nginx 0.8.45-0.8.49 segfault bug

[Igor Sysoev]

On Wed, Sep 01, 2010 at 10:18:26PM +0400, Maxim Dounin wrote:

> Hello!
> 
> On Wed, Sep 01, 2010 at 12:19:55PM -0400, zhijianpeng wrote:
> 
> > Sorry,I forgot about that my friend patch 0.8.47 for me.
> > 
> > Let's forget about it,  and [b]0.8.49 is clean[/b]
> 
> [...]
> 
> >         [b]proxy_ignore_client_abort       on;[/b]
> 
> [...]
> 
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 connect to 81.19.68.137:80, fd:9
> > #4
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 http upstream connect: -2
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 event timer add: 9:
> > 60000:1283357753347
> > 2010/09/02 00:14:53 [debug] 15807#0: timer delta: 991
> > 2010/09/02 00:14:53 [debug] 15807#0: posted events 0000000000000000
> > 2010/09/02 00:14:53 [debug] 15807#0: worker cycle
> > 2010/09/02 00:14:53 [debug] 15807#0: epoll timer: 60000
> > 2010/09/02 00:14:53 [debug] 15807#0: epoll: fd:3 ev:0005
> > d:00002B77E3EDC160
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 http run request: "/aa/bb?"
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 http read client request body
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 add cleanup: 0000000010258CE0
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 hashed path:
> > /opt/itc/vmsnginx/client_body_temp/0000000002
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 temp fd:10
> > 2010/09/02 00:14:53 [warn] 15807#0: *3 a client request body is buffered
> > to a temporary file /opt/itc/vmsnginx/client_body_temp/0000000002 while
> > connecting to upstream, client: 127.0.0.1, server: localhost, request:
> > "POST /aa/bb HTTP/1.1", upstream: "http://81.19.68.137:80/aa/bb", host:
> > "www.nginx.net"
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 write: 10, 000000001025E6B0, 5,
> > 0
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 recv: fd:3 0 of 0
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 http client request body recv 0
> > 2010/09/02 00:14:53 [info] 15807#0: *3 client closed prematurely
> > connection while connecting to upstream, client: 127.0.0.1, server:
> > localhost, request: "POST /aa/bb HTTP/1.1", upstream:
> > "http://81.19.68.137:80/aa/bb", host: "www.nginx.net"
> > 2010/09/02 00:14:53 [debug] 15807#0: *3 http finalize request: 400,
> > "/aa/bb?" a:1, c:1
> 
> [...]
> 
> This seems to be (somewhat known) issue with 
> "proxy_ignore_client_abort on;" and requests with body.  It 
> doesn't modify request handlers correctly (don't clear request 
> body read handler if one was set) and this may cause unexpected 
> behaviour.
> 
> I'll take a look at this more closely later.  Thanks for your 
> debugging.

I my test nginx run

2010/09/06 14:48:22 [debug] 25462#0: *1 http run request: "/aa/bb?"
2010/09/06 14:48:22 [debug] 25462#0: *1 http request empty handler

instead of

2010/09/02 00:14:53 [debug] 15807#0: *3 http run request: "/aa/bb?"
2010/09/02 00:14:53 [debug] 15807#0: *3 http read client request body

I believe here is some patch or something else.


-- 
Igor Sysoev
http://sysoev.ru/en/