[PATCH] Fixed crash protection in round robin

[乔志奇]

Hello,
I'm sorry, I triggered this issue while developing the dynamic
configuration change module. When I directly modify the configuration
content in memory through the API interface, it may set all the servers to
the backup state, which will cause rrp->peers to be NULL. However, during
the process of starting nginx with local configuration, this situation will
not occur because the configuration check will inform "no server in
upstream", so this is not a problem. Thank you for your response.

Maxim Dounin <mdounin at mdounin.ru> 于2022年12月20日周二 16:48写道：

> Hello!
>
> On Tue, Dec 20, 2022 at 04:16:37PM +0800, 乔志奇 wrote:
>
> > # HG changeset patch
> > # User 乔志奇@Matebook-Qiao <qiaozhiqi2016 at gmail.com>
> > # Date 1671521412 -28800
> > #      Tue Dec 20 15:30:12 2022 +0800
> > # Branch nginx-bugfix-crash
> > # Node ID 992013158c8970318c20e2e3294dbc9311bb20c8
> > # Parent  3108d4d668e4b907868b815f0441d4c893bf4188
> > Fixed crash protection in round robin
> >
> > When all servers in the upstream are in the down state, rrp->peers will
> be
> > NULL, initialization will crash here, and protection is needed.
> >
> > diff -r 3108d4d668e4 -r 992013158c89
> > src/http/ngx_http_upstream_round_robin.c
> > --- a/src/http/ngx_http_upstream_round_robin.c  Fri Dec 16 01:15:15 2022
> > +0400
> > +++ b/src/http/ngx_http_upstream_round_robin.c  Tue Dec 20 15:30:12 2022
> > +0800
> > @@ -275,6 +275,10 @@
> >      rrp->current = NULL;
> >      rrp->config = 0;
> >
> > +    if (rrp->peers == NULL) {
> > +        return NGX_ERROR;
> > +    }
> > +
> >      n = rrp->peers->number;
> >
> >      if (rrp->peers->next && rrp->peers->next->number > n) {
>
> Could you please clarify how rrp->peers can be NULL here?  An
> example configuration and/or test which demonstrates the problem
> would be awesome.  Thanks in advance.
>
> --
> Maxim Dounin
> http://mdounin.ru/
> _______________________________________________
> nginx-devel mailing list
> nginx-devel at nginx.org
> https://mailman.nginx.org/mailman/listinfo/nginx-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20221226/97129dae/attachment.htm>