IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-01-22 14:23:18 -06:00
Code Issues Packages Projects Releases Wiki Activity

QUIC: fixed accessing a released stream.

Browse Source 
While trying to close a stream in ngx_quic_close_streams() by calling its
read event handler, the next stream saved prior to that could be destroyed
recursively.  This caused a segfault while trying to access the next stream.

The way the next stream could be destroyed in HTTP/3 is the following.
A request stream read event handler ngx_http_request_handler() could
end up calling ngx_http_v3_send_cancel_stream() to report a cancelled
request stream in the decoder stream.  If sending stream cancellation
decoder instruction fails for any reason, and the decoder stream is the
next in order after the request stream, the issue is triggered.

The fix is to postpone calling read event handlers for all streams being
closed to avoid closing a released stream.
This commit is contained in:
Roman Arutyunyan 2024-12-10 18:19:27 +04:00 committed by Roman Arutyunyan
parent a52ba8ba0e
commit e3a9b6ad08
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/event/quic/ngx_event_quic_streams.c
View File

@ -174,7 +174,7 @@ ngx_int_t
ngx_quic_close_streams(ngx_connection_t *c, ngx_quic_connection_t *qc)
{
ngx_pool_t *pool;
ngx_queue_t *q;
ngx_queue_t *q, posted_events;
ngx_rbtree_t *tree;
ngx_connection_t *sc;
ngx_rbtree_node_t *node;
@ -197,6 +197,8 @@ ngx_quic_close_streams(ngx_connection_t *c, ngx_quic_connection_t *qc)
return NGX_OK;
}
ngx_queue_init(&posted_events);
node = ngx_rbtree_min(tree->root, tree->sentinel);
while (node) {
@ -213,15 +215,21 @@ ngx_quic_close_streams(ngx_connection_t *c, ngx_quic_connection_t *qc)
}
sc->read->error = 1;
sc->read->ready = 1;
sc->write->error = 1;
ngx_quic_set_event(sc->read);
ngx_quic_set_event(sc->write);
sc->write->ready = 1;
sc->close = 1;
sc->read->handler(sc->read);
if (sc->read->posted) {
ngx_delete_posted_event(sc->read);
}
ngx_post_event(sc->read, &posted_events);
}
ngx_event_process_posted((ngx_cycle_t *) ngx_cycle, &posted_events);
if (tree->root == tree->sentinel) {
return NGX_OK;
}