Skip to content

Commit 2c8dd1c

Browse files
committed
Changed ngx_chain_update_chains() to test tag first (ticket #2248).
Without this change, aio used with HTTP/2 can result in connection hang, as observed with "aio threads; aio_write on;" and proxying (ticket #2248). The problem is that HTTP/2 updates buffers outside of the output filters (notably, marks them as sent), and then posts a write event to call output filters. If a filter does not call the next one for some reason (for example, because of an AIO operation in progress), this might result in a state when the owner of a buffer already called ngx_chain_update_chains() and can reuse the buffer, while the same buffer is still sitting in the busy chain of some other filter. In the particular case a buffer was sitting in output chain's ctx->busy, and was reused by event pipe. Output chain's ctx->busy was permanently blocked by it, and this resulted in connection hang. Fix is to change ngx_chain_update_chains() to skip buffers from other modules unconditionally, without trying to wait for these buffers to become empty.
1 parent 5636e7f commit 2c8dd1c

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/core/ngx_buf.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -203,16 +203,16 @@ ngx_chain_update_chains(ngx_pool_t *p, ngx_chain_t **free, ngx_chain_t **busy,
203203
while (*busy) {
204204
cl = *busy;
205205

206-
if (ngx_buf_size(cl->buf) != 0) {
207-
break;
208-
}
209-
210206
if (cl->buf->tag != tag) {
211207
*busy = cl->next;
212208
ngx_free_chain(p, cl);
213209
continue;
214210
}
215211

212+
if (ngx_buf_size(cl->buf) != 0) {
213+
break;
214+
}
215+
216216
cl->buf->pos = cl->buf->start;
217217
cl->buf->last = cl->buf->start;
218218

0 commit comments

Comments
 (0)