState>,
-                 RefCountedPtr<grpc_chttp2_transport>>
+                 RefCountedPtr<grpc_chttp2_transport>,
+                 RefCountedPtr<http2::Http2ServerTransport>>
         state_;
     grpc_closure on_close_;
     bool shutdown_ = false;
@@ -204,6 +208,11 @@ class NewChttp2ServerListener : public Server::ListenerInterface {
         .GetObject<grpc_event_engine::experimental::EventEngine>();
   }
 
+  RefCountedPtr<MitigationEngine> mitigation_engine() const {
+    auto* provider = args_.GetObject<MitigationEngineProvider>();
+    return provider != nullptr ? provider->GetEngine() : nullptr;
+  }
+
   grpc_tcp_server* tcp_server_ = nullptr;
   grpc_resolved_address resolved_address_;
   RefCountedPtr<Server::ListenerState> listener_state_;

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -97,6 +97,7 @@
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/lib/transport/transport_framing_endpoint_extension.h"
+#include "src/core/mitigation_engine/mitigation_engine.h"
 #include "src/core/telemetry/call_tracer.h"
 #include "src/core/telemetry/context_list_entry.h"
 #include "src/core/telemetry/default_tcp_tracer.h"
@@ -155,6 +156,8 @@ static bool g_default_client_keepalive_permit_without_calls = false;
 static bool g_default_server_keepalive_permit_without_calls = false;
 
 #define MAX_CLIENT_STREAM_ID 0x7fffffffu
+uint32_t g_pending_induced_frames_hard_limit =
+    2u * DEFAULT_MAX_PENDING_INDUCED_FRAMES;
 
 // forward declarations of various callbacks that we'll build closures around
 static void write_action_begin_locked(
@@ -500,6 +503,7 @@ static void read_channel_args(grpc_chttp2_transport* t,
           .GetDurationFromIntMillis(GRPC_ARG_HTTP_TARPIT_MAX_DURATION_MS)
           .value_or(grpc_core::Duration::Seconds(1))
           .millis();
+  GRPC_CHECK(t->min_tarpit_duration_ms <= t->max_tarpit_duration_ms);
   t->max_header_list_size_soft_limit =
       grpc_core::GetSoftLimitFromChannelArgs(channel_args);
 
@@ -696,6 +700,7 @@ void grpc_chttp2_transport::WriteSecurityFrameLocked(
             GRPC_ERROR_CREATE("Unexpected SECURITY frame scheduled for write"),
             grpc_core::StatusIntProperty::kRpcStatus,
             GRPC_STATUS_FAILED_PRECONDITION));
+    return;
   }
   grpc_core::SliceBuffer security_frame;
   grpc_chttp2_security_frame_create(data->c_slice_buffer(), data->Length(),
@@ -736,7 +741,12 @@ grpc_chttp2_transport::grpc_chttp2_transport(
           channel_args.GetBool(GRPC_ARG_HTTP2_BDP_PROBE).value_or(true),
           &memory_owner),
       deframe_state(is_client ? GRPC_DTS_FH_0 : GRPC_DTS_CLIENT_PREFIX_0),
-      is_client(is_client) {
+      is_client(is_client),
+      mitigation_engine([&]() {
+        auto* provider =
+            channel_args.GetObject<grpc_core::MitigationEngineProvider>();
+        return provider == nullptr ? nullptr : provider->GetEngine();
+      }()) {
   context_list = new grpc_core::ContextList();
 
   if (channel_args.GetBool(GRPC_ARG_TCP_TRACING_ENABLED).value_or(false) &&
@@ -884,7 +894,12 @@ static void close_transport_locked(grpc_chttp2_transport* t,
     connectivity_state_set(t, GRPC_CHANNEL_SHUTDOWN, absl::Status(),
                            "close_transport");
     // TODO(roth, ctiller): Provide better disconnect info here.
-    t->NotifyStateWatcherOnDisconnectLocked(t->closed_with_error, {});
+    grpc_core::Transport::StateWatcher::DisconnectInfo disconnect_info;
+    if (t->sent_goaway_state == GRPC_CHTTP2_FINAL_GOAWAY_SENT) {
+      disconnect_info.reason = grpc_core::Transport::StateWatcher::kGoaway;
+    }
+    t->NotifyStateWatcherOnDisconnectLocked(t->closed_with_error,
+                                            disconnect_info);
     if (t->keepalive_ping_timeout_handle != TaskHandle::kInvalid) {
       t->event_engine->Cancel(std::exchange(t->keepalive_ping_timeout_handle,
                                             TaskHandle::kInvalid));
@@ -2012,6 +2027,25 @@ void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id) {
   }
 }
 
+grpc_error_handle grpc_chttp2_increase_num_pending_induced_frames(
+    grpc_chttp2_transport* t) {
+  t->num_pending_induced_frames++;
+  if (grpc_core::IsMemoryOptimization01Enabled()) {
+    if (GPR_UNLIKELY(t->num_pending_induced_frames >=
+                     g_pending_induced_frames_hard_limit)) {
+      LOG(ERROR) << "Too many pending induced frames. Closing transport.";
+      return GRPC_ERROR_CREATE("Too many pending induced frames");
+    }
+  }
+
+  return absl::OkStatus();
+}
+
+void grpc_chttp2_close_transport_locked(grpc_chttp2_transport* t,
+                                        grpc_error_handle error) {
+  close_transport_locked(t, error);
+}
+
 void grpc_chttp2_keepalive_timeout(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
   t->combiner->Run(
@@ -2508,8 +2542,12 @@ void grpc_chttp2_cancel_stream(
             if (t->is_client && !sent_initial_metadata) {
               return;
             }
-            grpc_chttp2_add_rst_stream_to_next_write(
+            grpc_error_handle error = grpc_chttp2_add_rst_stream_to_next_write(
                 t, id, static_cast<uint32_t>(http_error), nullptr);
+            if (GPR_UNLIKELY(!error.ok())) {
+              grpc_chttp2_close_transport_locked(t, error);
+              return;
+            }
             grpc_chttp2_initiate_write(t,
                                        GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
           });
@@ -2855,9 +2893,12 @@ static void close_from_api(
           grpc_slice_buffer_add(&t->qbuf, message_slice.TakeCSlice());
         }
         grpc_chttp2_reset_ping_clock(t);
-        grpc_chttp2_add_rst_stream_to_next_write(
+        grpc_error_handle error = grpc_chttp2_add_rst_stream_to_next_write(
             t, id, static_cast<intptr_t>(Http2ErrorCode::kNoError), nullptr);
-
+        if (GPR_UNLIKELY(!error.ok())) {
+          grpc_chttp2_close_transport_locked(t, error);
+          return;
+        }
         grpc_chttp2_initiate_write(t,
                                    GRPC_CHTTP2_INITIATE_WRITE_CLOSE_FROM_API);
       });
@@ -2979,6 +3020,7 @@ static void read_action_parse_loop_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle error) {
   GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("read_action_parse_loop_locked");
+  bool should_reset_buffer = true;
   if (t->closed_with_error.ok()) {
     grpc_error_handle errors[3] = {error, absl::OkStatus(), absl::OkStatus()};
     size_t requests_started = 0;
@@ -3004,6 +3046,19 @@ static void read_action_parse_loop_locked(
       } else {
         errors[1] = std::move(std::get<absl::Status>(r));
       }
+
+      if (grpc_core::IsMemoryOptimization02Enabled()) {
+        if (errors[1].ok() && (i + 1 < t->read_buffer.count) &&
+            t->num_pending_induced_frames >=
+                DEFAULT_MAX_PENDING_INDUCED_FRAMES) {
+          for (size_t j = 0; j <= i; j++) {
+            grpc_core::CSliceUnref(
+                grpc_slice_buffer_take_first(&t->read_buffer));
+          }
+          should_reset_buffer = false;
+          break;
+        }
+      }
     }
     if (errors[1] != absl::OkStatus()) {
       errors[2] = try_http_parsing(t.get());
@@ -3045,7 +3100,9 @@ static void read_action_parse_loop_locked(
       maybe_reset_keepalive_ping_timer_locked(t.get());
     }
   }
-  grpc_slice_buffer_reset_and_unref(&t->read_buffer);
+  if (should_reset_buffer) {
+    grpc_slice_buffer_reset_and_unref(&t->read_buffer);
+  }
 
   if (keep_reading) {
     if (t->num_pending_induced_frames >= DEFAULT_MAX_PENDING_INDUCED_FRAMES) {
@@ -3084,6 +3141,16 @@ static void read_action_locked(
 
 static void continue_read_action_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  if (grpc_core::IsMemoryOptimization02Enabled()) {
+    if (t->read_buffer.count > 0) {
+      auto* tp = t.get();
+      tp->combiner->Run(
+          grpc_core::InitTransportClosure<read_action_parse_loop_locked>(
+              std::move(t), &tp->read_action_locked),
+          absl::OkStatus());
+      return;
+    }
+  }
   const bool urgent = !t->goaway_error.ok();
   auto* tp = t.get();
   grpc_endpoint_read(tp->ep.get(), &tp->read_buffer,

data/src/core/ext/transport/chttp2/transport/chttp2_transport.h

@@ -28,6 +28,7 @@
 
 #include "src/core/channelz/channelz.h"
 #include "src/core/ext/transport/chttp2/transport/flow_control.h"
+#include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/buffer_list.h"

data/src/core/ext/transport/chttp2/transport/flow_control.cc

@@ -315,7 +315,7 @@ FlowControlAction TransportFlowControl::PeriodicUpdate() {
                         Http2Settings::max_max_frame_size()),
                   &action, &FlowControlAction::set_send_max_frame_size_update);
 
-    if (IsTcpFrameSizeTuningEnabled()) {
+    if (IsTcpFrameSizeTuningEnabled() && ph2_enable_rx_crypto_) {
       // Advertise PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE to peer. By advertising
       // PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE to the peer, we are informing the
       // peer that we have tcp frame size tuning enabled and we inform it of our

data/src/core/ext/transport/chttp2/transport/flow_control.h

@@ -206,6 +206,10 @@ class TransportFlowControl final {
   ~TransportFlowControl() {}
 
   bool bdp_probe() const { return enable_bdp_probe_; }
+  bool ph2_enable_rx_crypto() const { return ph2_enable_rx_crypto_; }
+  void set_ph2_enable_rx_crypto(const bool enable) {
+    ph2_enable_rx_crypto_ = enable;
+  }
 
   // Returns a non-zero announce if we should send a transport update to our
   // peer, else returns zero; writing_anyway indicates if a write would happen
@@ -471,6 +475,13 @@ class TransportFlowControl final {
   uint32_t acked_init_window_ = kDefaultWindow;
   uint32_t sent_init_window_ = kDefaultWindow;
   absl::flat_hash_set<uint32_t> window_update_list_;
+
+  // Preferred_rx_crypto_frame_sizes are advertised to the peer
+  // For CHTTP2, this is always true.
+  // For PH2, this is set by the transport based on the channel arg
+  // GRPC_ARG_EXPERIMENTAL_HTTP2_PREFERRED_CRYPTO_FRAME_SIZE.
+  // TODO(tjagtap) [PH2][CHTTP2] Edit comment when CHTTP2 is getting deleted.
+  bool ph2_enable_rx_crypto_ = true;
 };
 
 // Implementation of flow control that abides to HTTP/2 spec and attempts

data/src/core/ext/transport/chttp2/transport/flow_control_manager.h

@@ -45,16 +45,14 @@ constexpr int64_t kZero = 0;
 // This function does the settings related tasks equivalent to
 // grpc_chttp2_act_on_flowctl_action in chttp2_transport.cc
 inline void ActOnFlowControlActionSettings(
-    const chttp2::FlowControlAction& action, Http2Settings& local_settings,
-    const bool enable_preferred_rx_crypto_frame_advertisement) {
+    const chttp2::FlowControlAction& action, Http2Settings& local_settings) {
   if (action.send_initial_window_update() != kNoActionNeeded) {
     local_settings.SetInitialWindowSize(action.initial_window_size());
   }
   if (action.send_max_frame_size_update() != kNoActionNeeded) {
     local_settings.SetMaxFrameSize(action.max_frame_size());
   }
-  if (enable_preferred_rx_crypto_frame_advertisement &&
-      action.preferred_rx_crypto_frame_size_update() != kNoActionNeeded) {
+  if (action.preferred_rx_crypto_frame_size_update() != kNoActionNeeded) {
     local_settings.SetPreferredReceiveCryptoMessageSize(
         action.preferred_rx_crypto_frame_size());
   }

data/src/core/ext/transport/chttp2/transport/frame.cc

@@ -33,7 +33,7 @@
 #include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 
-// TODO(tjagtap) TODO(akshitpatel): [PH2][P3] : Write micro benchmarks for
+// TODO(tjagtap) TODO(akshitpatel): [PH2][P4] : Write micro benchmarks for
 // framing code
 
 using grpc_core::http2::Http2ErrorCode;
@@ -650,7 +650,6 @@ ValueOrHttp2Status<Http2Frame> ParseWindowUpdateFrame(
 
 ValueOrHttp2Status<Http2Frame> ParseSecurityFrame(
     const Http2FrameHeader& /*hdr*/, SliceBuffer& payload) {
-  // TODO(tjagtap) : [PH2][P3] : Add validations
   return ValueOrHttp2Status<Http2Frame>(Http2SecurityFrame{std::move(payload)});
 }
 
@@ -828,10 +827,17 @@ void AppendGrpcHeaderToSliceBuffer(SliceBuffer& payload, const uint32_t flags,
 Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
                                 const bool incoming_header_in_progress,
                                 const uint32_t incoming_header_stream_id,
-                                Http2FrameHeader& current_frame_header,
+                                const Http2FrameHeader& current_frame_header,
                                 const uint32_t last_stream_id,
                                 const bool is_client,
-                                const bool is_first_settings_processed) {
+                                const bool is_first_settings_processed,
+                                Http2FrameCountTracker& tracker) {
+  const bool is_data_frame =
+      current_frame_header.type == static_cast<uint8_t>(FrameType::kData);
+  const bool is_continuation_frame =
+      current_frame_header.type ==
+      static_cast<uint8_t>(FrameType::kContinuation);
+
   if (GPR_UNLIKELY(!is_first_settings_processed)) {
     // This check works only because we pause the read loop after reading the
     // first SETTINGS frame.
@@ -854,11 +860,20 @@ Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
                      ", Current Size = ", current_frame_header.length,
                      ", Max Size = ", max_frame_size_setting));
   }
-  if (GPR_UNLIKELY(
-          incoming_header_in_progress &&
-          (current_frame_header.type !=
-               static_cast<uint8_t>(FrameType::kContinuation) ||
-           current_frame_header.stream_id != incoming_header_stream_id))) {
+
+  // RFC 9113 (Section 6.10) requires that if a HEADERS frame does not have
+  // END_HEADERS set, it must be followed by a contiguous sequence of
+  // CONTINUATION frames for the same stream, ending with END_HEADERS. No other
+  // frame types or frames for other streams may be interleaved during this
+  // sequence.
+  const bool did_frame_violate_header_block_sequence =
+      (incoming_header_in_progress &&
+       (!is_continuation_frame ||
+        current_frame_header.stream_id != incoming_header_stream_id));
+  const bool did_receive_unexpected_continuation_frame =
+      (!incoming_header_in_progress && is_continuation_frame);
+  if (GPR_UNLIKELY(did_frame_violate_header_block_sequence ||
+                   did_receive_unexpected_continuation_frame)) {
     return Http2Status::Http2ConnectionError(
         Http2ErrorCode::kProtocolError,
         std::string(RFC9113::kAssemblerContiguousSequenceError));
@@ -868,11 +883,46 @@ Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
   // as in gRPC only clients can initiate a stream. last_stream_id is the stream
   // id of the last stream created by the transport. If no streams were created
   // by the transport, last_stream_id is 0.
-  // TODO(akshitpatel) : [PH2][P3] : Revisit this for server.
-  if (is_client && current_frame_header.stream_id > last_stream_id) {
-    return Http2Status::Http2ConnectionError(
-        Http2ErrorCode::kProtocolError, std::string(RFC9113::kUnknownStreamId));
+  if (GPR_UNLIKELY(current_frame_header.stream_id > last_stream_id)) {
+    const bool is_metadata_frame =
+        current_frame_header.type == static_cast<uint8_t>(FrameType::kHeader) ||
+        is_continuation_frame;
+    if (GPR_UNLIKELY(is_client)) {
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kProtocolError,
+          std::string(RFC9113::kUnknownStreamId));
+    } else if (GPR_UNLIKELY(!is_metadata_frame)) {
+      // For servers, if the stream id is not known, it means the Headers have
+      // not been received for this stream yet. This means that the stream is
+      // still in idle state. A stream in idle state cannot receive any frames
+      // other than HEADERS or PRIORITY.
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kProtocolError,
+          std::string(RFC9113::kIdleStreamError));
+    }
   }
+
+  if (GPR_UNLIKELY(is_continuation_frame && current_frame_header.length == 0u &&
+                   (current_frame_header.flags & kFlagEndHeaders) == 0u)) {
+    tracker.noop_continuation_frames++;
+    if (GPR_UNLIKELY(tracker.noop_continuation_frames >=
+                     kMaxNoopContinuationFrames)) {
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kInternalError,
+          std::string(GrpcErrors::kTooManyZeroLengthContinuationFrames));
+    }
+  }
+
+  if (GPR_UNLIKELY(is_data_frame && current_frame_header.length == 0u &&
+                   (current_frame_header.flags & kFlagEndStream) == 0u)) {
+    tracker.noop_data_frames++;
+    if (GPR_UNLIKELY(tracker.noop_data_frames >= kMaxNoopDataFrames)) {
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kInternalError,
+          std::string(GrpcErrors::kTooManyZeroLengthDataFrames));
+    }
+  }
+
   // TODO(tjagtap) : [PH2][P2]:Consider validating MAX_CONCURRENT_STREAMS here
   // for server.
   return Http2Status::Ok();

data/src/core/ext/transport/chttp2/transport/frame.h

@@ -269,18 +269,38 @@ http2::ValueOrHttp2Status<GrpcMessageHeader> ExtractGrpcHeader(
 void AppendGrpcHeaderToSliceBuffer(SliceBuffer& payload, uint32_t flags,
                                    uint32_t length);
 
+///////////////////////////////////////////////////////////////////////////////
+// Frame limits
+
+constexpr uint16_t kMaxNoopDataFrames = 16384u;
+constexpr uint16_t kMaxNoopContinuationFrames = 128u;
+
+struct Http2FrameCountTracker {
+  void OnLastContinuationFrame() { noop_continuation_frames = 0u; }
+
+  std::string DebugString() const {
+    return absl::StrCat(
+        "{ noop_continuation_frames : ", noop_continuation_frames,
+        ", noop_data_frames : ", noop_data_frames, "}");
+  }
+
+  uint16_t noop_continuation_frames = 0u;
+  uint16_t noop_data_frames = 0u;
+};
+
 ///////////////////////////////////////////////////////////////////////////////
 // Validations
 
 http2::Http2Status ValidateSettingsValues(
     std::vector<Http2SettingsFrame::Setting>& list);
 
-http2::Http2Status ValidateFrameHeader(uint32_t max_frame_size_setting,
-                                       bool incoming_header_in_progress,
-                                       uint32_t incoming_header_stream_id,
-                                       Http2FrameHeader& current_frame_header,
-                                       uint32_t last_stream_id, bool is_client,
-                                       bool is_first_settings_processed);
+http2::Http2Status ValidateFrameHeader(
+    const uint32_t max_frame_size_setting,
+    const bool incoming_header_in_progress,
+    const uint32_t incoming_header_stream_id,
+    const Http2FrameHeader& current_frame_header, const uint32_t last_stream_id,
+    const bool is_client, const bool is_first_settings_processed,
+    Http2FrameCountTracker& tracker);
 
 ///////////////////////////////////////////////////////////////////////////////
 // RFC9113 Related Strings and Consts
@@ -344,8 +364,7 @@ inline constexpr absl::string_view kPaddingLengthLargerThanFrameLength =
 // Misc Errors
 inline constexpr absl::string_view kNoPushPromise =
     "RFC9113: PUSH_PROMISE MUST NOT be sent if the SETTINGS_ENABLE_PUSH "
-    "setting of the "
-    "peer endpoint is set to 0";
+    "setting of the peer endpoint is set to 0";
 
 inline constexpr absl::string_view kAssemblerContiguousSequenceError =
     "RFC9113 : Field blocks MUST be transmitted as a contiguous sequence "
@@ -389,6 +408,11 @@ inline constexpr absl::string_view kFirstSettingsFrameServer =
     "empty. Clients and servers MUST treat an invalid connection preface as a "
     "connection error of type PROTOCOL_ERROR.";
 
+inline constexpr absl::string_view kIdleStreamError =
+    "Stream Idle : Receiving any frame other than HEADERS or PRIORITY on a "
+    "stream in this state MUST be treated as a connection error of type "
+    "PROTOCOL_ERROR.";
+
 inline constexpr uint32_t kMaxStreamId31Bit = 0x7fffffffu;
 inline constexpr uint32_t kMaxSize31Bit = 0x7fffffffu;
 inline constexpr uint32_t kMinimumFrameSize = 16384;
@@ -404,8 +428,19 @@ inline constexpr absl::string_view kTooManyMetadata =
     "gRPC Error : A gRPC server can send upto 1 initial metadata followed by "
     "upto 1 trailing metadata.";
 inline constexpr absl::string_view kOutOfOrderDataFrame =
-    "gRPC Error : DATA frames must follow initial metadata and precede "
-    "trailing metadata.";
+    "gRPC Transport Error : DATA frames must follow initial metadata and "
+    "precede trailing metadata.";
+inline constexpr absl::string_view kTooManyZeroLengthContinuationFrames =
+    "gRPC Transport Error : Received too many zero length CONTINUATION frames "
+    "without end_headers flag set";
+inline constexpr absl::string_view kTooManyZeroLengthDataFrames =
+    "gRPC Transport Error : Received too many zero length DATA frames";
+inline constexpr absl::string_view kUnsolicitedSettingsAck =
+    "gRPC Transport Error : Received unsolicited SETTINGS ACK.";
+inline constexpr absl::string_view kFailedToEnqueueStream =
+    "gRPC Transport Error : Failed to enqueue stream to writable stream list";
+inline constexpr absl::string_view kStreamCreationFailed =
+    "gRPC Transport Error : Stream creation failed";
 }  // namespace GrpcErrors
 
 }  // namespace grpc_core

data/src/core/ext/transport/chttp2/transport/frame_ping.cc

@@ -115,13 +115,16 @@ grpc_error_handle grpc_chttp2_ping_parser_parse(void* parser,
             << "CLIENT[" << t << "]: received ping " << p->opaque_8bytes;
       }
       if (t->ack_pings) {
+        grpc_error_handle error =
+            grpc_chttp2_increase_num_pending_induced_frames(t);
+        if (GPR_UNLIKELY(!error.ok())) return error;
+
         if (t->ping_ack_count == t->ping_ack_capacity) {
           t->ping_ack_capacity =
               std::max(t->ping_ack_capacity * 3 / 2, size_t{3});
           t->ping_acks = static_cast<uint64_t*>(gpr_realloc(
               t->ping_acks, t->ping_ack_capacity * sizeof(*t->ping_acks)));
         }
-        t->num_pending_induced_frames++;
         t->ping_acks[t->ping_ack_count++] = p->opaque_8bytes;
         grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_PING_RESPONSE);
       }

data/src/core/ext/transport/chttp2/transport/frame_rst_stream.cc

@@ -74,13 +74,18 @@ grpc_slice grpc_chttp2_rst_stream_create(
   return slice;
 }
 
-void grpc_chttp2_add_rst_stream_to_next_write(
+grpc_error_handle grpc_chttp2_add_rst_stream_to_next_write(
     grpc_chttp2_transport* t, uint32_t id, uint32_t code,
     grpc_core::CallTracerInterface* call_tracer) {
-  t->num_pending_induced_frames++;
+  grpc_error_handle error = grpc_chttp2_increase_num_pending_induced_frames(t);
+  if (GPR_UNLIKELY(!error.ok())) {
+    return error;
+  }
+
   grpc_slice_buffer_add(
       &t->qbuf, grpc_chttp2_rst_stream_create(id, code, call_tracer,
                                               &t->http2_ztrace_collector));
+  return absl::OkStatus();
 }
 
 grpc_error_handle grpc_chttp2_rst_stream_parser_begin_frame(
@@ -137,7 +142,10 @@ grpc_error_handle grpc_chttp2_rst_stream_parser_parse(void* parser,
     grpc_core::SharedBitGen g;
     if (!t->is_client &&
         absl::Bernoulli(g, t->ping_on_rst_stream_percent / 100.0)) {
-      ++t->num_pending_induced_frames;
+      grpc_error_handle error =
+          grpc_chttp2_increase_num_pending_induced_frames(t);
+      if (GPR_UNLIKELY(!error.ok())) return error;
+
       t->ping_callbacks.RequestPing();
       grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_KEEPALIVE_PING);
     }

data/src/core/ext/transport/chttp2/transport/frame_rst_stream.h

@@ -41,7 +41,7 @@ grpc_slice grpc_chttp2_rst_stream_create(
 // Adds RST_STREAM frame to t->qbuf (buffer for the next write). Should be
 // called when we want to add RST_STREAM and we are not in
 // write_action_begin_locked.
-void grpc_chttp2_add_rst_stream_to_next_write(
+grpc_error_handle grpc_chttp2_add_rst_stream_to_next_write(
     grpc_chttp2_transport* t, uint32_t id, uint32_t code,
     grpc_core::CallTracerInterface* call_tracer);
 

data/src/core/ext/transport/chttp2/transport/frame_settings.cc

@@ -136,7 +136,10 @@ grpc_error_handle grpc_chttp2_settings_parser_parse(void* p,
                 []() { return grpc_core::H2SettingsTrace<false>{true, {}}; });
             *parser->target_settings = *parser->incoming_settings;
             t->MaybeNotifyStateWatcherOfPeerMaxConcurrentStreamsLocked();
-            t->num_pending_induced_frames++;
+            grpc_error_handle error =
+                grpc_chttp2_increase_num_pending_induced_frames(t);
+            if (GPR_UNLIKELY(!error.ok())) return error;
+
             grpc_slice_buffer_add(&t->qbuf, grpc_chttp2_settings_ack_create());
             grpc_chttp2_initiate_write(t,
                                        GRPC_CHTTP2_INITIATE_WRITE_SETTINGS_ACK);