Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#1333 closed defect (invalid)

Crashes in timer code when ngx_log_debug is on

Reported by: lev.apcera.com@… Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.13.x
Keywords: Cc:
uname -a: Linux lbrouk2-c09380ed 3.13.0-108.155-generic #apcera1 SMP Sun Jan 22 01:41:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx/1.12.1 (same in 1.13.3)

Description

There is now code that looks like
https://github.com/nginx/nginx/blob/6454225872c058c2705fc1e207ce4bb503b2e12a/src/event/ngx_event_timer.h#L69-L71

ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ...ngx_event_ident(ev->data), ...);

ngx_event_ident takes an ngx_connection*, we use timers with custom data pointers in our code, not tied to a specific connection, so the above line crashes in debug mode.

There are several other instances of this, easily greppable

Change History (3)

comment:1 by Valentin V. Bartenev, 3 years ago

This ticket reminds me an old joke: “The patient says "Doctor, it hurts when I do this." "Then don't do that!"”

comment:2 by Maxim Dounin, 3 years ago

Resolution: invalid
Status: newclosed

The ev->data field is expected to contain ngx_connection_t or a structure compatible with it for ngx_event_data(). For example, ngx_open_file_cache_event_t does the following:

typedef struct {

    /* ngx_connection_t stub to allow use c->fd as event ident */
    void                    *data;
    ngx_event_t             *read;
    ngx_event_t             *write;
    ngx_fd_t                 fd;

    ...
} ngx_open_file_cache_event_t;

and here is a quote from resolver code:

struct ngx_resolver_s {
    /* has to be pointer because of "incomplete type" */
    ngx_event_t              *event;
    void                     *dummy;
    ngx_log_t                *log;

    /* event ident must be after 3 pointers as in ngx_connection_t */
    ngx_int_t                 ident;

    ...

While this may be non-intuitive and not convenient in some cases, this is how it works. If your module does not provide appropriate ev->data, an obvious solution would be to fix the module.

comment:3 by lev.apcera.com@…, 3 years ago

Thanks for the explanation!

Note: See TracTickets for help on using tickets.