Hello!
On Sat, May 11, 2013 at 04:23:00PM -0300, Breno Silva wrote:
> Hello list,
>
> We are porting ModSecurity to NGINX. However we are seeing sometimes an
> issue. Nginx eats 100% of cpu and when i use gdb i see:
>
> gdb -p 8645
>
> ngx_event_pipe_write_to_downstream (p=0x9bbc720, do_write=0) at
> src/event/ngx_event_pipe.c:551
>
> 551 if (cl->buf->recycled) {
> (gdb)
>
> Looks like it is happening when we call ngx_http_modsecurity_body_filter()
> then go to this conditions;
>
> rc = move_chain_to_brigade(in, ctx->brigade, r->pool, 0);
>
> if (rc != NGX_OK) {
>
> r->buffered |= NGX_HTTP_SSI_BUFFERED;
>
> return rc;
>
> }
>
> move_chainto_brigade is defined as:
>
>
> ngx_int_t
>
> move_chain_to_brigade(ngx_chain_t *chain, apr_bucket_brigade *bb,
> ngx_pool_t *pool, ngx_int_t last_buf) {
>
> apr_bucket *e;
>
> ngx_chain_t *cl;
>
>
> while (chain) {
>
> e = ngx_buf_to_apr_bucket(chain->buf, bb->p, bb->bucket_alloc);
>
> if (e == NULL) {
>
> return NGX_ERROR;
>
> }
>
>
> APR_BRIGADE_INSERT_TAIL(bb, e);
>
> if (chain->buf->last_buf) {
>
> e = apr_bucket_eos_create(bb->bucket_alloc);
>
> APR_BRIGADE_INSERT_TAIL(bb, e);
>
> chain->buf->last_buf = 0;
>
> return NGX_OK;
>
> }
>
> cl = chain;
>
> chain = chain->next;
>
> ngx_free_chain(pool, cl);
>
> }
>
>
> if (last_buf) {
>
> e = apr_bucket_eos_create(bb->bucket_alloc);
>
> APR_BRIGADE_INSERT_TAIL(bb, e);
>
> return NGX_OK;
>
> }
>
> return NGX_AGAIN;
>
> }
> Let me know if you guys can help us understanding why sometimes we trigger
> this issue
It looks like your code modify chain links (ngx_chain_t
structures) as got by your response body filter. This is not
something filters are allowed to do, and results are undefined.
If a filter needs to modify chain, it should allocate it's own
chain links.
In the code quoted you probably don't want to touch chain links at
all.
--
Maxim Dounin
http://nginx.org/en/donation.html
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
