bugfix: segmentation faults might happen when multiple "light threads" in the same request manipuate a stream cosocket object in turn. thanks Aviram Cohen for the report.

Author: agentzh

src/ngx_http_lua_sleep.c

@@ -138,7 +138,8 @@ ngx_http_lua_sleep_cleanup(void *data)
     ngx_http_lua_co_ctx_t          *coctx = data;
 
     if (coctx->sleep.timer_set) {
-        dd("cleanup: deleting timer for ngx.sleep");
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
+                       "lua clean up the timer for pending ngx.sleep");
 
         ngx_del_timer(&coctx->sleep);
     }

src/ngx_http_lua_socket_tcp.c

@@ -800,6 +800,7 @@ ngx_http_lua_socket_resolve_handler(ngx_resolver_ctx_t *ctx)
     ngx_resolve_name_done(ctx);
 
     u->waiting = 0;
+    u->co_ctx = NULL;
 
     if (waiting) {
         lctx->resume_handler = ngx_http_lua_socket_tcp_resume;
@@ -1233,6 +1234,7 @@ ngx_http_lua_socket_tcp_receive(lua_State *L)
     }
 
     u->waiting = 0;
+    u->co_ctx = NULL;
 
     rc = ngx_http_lua_socket_tcp_read(r, u);
 
@@ -1835,6 +1837,7 @@ ngx_http_lua_socket_tcp_send(lua_State *L)
 
 #if 1
     u->waiting = 0;
+    u->co_ctx = NULL;
 #endif
 
     ngx_http_lua_probe_socket_tcp_send_start(r, u, b->pos, len);
@@ -2281,32 +2284,28 @@ ngx_http_lua_socket_handle_success(ngx_http_request_t *r,
     ngx_http_lua_socket_tcp_upstream_t *u)
 {
     ngx_http_lua_ctx_t          *ctx;
+    ngx_http_lua_co_ctx_t       *coctx;
 
 #if 1
     u->read_event_handler = ngx_http_lua_socket_dummy_handler;
     u->write_event_handler = ngx_http_lua_socket_dummy_handler;
 #endif
 
-    if (u->co_ctx) {
-        u->co_ctx->cleanup = NULL;
-    }
-
-#if 0
-    if (u->eof) {
-        ngx_http_lua_socket_tcp_finalize(r, u);
-    }
-#endif
-
     if (u->waiting) {
         u->waiting = 0;
 
+        ngx_http_lua_assert(u->co_ctx != NULL);
+        coctx = u->co_ctx;
+        coctx->cleanup = NULL;
+        u->co_ctx = NULL;
+
         ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module);
         if (ctx == NULL) {
             return;
         }
 
         ctx->resume_handler = ngx_http_lua_socket_tcp_resume;
-        ctx->cur_co_ctx = u->co_ctx;
+        ctx->cur_co_ctx = coctx;
 
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                        "lua tcp socket waking up the current request");
@@ -2321,6 +2320,7 @@ ngx_http_lua_socket_handle_error(ngx_http_request_t *r,
     ngx_http_lua_socket_tcp_upstream_t *u, ngx_uint_t ft_type)
 {
     ngx_http_lua_ctx_t          *ctx;
+    ngx_http_lua_co_ctx_t       *coctx;
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "lua tcp socket handle error");
@@ -2331,23 +2331,24 @@ ngx_http_lua_socket_handle_error(ngx_http_request_t *r,
     ngx_http_lua_socket_tcp_finalize(r, u);
 #endif
 
-    if (u->co_ctx) {
-        u->co_ctx->cleanup = NULL;
-    }
-
     u->read_event_handler = ngx_http_lua_socket_dummy_handler;
     u->write_event_handler = ngx_http_lua_socket_dummy_handler;
 
     if (u->waiting) {
         u->waiting = 0;
 
+        ngx_http_lua_assert(u->co_ctx != NULL);
+        coctx = u->co_ctx;
+        coctx->cleanup = NULL;
+        u->co_ctx = NULL;
+
         ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module);
         if (ctx == NULL) {
             return;
         }
 
         ctx->resume_handler = ngx_http_lua_socket_tcp_resume;
-        ctx->cur_co_ctx = u->co_ctx;
+        ctx->cur_co_ctx = coctx;
 
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                        "lua tcp socket waking up the current request");
@@ -2792,6 +2793,7 @@ ngx_http_lua_socket_receiveuntil_iterator(lua_State *L)
     }
 
     u->waiting = 0;
+    u->co_ctx = NULL;
 
     rc = ngx_http_lua_socket_tcp_read(r, u);
 

t/058-tcp-socket.t

@@ -5,7 +5,7 @@ use Test::Nginx::Socket::Lua;
 
 repeat_each(2);
 
-plan tests => repeat_each() * 126;
+plan tests => repeat_each() * 130;
 
 our $HtmlDir = html_dir;
 
@@ -15,7 +15,7 @@ $ENV{TEST_NGINX_RESOLVER} ||= '8.8.8.8';
 #log_level 'warn';
 log_level 'debug';
 
-#no_long_string();
+no_long_string();
 #no_diff();
 run_tests();
 
@@ -2575,3 +2575,94 @@ close: 1 nil
 --- no_error_log
 [error]
 
+
+
+=== TEST 42: u->coctx left over bug
+--- config
+    server_tokens off;
+    location = /t {
+        #set $port 5000;
+        set $port $TEST_NGINX_SERVER_PORT;
+
+        content_by_lua '
+            local sock = ngx.socket.tcp()
+            local port = ngx.var.port
+            local ok, err = sock:connect("127.0.0.1", port)
+            if not ok then
+                ngx.say("failed to connect: ", err)
+                return
+            end
+
+            ngx.say("connected: ", ok)
+
+            local req = "GET /foo HTTP/1.0\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n"
+            -- req = "OK"
+
+            local bytes, err = sock:send(req)
+            if not bytes then
+                ngx.say("failed to send request: ", err)
+                return
+            end
+
+            ngx.say("request sent: ", bytes)
+
+            local ready = false
+            local fatal = false
+
+            function f()
+                local line, err, part = sock:receive()
+                if not line then
+                    ngx.say("failed to receive the 1st line: ", err, " [", part, "]")
+                    fatal = true
+                    return
+                end
+                ready = true
+                ngx.sleep(1)
+            end
+
+            local st = ngx.thread.spawn(f)
+            while true do
+                if fatal then
+                    return
+                end
+
+                if not ready then
+                    ngx.sleep(0.01)
+                else
+                    break
+                end
+            end
+
+            while true do
+                local line, err, part = sock:receive()
+                if line then
+                    -- ngx.say("received: ", line)
+
+                else
+                    -- ngx.say("failed to receive a line: ", err, " [", part, "]")
+                    break
+                end
+            end
+
+            ok, err = sock:close()
+            ngx.say("close: ", ok, " ", err)
+            ngx.exit(0)
+        ';
+    }
+
+    location /foo {
+        content_by_lua 'ngx.sleep(0.1) ngx.say("foo")';
+        more_clear_headers Date;
+    }
+
+--- request
+GET /t
+--- response_body
+connected: 1
+request sent: 57
+close: nil closed
+--- no_error_log
+[error]
+--- error_log
+lua clean up the timer for pending ngx.sleep
+