Segfault in nginx-1.9.2 with ssl and spdy module # nginx -V nginx version: nginx/1.9.2 built by gcc 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) built with OpenSSL 1.0.1e-fips 11 Feb 2013 TLS SNI support enabled configure arguments: --user=nginx --group=nginx --prefix=/usr/local/nginx --sbin-path=/usr/local/nginx/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http_ssl_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_realip_module --with-debug --with-ipv6 --with-http_spdy_module --add-module=/home/buildbot/rpm//BUILD/lua-nginx-module-0.9.16 --add-module=/home/buildbot/rpm//BUILD/ngx_devel_kit-0.2.14
# gdb nginx nginx.core GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6_4.1) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/nginx/sbin/nginx...done. [New Thread 24331] ... #0 ngx_http_spdy_close_stream_handler (ev=0x754eb58) at src/http/ngx_http_spdy.c:3353 3353 src/http/ngx_http_spdy.c: No such file or directory. in src/http/ngx_http_spdy.c Missing separate debuginfos, use: debuginfo-install nginx-rb-1.9.52-1.x86_64 (gdb) directory nginx-1.9.2 Source directories searched: nginx-1.9.2:$cdir:$cwd (gdb) bt #0 ngx_http_spdy_close_stream_handler (ev=0x754eb58) at src/http/ngx_http_spdy.c:3353 #1 0x0000000000482562 in ngx_http_spdy_write_handler (wev=<value optimized out>) at src/http/ngx_http_spdy.c:649 #2 0x0000000000435f26 in ngx_event_process_posted (cycle=0xcc6a20, posted=0x76fcd0) at src/event/ngx_event_posted.c:33 #3 0x000000000043ce85 in ngx_worker_process_cycle (cycle=0xcc6a20, data=<value optimized out>) at src/os/unix/ngx_process_cycle.c:769 #4 0x000000000043b234 in ngx_spawn_process (cycle=0xcc6a20, proc=0x43cdb0 <ngx_worker_process_cycle>, data=0x10, name=0x4f98b3 "worker process", respawn=-4) at src/os/unix/ngx_process.c:198 #5 0x000000000043c1cc in ngx_start_worker_processes (cycle=0xcc6a20, n=23, type=-4) at src/os/unix/ngx_process_cycle.c:358 #6 0x000000000043dbd8 in ngx_master_process_cycle (cycle=0xcc6a20) at src/os/unix/ngx_process_cycle.c:243 #7 0x000000000041b856 in main (argc=<value optimized out>, argv=<value optimized out>) at src/core/nginx.c:415 (gdb) list 3348 ngx_http_request_t *r; 3349 3350 fc = ev->data; 3351 r = fc->data; 3352 3353 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, 3354 "spdy close stream handler"); 3355 3356 ngx_http_spdy_close_stream(r->spdy_stream, 0); 3357 } (gdb) p r $1 = (ngx_http_request_t *) 0x0 (gdb) p fc $2 = (ngx_connection_t *) 0x754ea20 (gdb) p *fc $3 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv = 0x4424e0 <ngx_ssl_recv>, send = 0x441e90 <ngx_ssl_write>, recv_chain = 0x442990 <ngx_ssl_recv_chain>, send_chain = 0x484830 <ngx_http_spdy_send_chain>, listening = 0xcc6f00, sent = 16770, log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16, addr_text = {len = 11, data = 0x1edba50 "83.149.9.264"}, proxy_protocol_addr = {len = 0, data = 0x0}, ssl = 0x53307b8, local_sockaddr = 0xe773e0, local_socklen = 16, buffer = 0x0, queue = { prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2, log_error = 2, unexpected_eof = 0, timedout = 0, error = 1, destroyed = 1, idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp_nodelay = 2, tcp_nopush = 0, need_last_buf = 1} (gdb) p ev $4 = (ngx_event_t *) 0x754eb58 (gdb) p *ev $5 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0, disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0, timedout = 0, timer_set = 0, delayed = 0, deferred_accept = 0, pending_eof = 0, posted = 0, closed = 0, channel = 0, resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90 <ngx_http_spdy_close_stream_handler>, index = 0, log = 0x754ebb8, timer = {key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 '\000', data = 0 '\000'}, queue = {prev = 0x0, next = 0x0}} (gdb) f 1 #1 0x0000000000482562 in ngx_http_spdy_write_handler (wev=<value optimized out>) at src/http/ngx_http_spdy.c:649 649 wev->handler(wev); (gdb) list 644 645 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, 646 "run spdy stream %ui", stream->id); 647 648 wev = stream->request->connection->write; 649 wev->handler(wev); 650 } 651 652 sc->blocked = 0; 653 (gdb) p wev $6 = <value optimized out> (gdb) p stream $7 = (ngx_http_spdy_stream_t *) 0x66a7150 (gdb) p *stream $8 = {id = 13, request = 0x66a64c0, connection = 0x39861e0, index = 0x0, header_buffers = 0, queued = 0, send_window = 40500, recv_window = 2147483647, free_frames = 0x10ec518, free_data_headers = 0x10ec558, free_bufs = 0x10ec4b8, queue = {prev = 0x0, next = 0x0}, priority = 4, handled = 0, blocked = 0, exhausted = 0, in_closed = 1, out_closed = 1, skip_data = 1} (gdb) p stream->request $9 = (ngx_http_request_t *) 0x66a64c0 (gdb) p *stream->request $10 = {signature = 1347703880, connection = 0x754ea20, ctx = 0x66a6df8, main_conf = 0xcc76e0, srv_conf = 0xd2a178, loc_conf = 0xd3a0c0, read_event_handler = 0x454ee0 <ngx_http_test_reading>, write_event_handler = 0x4521f0 <ngx_http_terminate_handler>, cache = 0x0, upstream = 0x0, upstream_states = 0x0, pool = 0x0, header_in = 0x66a7100, headers_in = {headers = {last = 0x66a6530, part = {elts = 0x10ebb50, nelts = 5, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, host = 0x10ebb50, connection = 0x0, if_modified_since = 0x0, if_unmodified_since = 0x0, if_match = 0x0, if_none_match = 0x0, user_agent = 0x10ebc10, referer = 0x0, content_length = 0x0, content_type = 0x0, range = 0x0, if_range = 0x0, transfer_encoding = 0x0, expect = 0x0, upgrade = 0x0, accept_encoding = 0x10ebbb0, via = 0x0, authorization = 0x0, keep_alive = 0x0, x_forwarded_for = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, x_real_ip = 0x0, user = {len = 0, data = 0x0}, passwd = {len = 0, data = 0x0}, cookies = {elts = 0x66a71c0, nelts = 0, size = 8, nalloc = 2, pool = 0x66a6470}, server = {len = 11, data = 0x10eb761 "r.mradx.net"}, content_length_n = -1, keep_alive_n = -1, connection_type = 1, chunked = 0, msie = 0, msie6 = 0, opera = 0, gecko = 0, chrome = 0, safari = 0, konqueror = 0}, headers_out = {headers = {last = 0x66a66a0, part = {elts = 0x66a6a38, nelts = 4, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, status = 200, status_line = {len = 0, data = 0x0}, server = 0x0, date = 0x0, content_length = 0x0, content_encoding = 0x0, location = 0x0, refresh = 0x0, last_modified = 0x0, content_range = 0x0, accept_ranges = 0x66a6ac8, www_authenticate = 0x0, expires = 0x66a6a68, etag = 0x66a6a38, override_charset = 0x0, content_type_len = 10, content_type = {len = 10, data = 0xd84f60 "image/jpeg"}, charset = {len = 0, data = 0x0}, content_type_lowcase = 0x0, content_type_hash = 0, cache_control = {elts = 0x66a7468, nelts = 1, size = 8, nalloc = 1, pool = 0x66a6470}, content_length_n = 25036, date_time = 0, last_modified_time = 1434536173}, request_body = 0x0, lingering_time = 0, start_sec = 1435303301, start_msec = 143, method = 2, http_version = 1001, request_line = {len = 0, data = 0x66a71d0 "GET /img/BA/1F3F84.jpg HTTP/1.1"}, uri = {len = 18, data = 0x10eb78b "/img/BA/1F3F84.jpg"}, args = {len = 0, data = 0x0}, exten = {len = 3, data = 0x10eb79a "jpg"}, unparsed_uri = {len = 18, data = 0x10eb78b "/img/BA/1F3F84.jpg"}, method_name = {len = 3, data = 0x66a71d0 "GET /img/BA/1F3F84.jpg HTTP/1.1"}, http_protocol = {len = 8, data = 0x10eb7c1 "HTTP/1.1"}, out = 0x0, main = 0x66a64c0, parent = 0x0, postponed = 0x0, post_subrequest = 0x0, posted_requests = 0x0, phase_handler = 18, content_handler = 0, access_code = 0, variables = 0x66a6fa0, ncaptures = 0, captures = 0x66a71f0, captures_data = 0x0, limit_rate = 0, limit_rate_after = 0, header_size = 386, request_length = 301, err_status = 0, http_connection = 0x5330770, spdy_stream = 0x66a7150, log_handler = 0x452510 <ngx_http_log_error_handler>, cleanup = 0x0, subrequests = 201, count = 0, blocked = 0, aio = 0, http_state = 6, complex_uri = 0, quoted_uri = 0, plus_in_uri = 0, space_in_uri = 0, invalid_header = 0, add_uri_to_alias = 0, valid_location = 1, valid_unparsed_uri = 1, uri_changed = 0, uri_changes = 11, request_body_in_single_buf = 0, request_body_in_file_only = 0, request_body_in_persistent_file = 0, request_body_in_clean_file = 0, request_body_file_group_access = 0, request_body_file_log_level = 5, request_body_no_buffering = 0, subrequest_in_memory = 0, waited = 0, cached = 0, gzip_tested = 0, gzip_ok = 0, gzip_vary = 0, proxy = 0, bypass_cache = 0, no_cache = 0, limit_conn_set = 0, limit_req_set = 0, pipeline = 0, chunked = 0, header_only = 0, keepalive = 0, lingering_close = 0, discard_body = 0, reading_body = 0, internal = 0, error_page = 0, filter_finalize = 0, post_action = 0, request_complete = 0, request_output = 1, header_sent = 1, expect_tested = 0, root_tested = 1, done = 0, logged = 0, buffered = 0, main_filter_need_in_memory = 1, filter_need_in_memory = 0, filter_need_temporary = 0, allow_ranges = 1, single_range = 0, disable_not_modified = 0, stat_reading = 0, stat_writing = 1, state = 0, header_hash = 3194399592611459, lowcase_index = 18446744073709551615, lowcase_header = '\000' <repeats 31 times>, header_name_start = 0x10eb81b "user-agent", header_name_end = 0x10eb825 "", header_start = 0x10eb829 "CFNetwork/711.3.18 Darwin/14.0.0", header_end = 0x10eb861 "", uri_start = 0x66a64c0 "HTTP", uri_end = 0x0, uri_ext = 0x10eb79a "jpg", args_start = 0x0, request_start = 0x0, request_end = 0x0, method_end = 0x0, schema_start = 0x10eb7ac "https", schema_end = 0x10eb7b1 "", host_start = 0x0, host_end = 0x0, port_start = 0x0, port_end = 0x0, http_minor = 1, http_major = 1, content_start_sec = 0, content_start_msec = 0, content_end_sec = 0, content_end_msec = 0, gzip_process = 0, gzip_start_sec = 0, gzip_start_msec = 0, gzip_end_sec = 0, gzip_end_msec = 0} (gdb) p stream->request->connection $11 = (ngx_connection_t *) 0x754ea20 (gdb) p *stream->request->connection $12 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv = 0x4424e0 <ngx_ssl_recv>, send = 0x441e90 <ngx_ssl_write>, recv_chain = 0x442990 <ngx_ssl_recv_chain>, send_chain = 0x484830 <ngx_http_spdy_send_chain>, listening = 0xcc6f00, sent = 16770, log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16, addr_text = {len = 11, data = 0x1edba50 "83.149.9.264"}, proxy_protocol_addr = {len = 0, data = 0x0}, ssl = 0x53307b8, local_sockaddr = 0xe773e0, local_socklen = 16, buffer = 0x0, queue = { prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2, log_error = 2, unexpected_eof = 0, timedout = 0, error = 1, destroyed = 1, idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp_nodelay = 2, tcp_nopush = 0, need_last_buf = 1} (gdb) p stream->request->connection->write $13 = (ngx_event_t *) 0x754eb58 (gdb) p *stream->request->connection->write $14 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0, disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0, timedout = 0, timer_set = 0, delayed = 0, deferred_accept = 0, pending_eof = 0, posted = 0, closed = 0, channel = 0, resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90 <ngx_http_spdy_close_stream_handler>, index = 0, log = 0x754ebb8, timer = {key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 '\000', data = 0 '\000'}, queue = {prev = 0x0, next = 0x0}} (gdb) Posted at Nginx Forum: http://forum.nginx.org/read.php?2,260010,260010#msg-260010 _______________________________________________ nginx mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx
