# HG changeset patch
# User Dmitry Volyntsev <xeioex@nginx.com>
# Date 1583168856 -10800
# Node ID b4dbf8b98f9a781ed3bf611ed3bd65cd1e05179a
# Parent  f001d938429310c45951aeb78827237038247c1c
Fixed premature background subrequest finalization.

When "aio" or "aio threads" is used while processing the response body of an
in-memory background subrequest, the subrequest could be finalized with an aio
operation still in progress.  Upon aio completion either parent request is
woken or the old r->write_event_handler is called again.  The latter may result
in request errors.  In either case post_subrequest handler is never called with
the full response body, which is typically expected when using in-memory
subrequests.

Currently in nginx background subrequests are created by the upstream module
and the mirror module.  The issue does not manifest itself with these
subrequests because they are header-only.  But it can manifest itself with
third-party modules which create in-memory background subrequests.

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2490,6 +2490,15 @@ ngx_http_finalize_request(ngx_http_reque
     if (r != r->main) {
         clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 
+        if (r->buffered || r->postponed) {
+
+            if (ngx_http_set_write_handler(r) != NGX_OK) {
+                ngx_http_terminate_request(r, 0);
+            }
+
+            return;
+        }
+
         if (r->background) {
             if (!r->logged) {
                 if (clcf->log_subrequest) {
@@ -2509,15 +2518,6 @@ ngx_http_finalize_request(ngx_http_reque
             return;
         }
 
-        if (r->buffered || r->postponed) {
-
-            if (ngx_http_set_write_handler(r) != NGX_OK) {
-                ngx_http_terminate_request(r, 0);
-            }
-
-            return;
-        }
-
         pr = r->parent;
 
         if (r == c->data) {