[PATCH] Check stale write events in ngx_epoll_module

[agentzh]

Hello!

We've run into an issue with stale write event in ngx_epoll_module.
Here's a scenario for the issue:

1. epoll_wait returns a read event and a write event for a connection,
2. ngx_epoll_process_events checks if the read event is stale and sees
it is not, then invoke the read event handler.
3. the read event handler closes the current connection and makes the
write event not yet processed stale,
4. ngx_epoll_process_events blindly continues to run the write event
handler even if the write event is already stale.

I've already attached a patch for the nginx 1.0.9 core to fix this issue.

Thanks!
-agentzh

--- nginx-1.0.9/src/event/modules/ngx_epoll_module.c	2011-09-30
22:12:53.000000000 +0800
+++ nginx-1.0.9-patched/src/event/modules/ngx_epoll_module.c	2011-11-07
18:07:04.764111952 +0800
@@ -681,6 +681,18 @@

         wev = c->write;

+        if (c->fd == -1 || wev->instance != instance) {
+
+            /*
+             * the stale event from a file descriptor
+             * that was just closed in this iteration
+             */
+
+            ngx_log_debug1(NGX_LOG_DEBUG_EVENT, cycle->log, 0,
+                           "epoll: stale event %p", c);
+            continue;
+        }
+
         if ((revents & EPOLLOUT) && wev->active) {

             if (flags & NGX_POST_THREAD_EVENTS) {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: nginx-1.0.9-epoll_check_stale_wev.patch
Type: application/octet-stream
Size: 701 bytes
Desc: not available
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20111107/0c2f7969/attachment.obj>