<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<pre>Looks like [<a href="https://hg.nginx.org/nginx/rev/efd71d49bde0">efd71d49bde0</a>] could be indeed responsible for that:<br /><br />I see at least one state where <span style="font-family: courier new,courier;">rev->ready</span> could remain 1 (after <span style="font-family: courier new,courier;">rev->available</span> gets 0) e. g. deviation between blocks [<a href="https://hg.nginx.org/nginx/rev/efd71d49bde0#l10.8">efd71d49bde0#l10.8</a>] and [<a href="https://hg.nginx.org/nginx/rev/efd71d49bde0#l11.8">efd71d49bde0#l11.8</a>] where first did not reset <span style="font-family: courier new,courier;">rev->ready</span> and for example if <span id="l10.38" class="plusline" style="font-family: courier new,courier;">ngx_socket_nread</span> in [<a href="https://hg.nginx.org/nginx/rev/efd71d49bde0#l10.38">efd71d49bde0#l10.38</a>] would write 0 into <span style="font-family: courier new,courier;">rev->available</span>, so <span style="font-family: courier new,courier;">rev->ready</span> remains 1 yet.</pre>
<pre>Maybe it should be changed to this one:<br /><br /></pre>
<table class="diff-table js-diff-table tab-size" style="box-sizing: border-box; border-spacing: 0px; border-collapse: initial; tab-size: 8; color: #24292e; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji'; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial;" data-tab-size="8" data-diff-anchor="diff-0b707fd972a54f561081982c62457feb">
<tbody style="box-sizing: border-box;">
<tr style="box-sizing: border-box;" data-hunk="03ac88e1776912b1821b2aef2fa3eecb">
<td class="blob-code blob-code-deletion" style="box-sizing: border-box; padding: 0px 10px; position: relative; line-height: 20px; vertical-align: top; background-color: #ffeef0;"><span class="blob-code-inner blob-code-marker" style="box-sizing: border-box; overflow: visible; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 12px; color: #24292e; overflow-wrap: normal; white-space: pre;" data-code-marker="-"><span class="pl-k" style="box-sizing: border-box; color: #d73a49;">if</span> (rev-><span class="pl-smi" style="box-sizing: border-box; color: #24292e;">available <span class="blob-code-inner blob-code-marker" style="box-sizing: border-box; overflow: visible; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 12px; color: #24292e; overflow-wrap: normal; white-space: pre;" data-code-marker="-"><span class="x x-first x-last" style="box-sizing: border-box; border-radius: 0.2em; color: #24292e; background-color: #fdb8c0;">==</span></span></span> 0 && !rev-><span class="pl-smi" style="box-sizing: border-box; color: #24292e;">pending_eof</span>) {</span></td>
</tr>
<tr style="box-sizing: border-box;" data-hunk="03ac88e1776912b1821b2aef2fa3eecb">
<td class="blob-num blob-num-addition empty-cell" style="box-sizing: border-box; padding: 0px 10px; width: 50px; min-width: 50px; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 12px; line-height: 20px; color: rgba(27, 31, 35, 0.3); white-space: nowrap; vertical-align: top; cursor: pointer; user-select: none; background-color: #cdffd8; border-color: #bef5cb;"><span class="blob-code-inner blob-code-marker" style="box-sizing: border-box; overflow: visible; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 12px; color: #24292e; overflow-wrap: normal; white-space: pre;" data-code-marker="+"><span class="pl-k" style="box-sizing: border-box; color: #d73a49;">if</span> (rev-><span class="pl-smi" style="box-sizing: border-box; color: #24292e;">available </span><span class="x x-first" style="box-sizing: border-box; border-top-left-radius: 0.2em; border-bottom-left-radius: 0.2em; color: #24292e; background-color: #acf2bd;"><=</span><span class="pl-c1 x x-last" style="box-sizing: border-box; color: #24292e; border-top-right-radius: 0.2em; border-bottom-right-radius: 0.2em; background-color: #acf2bd;"></span> 0 && !rev-><span class="pl-smi" style="box-sizing: border-box; color: #24292e;">pending_eof</span>) {</span> </td>
</tr>
</tbody>
</table>
<pre><br />Also <span style="font-family: courier new,courier;">rev->available</span> could remain negative if n != size and <span style="font-family: courier new,courier;">ngx_readv_chain</span> or <span style="font-family: courier new,courier;">ngx_unix_recv</span> wouldn't enter this blocks or if <span style="font-family: courier new,courier;">ngx_socket_nread</span> failed (returns -1). <br />And there are some code pices where nginx would expect positive <span style="font-family: courier new,courier;">ev->available</span>.<br /><br />So I guess either one of this blocks are not fully correct, or perhaps the block [<a href="https://hg.nginx.org/nginx/rev/efd71d49bde0#l10.28">efd71d49bde0#l10.28</a>] could be moved to end of the <span style="font-family: courier new,courier;">#if (NGX_HAVE_FIONREAD)</span> block (before <span style="font-family: courier new,courier;">#endif</span> at least in case <span style="font-family: courier new,courier;"><span style="color: #24292e; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fafbfc; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">!rev-></span><span class="pl-smi" style="box-sizing: border-box; color: #24292e; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;">pending_eof</span></span>).<br /><br />Regards,<br />Sergey.</pre>
<p>18.11.2019 15:03, Dave Brennan wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --> <!-- head ignored --><!-- meta ignored --> <!-- meta ignored --><!-- node type 8 --><!-- node type 8 -->
<div class="WordSection1">
<p class="MsoNormal">For the last few years we have been using the “nginx_upload” module to streamline result posting within our environment.<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">With the introduction of nginx 1.17.5 we saw a large number of segment faults, causing us to revert to 1.17.4 on our development system.<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">While isolating the fault we added an increase in debug messages to monitor the request and context variables being passed to event handlers.<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">So a good response in 1.17.4 looks like this:-<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload handle pre alloc Request address = 0000563E9FE451F0 Context = 0000000000000000<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload Handler post alloc Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload_eval_path Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload eval state path Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload client read Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 do read upload client Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 process request body Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 upload md5 variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload File size variable Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/14 10:24:21 [debug] 12398#12398: *9770 Upload Body Handler Request address = 0000563E9FE451F0 Context = 0000563E9FE81CD8<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">In 1.17.5 the event stream looks like this:-<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload handle pre alloc Request address = 0000558ADDD4F780 Context = 0000000000000000<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload Handler post alloc Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload_eval_path Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload eval state path Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload client read Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 do read upload client Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 process request body Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 process request body Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 upload md5 variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload File size variable Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal">2019/11/13 14:21:52 [debug] 28086#28086: *3703 Upload Body Handler Request address = 0000558ADDD4F780 Context = 0000558ADDD49FF8<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal"><strong>2019/11/13 14:21:52 [debug] 28086#28086: *3703 read upload clent request body Request address = 0000558ADDD4F780 Context = 0000000000000000<!-- o ignored --></strong></p>
<p class="MsoNormal"><strong>2019/11/13 14:21:52 [debug] 28086#28086: *3703 do read upload client Request address = 0000558ADDD4F780 Context = 0000000000000000<!-- o ignored --></strong></p>
<p class="MsoNormal"><strong><!-- o ignored --> </strong></p>
<p class="MsoNormal"><strong><!-- o ignored --> </strong></p>
<p class="MsoNormal">There appears to be an extra call to the request “read event” and although the request address has not changed the context address returned by:-<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">ngx_http_upload_ctx_t *u = ngx_http_get_module_ctx(r, ngx_http_upload_module);<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">Returns NULL, which causes any reference to the context table to cause a segment fault.<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal">While it is possible to work round this by checking for a NULL context, the read event appears to be rouge when compared to the previous version of nginx, and I can only assume has been generated by code changes in 1.17.5.<!-- o ignored --></p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal"><!-- o ignored --> </p>
<p class="MsoNormal" style="line-height: 12.0pt; mso-line-height-rule: exactly;"><strong><span style="font-size: 10.0pt; mso-fareast-language: EN-GB;">Dave Brennan<br /> </span></strong><span style="font-size: 10.0pt; mso-fareast-language: EN-GB;">Cyber Protection Senior Technologist<!-- o ignored --></span></p>
<p class="MsoNormal" style="line-height: 12.0pt; mso-line-height-rule: exactly;"><span style="font-size: 10.0pt; mso-fareast-language: EN-GB;"><!-- o ignored --> </span></p>
</div>
CORVID Protect Holdings Limited, trading as CORVID Protect, is registered in Guernsey, company number FC034204, whose registered office is at Royal Bank Place, 1 Glategny Esplanade, St Peter Port, Guernsey GY1 4ND. CORVID Protect Holdings Limited is a subsidiary company of Ultra Electronics Holdings plc registered in England and Wales, company number 02830397, whose registered office is at 35 Portman Square, London W1H 6LR. <br /> <br /> Ultra Electronics is committed to safeguarding the privacy of all personal data: data privacy notice. Email communications may be monitored by us, as permitted by applicable law and regulations. This email is confidential and may also be privileged. If you have received this message in error you should notify the sender immediately by reply e-mail and delete the message from your system.<!-- html ignored --><br />
<pre>_______________________________________________
nginx-devel mailing list
<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a>
</pre>
</blockquote>
</body></html>