Upstream: read handler cleared on upstream finalization. With "proxy_ignore_client_abort off" (the default), upstream module changes r->read_event_handler to ngx_http_upstream_rd_check_broken_connection(). If the handler is not cleared during upstream finalization, it can be triggered later, causing unexpected effects, if, for example, a request was redirected to a different location using error_page or X-Accel-Redirect. In particular, it makes "proxy_ignore_client_abort on" non-working after a redirection in a configuration like this: location = / { error_page 502 = /error; proxy_pass http://127.0.0.1:8082; } location /error { proxy_pass http://127.0.0.1:8083; proxy_ignore_client_abort on; } It is also known to cause segmentation faults with aio used, see http://mailman.nginx.org/pipermail/nginx-ru/2015-August/056570.html. Fix is to explicitly set r->read_event_handler to ngx_http_block_reading() during upstream finalization, similar to how it is done in the request body reading code and in the limit_req module.

--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -4366,6 +4366,8 @@ ngx_http_upstream_finalize_request(ngx_h
         u->buffer.last = u->buffer.pos;
     }
 
+    r->read_event_handler = ngx_http_block_reading;
+
     if (rc == NGX_DECLINED) {
         return;
     }