[nginx] svn commit: r4909 - in branches/stable-1.2: . src/event src/http

[mdounin at mdounin.ru]

Author: mdounin
Date: 2012-11-13 11:24:14 +0000 (Tue, 13 Nov 2012)
New Revision: 4909
URL: http://trac.nginx.org/nginx/changeset/4909/nginx

Log:
Merge of r4896: event pipe: fixed handling of buf_to_file data.

Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption.  Buffer memory was reused to read upstream
response before headers were written to disk.

Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.

This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.

Reported by Anatoli Marinov.


Modified:
   branches/stable-1.2/
   branches/stable-1.2/src/event/ngx_event_pipe.c
   branches/stable-1.2/src/http/ngx_http_upstream.c

Index: branches/stable-1.2
===================================================================
--- branches/stable-1.2	2012-11-13 11:21:31 UTC (rev 4908)
+++ branches/stable-1.2	2012-11-13 11:24:14 UTC (rev 4909)

Property changes on: branches/stable-1.2
___________________________________________________________________
Modified: svn:mergeinfo
## -1 +1 ##
-/trunk:4611-4632,4636-4657,4671-4672,4674-4676,4682,4684-4699,4704-4706,4713,4736-4741,4754,4756-4771,4775,4777-4780,4782-4785,4795,4811-4820,4822-4824,4828-4835,4840-4844,4865-4872,4885-4887,4890-4895
+/trunk:4611-4632,4636-4657,4671-4672,4674-4676,4682,4684-4699,4704-4706,4713,4736-4741,4754,4756-4771,4775,4777-4780,4782-4785,4795,4811-4820,4822-4824,4828-4835,4840-4844,4865-4872,4885-4887,4890-4896
\ No newline at end of property
Modified: branches/stable-1.2/src/event/ngx_event_pipe.c
===================================================================
--- branches/stable-1.2/src/event/ngx_event_pipe.c	2012-11-13 11:21:31 UTC (rev 4908)
+++ branches/stable-1.2/src/event/ngx_event_pipe.c	2012-11-13 11:24:14 UTC (rev 4909)
@@ -946,8 +946,15 @@
         return NGX_ERROR;
     }
 
-    b->pos = b->start;
-    b->last = b->start;
+    if (p->buf_to_file && b->start == p->buf_to_file->start) {
+        b->pos = p->buf_to_file->last;
+        b->last = p->buf_to_file->last;
+
+    } else {
+        b->pos = b->start;
+        b->last = b->start;
+    }
+
     b->shadow = NULL;
 
     cl->buf = b;

Modified: branches/stable-1.2/src/http/ngx_http_upstream.c
===================================================================
--- branches/stable-1.2/src/http/ngx_http_upstream.c	2012-11-13 11:21:31 UTC (rev 4908)
+++ branches/stable-1.2/src/http/ngx_http_upstream.c	2012-11-13 11:24:14 UTC (rev 4909)
@@ -2287,6 +2287,7 @@
             return;
         }
 
+        p->buf_to_file->start = u->buffer.start;
         p->buf_to_file->pos = u->buffer.start;
         p->buf_to_file->last = u->buffer.pos;
         p->buf_to_file->temporary = 1;