annotate src/core/ngx_shmtx.h @ 6359:dac6eda40475 stable-1.8

Resolver: fixed use-after-free memory accesses with CNAME. When several requests were waiting for a response, then after getting a CNAME response only the last request's context had the name updated. Contexts of other requests had the wrong name. This name was used by ngx_resolve_name_done() to find the node to remove the request context from. When the name was wrong, the request could not be properly cancelled, its context was freed but stayed linked to the node's waiting list. This happened e.g. when the first request was aborted or timed out before the resolving completed. When it completed, this triggered a use-after-free memory access by calling ctx->handler of already freed request context. The bug manifests itself by "could not cancel <name> resolving" alerts in error_log. When a request was responded with a CNAME, the request context kept the pointer to the original node's rn->u.cname. If the original node expired before the resolving timed out or completed with an error, this would trigger a use-after-free memory access via ctx->name in ctx->handler(). The fix is to keep ctx->name unmodified. The name from context is no longer used by ngx_resolve_name_done(). Instead, we now keep the pointer to resolver node to which this request is linked. Keeping the original name intact also improves logging.
author Roman Arutyunyan <arut@nginx.com>
date Tue, 26 Jan 2016 16:46:59 +0300
parents 512c741fa841
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2 /*
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3 * Copyright (C) Igor Sysoev
4412
d620f497c50f Copyright updated.
Maxim Konovalov <maxim@nginx.com>
parents: 4309
diff changeset
4 * Copyright (C) Nginx, Inc.
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
5 */
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
6
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
7
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 #ifndef _NGX_SHMTX_H_INCLUDED_
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 #define _NGX_SHMTX_H_INCLUDED_
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
11
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
12 #include <ngx_config.h>
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
13 #include <ngx_core.h>
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
14
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
15
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
16 typedef struct {
4309
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
17 ngx_atomic_t lock;
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
18 #if (NGX_HAVE_POSIX_SEM)
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
19 ngx_atomic_t wait;
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
20 #endif
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
21 } ngx_shmtx_sh_t;
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
22
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
23
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
24 typedef struct {
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
25 #if (NGX_HAVE_ATOMIC_OPS)
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
26 ngx_atomic_t *lock;
3909
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
27 #if (NGX_HAVE_POSIX_SEM)
4309
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
28 ngx_atomic_t *wait;
3909
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
29 ngx_uint_t semaphore;
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
30 sem_t sem;
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
31 #endif
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
32 #else
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
33 ngx_fd_t fd;
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
34 u_char *name;
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
35 #endif
3909
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
36 ngx_uint_t spin;
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
37 } ngx_shmtx_t;
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
38
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
39
4309
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
40 ngx_int_t ngx_shmtx_create(ngx_shmtx_t *mtx, ngx_shmtx_sh_t *addr,
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
41 u_char *name);
4738
512c741fa841 Fixed typo in a function name.
Ruslan Ermilov <ru@nginx.com>
parents: 4412
diff changeset
42 void ngx_shmtx_destroy(ngx_shmtx_t *mtx);
3909
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
43 ngx_uint_t ngx_shmtx_trylock(ngx_shmtx_t *mtx);
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
44 void ngx_shmtx_lock(ngx_shmtx_t *mtx);
0daede16d68b use POSIX semaphores in shmtx instead of sched_yield()
Igor Sysoev <igor@sysoev.ru>
parents: 2563
diff changeset
45 void ngx_shmtx_unlock(ngx_shmtx_t *mtx);
4309
3f6040cd731e Added shmtx interface to forcibly unlock mutexes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3909
diff changeset
46 ngx_uint_t ngx_shmtx_force_unlock(ngx_shmtx_t *mtx, ngx_pid_t pid);
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
47
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
48
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
49 #endif /* _NGX_SHMTX_H_INCLUDED_ */