spdy: connection leak when client aborted connection

[Xiaochen Wang]

Configure:
 ./configure --with-http_spdy_module --with-http_stub_status_module
--prefix=$(pwd)/../nginx --with-cc-opt=-O0

Reproduce:
1. use nginx(spdy/2) to build static file server
2. request large static file(16MB file, 10 streams in one session)
   $ spdycat --no-tls -2 -m 10 http://ip:spdy_port/16M_static_file
3. input ctrl-c to abort connection before spdycat exit
4. see output of stub status module
   $ curl http://ip:http_port/stub_status
   Active connections: 2                          <<< always larger than 1,
one connection leak
   server accepts handled requests
    4 4 4
    Reading: 0 Writing: 2 Waiting: 1
Note: If you cannot reproduce, try one more time.

gdb trace:
-> ngx_http_spdy_read_handler
   ...
   do {
      recv()
      do {
        sc->handler(sc, p, end)
      } while
   } while
 ->sc->handler()
  -> ...
   -> ngx_http_spdy_send_output_queue()
     -> c->send_chain(c, cl, 0);                  <<< (maybe) not send
total chains

 stream->request->connection->write->handler = ngx_http_request_handler
 stream->request->write_event_handler = ngx_http_writer

>>> client aborted the connection <<<

-> ngx_http_spdy_read_handler
   ...
   do {
     rc = recv()
     if (rc == 0)                                  <<< Client closed the
connection.
       ngx_http_spdy_finalize_connection()
   } while
   ...
 -> ngx_http_spdy_finalize_connection
  -> ev->handler
     (stream->request->connection->write->handler)
     ngx_http_request_handler
   -> r->write_event_handler
      ngx_http_writer
      ...
      if (wev->delayed || r->aio) {               <<< wev->delayed was set.
          ngx_log_debug0(NGX_LOG_DEBUG_HTTP, wev->log, 0,
                         "http writer delayed");

          if (ngx_handle_write_event(wev, clcf->send_lowat) != NGX_OK) {
              ngx_http_close_request(r, 0);
          }

          return;
      }
      ...

    In which case, this stream had not been finalized, and sc->processing
was not decreased.
    After ngx_http_spdy_finalize_connection(), nginx got one
connection(spdy session) leak.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20131127/9872c200/attachment.html>