ngx_quic_create_stream segfault

[Clima Gabriel]

Hello everyone,

My Nginx worker process has frequent segfaults on this codepath.
(ngx_quic_create_stream)
Here are some observations I have made so far.
1. The faults happen with tcmalloc and malloc so this is not the issue.
2. master_process is on
3. 1 worker is enough
4. HTTP3 requests need to come in fairly frequently, at least 2 per second
5. At least one http1 or http2 request needs to be received as well,
regardless of what port

I would really appreciate any suggestions on where do I continue
investigating this.

#0  0x00007ffb0b01876a in (anonymous namespace)::do_memalign(unsigned
long, unsigned long) () from /lib64/libtcmalloc.so.4
#1  0x00007ffb0b037010 in tc_posix_memalign () from /lib64/libtcmalloc.so.4
#2  0x00000000005a7041 in ngx_memalign (alignment=alignment at entry=16,
size=size at entry=16384, log=log at entry=0x60b44d8) at
src/os/unix/ngx_alloc.c:57
#3  0x000000000058067c in ngx_create_pool (size=size at entry=16384,
log=0x60b44d8) at src/core/ngx_palloc.c:23
#4  0x00000000005ca7f0 in ngx_quic_create_stream () at
src/event/quic/ngx_event_quic_streams.c:685
#5  0x00000000005cb1f6 in ngx_quic_get_stream () at
src/event/quic/ngx_event_quic_streams.c:458
#6  0x00000000005cc745 in ngx_quic_handle_stream_frame
(c=c at entry=0x8417068, pkt=pkt at entry=0x7ffef1048250,
frame=frame at entry=0x7ffef1048140)
    at src/event/quic/ngx_event_quic_streams.c:1265
#7  0x00000000005bd5f3 in ngx_quic_handle_frames (c=0x8417068,
pkt=0x7ffef1048250) at src/event/quic/ngx_event_quic.c:1254
#8  0x00000000005bf022 in ngx_quic_handle_packet (pkt=0x7ffef1048250,
conf=0x0, c=0x8417068) at src/event/quic/ngx_event_quic.c:850
#9  ngx_quic_handle_datagram (c=c at entry=0x8417068, b=0x7ffef1048480,
conf=conf at entry=0x0) at src/event/quic/ngx_event_quic.c:700
#10 0x00000000005bff6b in ngx_quic_input_handler (rev=0x95965a0) at
src/event/quic/ngx_event_quic.c:443
#11 0x00000000005c0884 in ngx_quic_recvmsg (ev=0x95963c0) at
src/event/quic/ngx_event_quic_udp.c:195
#12 0x00000000005af0c8 in ngx_epoll_process_events (cycle=0x57aa050,
timer=<optimized out>, flags=<optimized out>)
    at src/event/modules/ngx_epoll_module.c:901
#13 0x00000000005a2941 in ngx_process_events_and_timers
(cycle=cycle at entry=0x57aa050) at src/event/ngx_event.c:251
#14 0x00000000005abd19 in ngx_worker_process_cycle (cycle=0x57aa050,
data=<optimized out>) at src/os/unix/ngx_process_cycle.c:1135
#15 0x00000000005aa323 in ngx_spawn_process
(cycle=cycle at entry=0x57aa050, proc=proc at entry=0x5abc00
<ngx_worker_process_cycle>, data=data at entry=0x15,
    name=name at entry=0xbc6066 "worker process",
respawn=respawn at entry=-4) at src/os/unix/ngx_process.c:209
#16 0x00000000005ac798 in ngx_start_worker_processes
(cycle=cycle at entry=0x57aa050, n=54, type=type at entry=-4,
    worker_spawn_start_index=worker_spawn_start_index at entry=0x0,
workers_to_exclude=workers_to_exclude at entry=0x0) at
src/os/unix/ngx_process_cycle.c:600
#17 0x00000000005ae069 in ngx_master_process_cycle (cycle=0x57aa050)
at src/os/unix/ngx_process_cycle.c:424
#18 0x000000000057d19c in main (argc=1, argv=<optimized out>) at
src/core/nginx.c:523
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20231221/59d827a2/attachment.htm>