From b6265d7e2e1ae58a22dbfff0e2e946f6822db63d Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Tue, 11 Feb 2025 22:54:04 +0400 Subject: [PATCH] Fixed request counting with subrequests in case of error. Previously, when creating a subrequest, request count increment could be missed in case of error after it became active. This resulted in "http request count is zero" alerts and socket leaks. Further, if posting the next subrequest resulted in an error, then as part of the main request termination, request pool could be destroyed from a subrequest cleanup handler due to the wrong request reference count, followed by a segmentation fault. Found by bad memory allocator simulation. --- src/http/ngx_http_core_module.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index a1540c018..4ef922355 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -2437,6 +2437,8 @@ ngx_http_subrequest(ngx_http_request_t *r, sr->filter_need_in_memory = 1; } + r->main->count++; + if (!sr->background) { if (c->data == r && r->postponed == NULL) { c->data = sr; @@ -2473,8 +2475,6 @@ ngx_http_subrequest(ngx_http_request_t *r, sr->start_sec = tp->sec; sr->start_msec = tp->msec; - r->main->count++; - *psr = sr; if (flags & NGX_HTTP_SUBREQUEST_CLONE) {