Opened 2 years ago

Last modified 23 months ago

#2418 closed defect

ngx_http_upstream_process_non_buffered_request do_write Dead-loop — at Initial Version

Reported by: bullerdu@… Owned by:
Priority: minor Milestone:
Component: documentation Version: 1.23.x
Keywords: proxy_request_buffering off Cc: bullerdu@…
uname -a: Linux cdn-dev011164234021.na61 4.19.91-008.ali4000.alios7.x86_64 #1 SMP Fri Sep 4 17:33:26 CST 2020 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.23.2
built by gcc 6.5.1 20220324 (GCC)
configure arguments: --prefix=/home/yefei.dyf/nginx

Description

In non-buffering transport mode(proxy_request_buffering off), I encountered a write dead loop problem with the following code path:

src/http/ngx_http_upstream.c:3666 ngx_http_upstream_process_non_buffered_request
  ->
     src/http/ngx_http_upstream.c:3691
     rc = ngx_http_output_filter(r, u->out_bufs);  /* u->out_bufs=0x0 */
         ->
         src/http/ngx_http_write_filter_module.c:48
         ngx_http_write_filter
            ->
            src/http/ngx_http_write_filter_module.c:295
            chain = c->send_chain(c, r->out, limit);
               src/os/uinx/ngx_linux_sendfile_chain.c:50
               ngx_linux_sendfile_chain
               /* code here return
                  if (!wev->ready) {
                      return in;
                  } 
               */

             src/http/ngx_http_write_filter_module.c:342
             /* code here return
                if (chain) {
                    c->buffered |= NGX_HTTP_WRITE_BUFFERED;
                    return NGX_AGAIN;
                }
              */

src/http/ngx_http_upstream.c:3735
n = upstream->recv(upstream, b->last, size);
/* code here, return n = -1 */

->

src/http/ngx_http_upstream.c:3753
/* code here, continue */

-> 

src/http/ngx_http_upstream.c:3691
rc = ngx_http_output_filter(r, u->out_bufs);

My analysis is as follows:

First:
when the downstream is written, ngx_linux_sendfile_chain calls ngx_writev and returns NGX_AGAIN, setting wev->ready =0
src/os/uinx/ngx_linux_sendfile_chain.c:204
if (n == NGX_AGAIN) {
wev->ready = 0;
return in;
}

Second:
src/http/ngx_http_upstream.c:3691
ngx_http_output_filter returns NGX_AGAIN, u->out_bufs = NULL, u->busy_bufs! = NULL

size > 0 && upstream->read->ready = 1, upstream->recv returns -1, So I keep writing downstream(ngx_http_output_filter), but downstream->write->ready = 0 so ngx_http_output_filter keeps returning -2

The resulting problems:
ngx_http_output_filter loop call, some filter_modules have cpu consumption problem, CPU 100%

The Solution:

Check the return value of ngx_http_output_filter. If it is NGX_AGAIN, break the write loop

src/http/ngx_http_upstream.c:3691

rc = ngx_http_output_filter(r, u->out_bufs);
if (rc == NGX_ERROR) {

ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
return;

}
if (rc == NGX_AGAIN) {

...

break;

}

Change History (0)

Note: See TracTickets for help on using tickets.