From 36a0713244a28266beefd5703521949a5fa994ca Mon Sep 17 00:00:00 2001
From: Roman Arutyunyan <arut@nginx.com>
Date: Mon, 14 Jan 2019 20:36:23 +0300
Subject: [PATCH] Prevented scheduling events on a shared connection.

A shared connection does not own its file descriptor, which means that
ngx_handle_read_event/ngx_handle_write_event calls should do nothing for it.
Currently the c->shared flag is checked in several places in the stream proxy
module prior to calling these functions.  However it was not done everywhere.
Missing checks could lead to calling
ngx_handle_read_event/ngx_handle_write_event on shared connections.

The problem manifested itself when using proxy_upload_rate and resulted in
either duplicate file descriptor error (e.g. with epoll) or incorrect further
udp packet processing (e.g. with kqueue).

The fix is to set and reset the event active flag in a way that prevents
ngx_handle_read_event/ngx_handle_write_event from scheduling socket events.
---
 src/event/ngx_event_udp.c            | 6 ++++++
 src/stream/ngx_stream_proxy_module.c | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/event/ngx_event_udp.c b/src/event/ngx_event_udp.c
index 65eb22fd2..557283050 100644
--- a/src/event/ngx_event_udp.c
+++ b/src/event/ngx_event_udp.c
@@ -256,7 +256,9 @@ ngx_event_recvmsg(ngx_event_t *ev)
             rev = c->read;
 
             c->udp->buffer = &buf;
+
             rev->ready = 1;
+            rev->active = 0;
 
             rev->handler(rev);
 
@@ -265,6 +267,7 @@ ngx_event_recvmsg(ngx_event_t *ev)
             }
 
             rev->ready = 0;
+            rev->active = 1;
 
             goto next;
         }
@@ -343,6 +346,7 @@ ngx_event_recvmsg(ngx_event_t *ev)
         rev = c->read;
         wev = c->write;
 
+        rev->active = 1;
         wev->ready = 1;
 
         rev->log = log;
@@ -453,7 +457,9 @@ ngx_udp_shared_recv(ngx_connection_t *c, u_char *buf, size_t size)
     ngx_memcpy(buf, b->pos, n);
 
     c->udp->buffer = NULL;
+
     c->read->ready = 0;
+    c->read->active = 1;
 
     return n;
 }
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index 094931355..ccb54188b 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -1667,13 +1667,13 @@ ngx_stream_proxy_process(ngx_stream_session_t *s, ngx_uint_t from_upstream,
 
     flags = src->read->eof ? NGX_CLOSE_EVENT : 0;
 
-    if (!src->shared && ngx_handle_read_event(src->read, flags) != NGX_OK) {
+    if (ngx_handle_read_event(src->read, flags) != NGX_OK) {
         ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
         return;
     }
 
     if (dst) {
-        if (!dst->shared && ngx_handle_write_event(dst->write, 0) != NGX_OK) {
+        if (ngx_handle_write_event(dst->write, 0) != NGX_OK) {
             ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
             return;
         }