Klaus Demo nginx / a256afd
fix race condition if during reconfiguration two cache managers try to delete old inactive entries: one of them removes a entry just locked by other manager from the queue and the rbtree as long inactive entry, causes the latter manager to segfault leaving cache mutex locked, the bug has been introduced in r3727 Igor Sysoev 11 years ago
2 changed file(s) with 10 addition(s) and 1 deletion(s). Raw diff Collapse all Expand all
4242 unsigned error:10;
4343 unsigned exists:1;
4444 unsigned updating:1;
45 /* 12 unused bits */
45 unsigned deleting:1;
46 /* 11 unused bits */
4647
4748 ngx_file_uniq_t uniq;
4849 time_t expire;
581581 fcn->uses = 1;
582582 fcn->count = 1;
583583 fcn->updating = 0;
584 fcn->deleting = 0;
584585
585586 renew:
586587
11011102 continue;
11021103 }
11031104
1105 if (fcn->deleting) {
1106 continue;
1107 }
1108
11041109 p = ngx_hex_dump(key, (u_char *) &fcn->node.key,
11051110 sizeof(ngx_rbtree_key_t));
11061111 len = NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t);
11521157 *p = '\0';
11531158
11541159 fcn->count++;
1160 fcn->deleting = 1;
11551161 ngx_shmtx_unlock(&cache->shpool->mutex);
11561162
11571163 len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;
11671173
11681174 ngx_shmtx_lock(&cache->shpool->mutex);
11691175 fcn->count--;
1176 fcn->deleting = 0;
11701177 }
11711178
11721179 if (fcn->count == 0) {
14301437 fcn->error = 0;
14311438 fcn->exists = 1;
14321439 fcn->updating = 0;
1440 fcn->deleting = 0;
14331441 fcn->uniq = c->uniq;
14341442 fcn->valid_sec = c->valid_sec;
14351443 fcn->body_start = c->body_start;