Mercurial > hg > nginx
view src/event/ngx_event_posted.h @ 4489:9806bf07d119
Event pipe: fixed buffer loss in p->length case.
With previous code raw buffer might be lost if p->input_filter() was called
on a buffer without any data and used ngx_event_pipe_add_free_buf() to
return it to the free list. This eventually might cause "all buffers busy"
problem, resulting in segmentation fault due to null pointer dereference in
ngx_event_pipe_write_chain_to_temp_file().
In ngx_event_pipe_add_free_buf() the buffer was added to the list start
due to pos == last, and then "p->free_raw_bufs = cl->next" in
ngx_event_pipe_read_upstream() dropped both chain links to the buffer
from the p->free_raw_bufs list.
Fix is to move "p->free_raw_bufs = cl->next" before calling the
p->input_filter().
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Wed, 22 Feb 2012 11:28:53 +0000 |
parents | d620f497c50f |
children | 3377f9459e99 |
line wrap: on
line source
/* * Copyright (C) Igor Sysoev * Copyright (C) Nginx, Inc. */ #ifndef _NGX_EVENT_POSTED_H_INCLUDED_ #define _NGX_EVENT_POSTED_H_INCLUDED_ #include <ngx_config.h> #include <ngx_core.h> #include <ngx_event.h> #if (NGX_THREADS) extern ngx_mutex_t *ngx_posted_events_mutex; #endif #define ngx_locked_post_event(ev, queue) \ \ if (ev->prev == NULL) { \ ev->next = (ngx_event_t *) *queue; \ ev->prev = (ngx_event_t **) queue; \ *queue = ev; \ \ if (ev->next) { \ ev->next->prev = &ev->next; \ } \ \ ngx_log_debug1(NGX_LOG_DEBUG_CORE, ev->log, 0, "post event %p", ev); \ \ } else { \ ngx_log_debug1(NGX_LOG_DEBUG_CORE, ev->log, 0, \ "update posted event %p", ev); \ } #define ngx_post_event(ev, queue) \ \ ngx_mutex_lock(ngx_posted_events_mutex); \ ngx_locked_post_event(ev, queue); \ ngx_mutex_unlock(ngx_posted_events_mutex); #define ngx_delete_posted_event(ev) \ \ *(ev->prev) = ev->next; \ \ if (ev->next) { \ ev->next->prev = ev->prev; \ } \ \ ev->prev = NULL; \ ngx_log_debug1(NGX_LOG_DEBUG_CORE, ev->log, 0, \ "delete posted event %p", ev); void ngx_event_process_posted(ngx_cycle_t *cycle, ngx_thread_volatile ngx_event_t **posted); void ngx_wakeup_worker_thread(ngx_cycle_t *cycle); #if (NGX_THREADS) ngx_int_t ngx_event_thread_process_posted(ngx_cycle_t *cycle); #endif extern ngx_thread_volatile ngx_event_t *ngx_posted_accept_events; extern ngx_thread_volatile ngx_event_t *ngx_posted_events; #endif /* _NGX_EVENT_POSTED_H_INCLUDED_ */