svn commit: r1604350 - in /httpd/httpd/trunk: CHANGES server/mpm/event/event.c

[co...@apache.org]

Author: covener
Date: Sat Jun 21 13:03:19 2014
New Revision: 1604350

URL: http://svn.apache.org/r1604350
Log:
missed a case in r1538490:

PR56639

Always NULL c->sbh before putting a connection back in a pollset or queue.

We can't NULL c->sbh at the bottom of process_socket() after putting a socket back on 
the event_pollset or having it go into lingering close, because the listener or a worker
thread could A) continue on the connection or B) free and allocate the same conn_rec
pointer before we get to the bottom of process_socket().

Submitted By: Edward Lu
Committed By: covener


Modified:
    httpd/httpd/trunk/CHANGES
    httpd/httpd/trunk/server/mpm/event/event.c

Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1604350&r1=1604349&r2=1604350&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Sat Jun 21 13:03:19 2014
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) event MPM: Fix possible crashes (third party modules accessing c->sbh)
+     or occasional missed mod_status updates for some initial requests
+     on a connection under load. PR 56639.[Edward Lu <Chaosed0 gmail.com>]
+  
   *) mod_deflate: Don't fail when flushing inflated data to the user-agent
      and that coincides with the end of stream ("Zlib error flushing inflate
      buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>]

Modified: httpd/httpd/trunk/server/mpm/event/event.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/event/event.c?rev=1604350&r1=1604349&r2=1604350&view=diff
==============================================================================
--- httpd/httpd/trunk/server/mpm/event/event.c (original)
+++ httpd/httpd/trunk/server/mpm/event/event.c Sat Jun 21 13:03:19 2014
@@ -845,6 +845,7 @@ static int start_lingering_close_common(
             cs->pub.sense == CONN_SENSE_WANT_WRITE ? APR_POLLOUT :
                     APR_POLLIN) | APR_POLLHUP | APR_POLLERR;
     cs->pub.sense = CONN_SENSE_DEFAULT;
+    cs->c->sbh = NULL;
     rv = apr_pollset_add(event_pollset, &cs->pfd);
     apr_thread_mutex_unlock(timeout_mutex);
     if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {
@@ -1130,11 +1131,8 @@ read_request:
     }
 
     if (cs->pub.state == CONN_STATE_LINGER) {
-        if (!start_lingering_close_blocking(cs)) {
-            c->sbh = NULL;
-            notify_suspend(cs);
-            return;
-        }
+        start_lingering_close_blocking(cs);
+        notify_suspend(cs);
     }
     else if (cs->pub.state == CONN_STATE_CHECK_REQUEST_LINE_READABLE) {
         /* It greatly simplifies the logic to use a single timeout value here
@@ -1162,21 +1160,13 @@ read_request:
                          "process_socket: apr_pollset_add failure");
             AP_DEBUG_ASSERT(rc == APR_SUCCESS);
         }
-        return;
     }
     else if (cs->pub.state == CONN_STATE_SUSPENDED) {
         cs->c->suspended_baton = cs;
         apr_atomic_inc32(&suspended_count);
+        c->sbh = NULL;
+        notify_suspend(cs);
     }
-    /*
-     * Prevent this connection from writing to our connection state after it
-     * is no longer associated with this thread. This would happen if the EOR
-     * bucket is destroyed from the listener thread due to a connection abort
-     * or timeout.
-     */
-    c->sbh = NULL;
-    notify_suspend(cs);
-    return;
 }
 
 /* Put a SUSPENDED connection back into a queue. */