bugfix: nginx crash when resolve an not exist domain in thread create by ngx.thread.spawn.(openresty#1931)

FIX openresty#1915 The resolve ctxes were dded to a link list. function ngx_resolver_process_a iterate through the link list when got the DNS reply. When processing the first resolve ctx, all the three ctxes were freed. So when ngx_resolver_process_a continues to process the second ctx, it will free the ctx again. Co-authored-by: doujiang24 <doujiang24@gmail.com>

Author: zhuizhuhaomeng

src/ngx_http_lua_socket_tcp.c

@@ -147,8 +147,6 @@ static void ngx_http_lua_socket_free_pool(ngx_log_t *log,
 static int ngx_http_lua_socket_shutdown_pool(lua_State *L);
 static void ngx_http_lua_socket_shutdown_pool_helper(
  ngx_http_lua_socket_pool_t *spool);
-static void
- ngx_http_lua_socket_empty_resolve_handler(ngx_resolver_ctx_t *ctx);
 static int ngx_http_lua_socket_prepare_error_retvals(ngx_http_request_t *r,
  ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L, ngx_uint_t ft_type);
 #if (NGX_HTTP_SSL)
@@ -1151,13 +1149,6 @@ ngx_http_lua_socket_tcp_connect(lua_State *L)
 }
 
 
-static void
-ngx_http_lua_socket_empty_resolve_handler(ngx_resolver_ctx_t *ctx)
-{
- /* do nothing */
-}
-
-
 static void
 ngx_http_lua_socket_resolve_handler(ngx_resolver_ctx_t *ctx)
 {
@@ -6084,10 +6075,8 @@ ngx_http_lua_tcp_resolve_cleanup(void *data)
  return;
  }
 
- /* just to be safer */
- rctx->handler = ngx_http_lua_socket_empty_resolve_handler;
-
- ngx_resolve_name_done(rctx);
+ /* postpone free the rctx in the handler */
+ rctx->handler = ngx_resolve_name_done;
 }
 
 

src/ngx_http_lua_socket_udp.c

@@ -1584,7 +1584,8 @@ ngx_http_lua_udp_resolve_cleanup(void *data)
  return;
  }
 
- ngx_resolve_name_done(rctx);
+ /* postpone free the rctx in the handler */
+ rctx->handler = ngx_resolve_name_done;
 }
 
 

t/014-bugs.t

@@ -8,7 +8,7 @@ log_level('debug');
 
 repeat_each(3);
 
-plan tests => repeat_each() * (blocks() * 2 + 30);
+plan tests => repeat_each() * (blocks() * 2 + 32);
 
 our $HtmlDir = html_dir;
 #warn $html_dir;
@@ -1019,3 +1019,199 @@ write timer set: 1
 --- no_error_log
 [error]
 [alert]
+
+
+
+=== TEST 42: tcp: nginx crash when resolve an not exist domain in ngx.thread.spawn
+https://github.com/openresty/lua-nginx-module/issues/1915
+--- config
+ resolver $TEST_NGINX_RESOLVER ipv6=off;
+ location = /t {
+ content_by_lua_block {
+ local function tcp(host, port)
+ local sock = ngx.socket.tcp()
+ local ok,err = sock:connect(host, port)
+ if not ok then
+ ngx.log(ngx.WARN, "failed: ", err)
+ sock:close()
+ return false
+ end
+
+ sock:close()
+ return true
+ end
+
+ local host = "www.notexistdomain.com"
+ local port = 80
+
+ local threads = {}
+ for i = 1, 3 do
+ threads[i] = ngx.thread.spawn(tcp, host, port)
+ end
+
+ local ok, res = ngx.thread.wait(threads[1],threads[2],threads[3])
+ if not ok then
+ ngx.say("failed to wait thread")
+ return
+ end
+
+ ngx.say("res: ", res)
+
+ for i = 1, 3 do
+ ngx.thread.kill(threads[i])
+ end
+ }
+ }
+
+--- request
+GET /t
+--- response_body
+res: false
+--- error_log
+www.notexistdomain.com could not be resolved
+
+
+
+=== TEST 43: domain exists with tcp socket
+https://github.com/openresty/lua-nginx-module/issues/1915
+--- config
+ resolver $TEST_NGINX_RESOLVER ipv6=off;
+ location = /t {
+ content_by_lua_block {
+ local function tcp(host, port)
+ local sock = ngx.socket.tcp()
+ local ok,err = sock:connect(host, port)
+ if not ok then
+ ngx.log(ngx.WARN, "failed: ", err)
+ sock:close()
+ return false
+ end
+
+ sock:close()
+ return true
+ end
+
+ local host = "www.openresty.org"
+ local port = 80
+
+ local threads = {}
+ for i = 1, 3 do
+ threads[i] = ngx.thread.spawn(tcp, host, port)
+ end
+
+ local ok, res = ngx.thread.wait(threads[1],threads[2],threads[3])
+ if not ok then
+ ngx.say("failed to wait thread")
+ return
+ end
+
+ ngx.say("res: ", res)
+
+ for i = 1, 3 do
+ ngx.thread.kill(threads[i])
+ end
+ }
+ }
+
+--- request
+GET /t
+--- response_body
+res: true
+
+
+
+=== TEST 44: domain exists with udp socket
+https://github.com/openresty/lua-nginx-module/issues/1915
+--- config
+ resolver $TEST_NGINX_RESOLVER ipv6=off;
+ location = /t {
+ content_by_lua_block {
+ local function udp(host, port)
+ local sock = ngx.socket.udp()
+ local ok,err = sock:setpeername(host, port)
+ if not ok then
+ ngx.log(ngx.WARN, "failed: ", err)
+ sock:close()
+ return false
+ end
+
+ sock:close()
+ return true
+ end
+
+ local host = "www.notexistdomain.com"
+ local port = 80
+
+ local threads = {}
+ for i = 1, 3 do
+ threads[i] = ngx.thread.spawn(udp, host, port)
+ end
+
+ local ok, res = ngx.thread.wait(threads[1],threads[2],threads[3])
+ if not ok then
+ ngx.say("failed to wait thread")
+ return
+ end
+
+ ngx.say("res: ", res)
+
+ for i = 1, 3 do
+ ngx.thread.kill(threads[i])
+ end
+ }
+ }
+
+--- request
+GET /t
+--- response_body
+res: false
+--- error_log
+www.notexistdomain.com could not be resolved
+
+
+
+=== TEST 45: udp: nginx crash when resolve an not exist domain in ngx.thread.spawn
+https://github.com/openresty/lua-nginx-module/issues/1915
+--- config
+ resolver $TEST_NGINX_RESOLVER ipv6=off;
+ location = /t {
+ content_by_lua_block {
+ local function udp(host, port)
+ local sock = ngx.socket.udp()
+ local ok,err = sock:setpeername(host, port)
+ if not ok then
+ ngx.log(ngx.WARN, "failed: ", err)
+ sock:close()
+ return false
+ end
+
+ sock:close()
+ return true
+ end
+
+ local host = "www.openresty.org"
+ local port = 80
+
+ local threads = {}
+ for i = 1, 3 do
+ threads[i] = ngx.thread.spawn(udp, host, port)
+ end
+
+ local ok, res = ngx.thread.wait(threads[1],threads[2],threads[3])
+ if not ok then
+ ngx.say("failed to wait thread")
+ return
+ end
+
+ ngx.say("res: ", res)
+
+ for i = 1, 3 do
+ ngx.thread.kill(threads[i])
+ end
+ }
+ }
+
+--- request
+GET /t
+--- response_body
+res: true

t/127-uthread-kill.t

@@ -8,7 +8,7 @@ our $StapScript = $t::StapThread::StapScript;
 
 repeat_each(2);
 
-plan tests => repeat_each() * (blocks() * 5 + 2);
+plan tests => repeat_each() * (blocks() * 5 + 1);
 
 $ENV{TEST_NGINX_RESOLVER} ||= '8.8.8.8';
 $ENV{TEST_NGINX_MEMCACHED_PORT} ||= '11211';
@@ -184,7 +184,6 @@ killed
 [error]
 --- error_log
 lua tcp socket abort resolver
-resolve name done: -2