Bug #941
closedlighttpd 1.5 segfault when client connection is aborted after proxy backend timed out
Description
as shown by the following backtrace :
Thread 16384 (LWP 13476)
mod_proxy_core_address.c.158: (trace) resolving localhost on port 8009
mod_proxy_core_address.c.63: (trace) adding 127.0.0.1:8009 to the address-pool
Thread 32769 (LWP 13477)
Thread 16386 (LWP 13478)
Program received signal SIGSEGV, Segmentation fault.
to Thread 16384 (LWP 13476)
0x0805c75c in fdevent_get_revents (ev=0x807bea8, event_count=1,
revents=0x8082158) at fdevent.c:218
218 r->handler = ev->fdarrayr->fd->handler;
(gdb) bt
#0 0x0805c75c in fdevent_get_revents (ev=0x807bea8, event_count=1,
revents=0x8082158) at fdevent.c:218
#1 0x0804e2f1 in lighty_mainloop (srv=0x806ff08) at server.c:976
#2 0x0804f31c in main (argc=1, argv=0x1, envp=0xbfffe7d8) at server.c:1690
#3 0x4009d7f7 in __libc_start_main () from /lib/i686/libc.so.6
and the following error log
log.c.139: (trace) server started
mod_proxy_core.c.1506: (trace) connect to backend timed out
mod_proxy_core.c.1506: (trace) connect to backend timed out
the problem can be reproduced by using lighttpd with linux 2.4 and proxy_ajp13 with a configuration like :
server.event-handler = "linux-rtsig"
server.modules = (
"mod_accesslog",
"mod_proxy_core",
"mod_proxy_backend_ajp13"
)
$HTTPurl =~ "^/" {
proxy-core.balancer = "round-robin"
proxy-core.protocol = "ajp13"
proxy-core.backends = ( "localhost:8009" )
proxy-core.max-pool-size = 16
}
when the connection to the webserver from a browser client hungs (which is another problem per se) wait several seconds (the code seems to require 60 to timeout the backend) and then hit the "stop" button in the browser.
lighttpd will segfault after printing the message about the backend timeout
Updated by carenas over 18 years ago
the problem was also reproducible without mod_proxy and friends, and just by using the event handler for RT signals with the following error logged before the crash :
log.c.139: (trace) server started
connections.c.823: (error) I thought only READ_REQUEST_* need fdevent-in
Updated by jakabosky about 18 years ago
- Status changed from New to Fixed
- Resolution set to fixed
this problem should be fix in trunk now.
Also available in: Atom