Opened 3 years ago

Closed 4 months ago

#1708 closed defect (fixed)

closed_nodes in h2c should define as ngx_uint_t

Reported by: zhengjinhuanHW@… Owned by:
Priority: minor Milestone:
Component: nginx-module Version: 1.15.x
Keywords: http2 Cc:
uname -a: Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.15.6
built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.11)
built with OpenSSL 1.0.2g 1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module --with-stream --with-mail=dynamic

Description

When h2c->processing exceeds 256 and all streams are released, the h2c->close_nodes in ngx_http_v2_close_stream will roll over and become a small value, eventually causing the node in the h2c->closed queue to be unreusable in the ngx_http_v2_get_node_by_id function, eventually h2c->streams_index contains a lot of invalid nodes, resulting in low performance of ngx_http_v2_get_node_by_id, so the closed_nodes in h2c is recommended to be define as ngx_uint_t instead of unsigned closed_nodes:8;

Change History (4)

comment:1 by Maxim Dounin, 3 years ago

Thanks for the report, this indeed seems possible if http2_max_concurrent_streams is set to a large value.

comment:2 by Maxim Dounin, 2 years ago

Keywords: http2 added; h2c_closed_nodes removed

comment:3 by Maxim Dounin <mdounin@…>, 4 months ago

In 8007:011f5ebdb928/nginx:

HTTP/2: fixed closed_nodes overflow (ticket #1708).

With large http2_max_concurrent_streams or http2_max_concurrent_pushes, more
than 255 ngx_http_v2_node_t structures might be allocated, eventually leading
to h2c->closed_nodes overflow when closing corresponding streams. This will
in turn result in additional allocations in ngx_http_v2_get_node_by_id().

While mostly harmless, it can result in excessive memory usage by a HTTP/2
connection, notably in configurations with many keepalive_requests allowed.
Fix is to use ngx_uint_t for h2c->closed_nodes instead of unsigned:8.

comment:4 by Maxim Dounin, 4 months ago

Resolution: fixed
Status: newclosed

Fix committed. Thanks for reporting this.

Note: See TracTickets for help on using tickets.