Mercurial > hg > nginx
view src/event/ngx_event_mutex.c @ 4895:508e61393b6c
Event pipe: fixed handling of buf_to_file data.
Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption. Buffer memory was reused to read upstream
response before headers were written to disk.
Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.
This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.
Reported by Anatoli Marinov.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 30 Oct 2012 11:14:24 +0000 |
parents | d620f497c50f |
children | 3377f9459e99 |
line wrap: on
line source
/* * Copyright (C) Igor Sysoev * Copyright (C) Nginx, Inc. */ #include <ngx_config.h> #include <ngx_core.h> #include <ngx_event.h> ngx_int_t ngx_event_mutex_timedlock(ngx_event_mutex_t *m, ngx_msec_t timer, ngx_event_t *ev) { ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0, "lock event mutex %p lock:%XD", m, m->lock); if (m->lock) { if (m->events == NULL) { m->events = ev; } else { m->last->next = ev; } m->last = ev; ev->next = NULL; #if (NGX_THREADS0) ev->light = 1; #endif ngx_add_timer(ev, timer); return NGX_AGAIN; } m->lock = 1; return NGX_OK; } ngx_int_t ngx_event_mutex_unlock(ngx_event_mutex_t *m, ngx_log_t *log) { ngx_event_t *ev; if (m->lock == 0) { ngx_log_error(NGX_LOG_ALERT, log, 0, "tring to unlock the free event mutex %p", m); return NGX_ERROR; } ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0, "unlock event mutex %p, next event: %p", m, m->events); m->lock = 0; if (m->events) { ev = m->events; m->events = ev->next; ev->next = (ngx_event_t *) ngx_posted_events; ngx_posted_events = ev; } return NGX_OK; }