From be7975abe328856a80e5041151265fef259b3547 Mon Sep 17 00:00:00 2001
From: Maxim Dounin <mdounin@mdounin.ru>
Date: Fri, 20 Jan 2017 21:14:19 +0300
Subject: [PATCH] Upstream: fixed cache corruption and socket leaks with
 aio_write.

The ngx_event_pipe() function wasn't called on write events with
wev->delayed set.  As a result, threaded writing results weren't
properly collected in ngx_event_pipe_write_to_downstream() when a
write event was triggered for a completed write.

Further, this wasn't detected, as p->aio was reset by a thread completion
handler, and results were later collected in ngx_event_pipe_read_upstream()
instead of scheduling a new write of additional data.  If this happened
on the last reading from an upstream, last part of the response was never
written to the cache file.

Similar problems might also happen in case of timeouts when writing to
client, as this also results in ngx_event_pipe() not being called on write
events.  In this scenario socket leaks were observed.

Fix is to check if p->writing is set in ngx_event_pipe_read_upstream(), and
therefore collect results of previous write operations in case of read events
as well, similar to how we do so in ngx_event_pipe_write_downstream().
This is enough to fix the wev->delayed case.  Additionally, we now call
ngx_event_pipe() from ngx_http_upstream_process_request() if there are
uncollected write operations (p->writing and !p->aio).  This also fixes
the wev->timedout case.
---
 src/event/ngx_event_pipe.c   | 13 +++++++++++++
 src/http/ngx_http_upstream.c | 15 +++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/src/event/ngx_event_pipe.c b/src/event/ngx_event_pipe.c
index be1b475bb..f54e07005 100644
--- a/src/event/ngx_event_pipe.c
+++ b/src/event/ngx_event_pipe.c
@@ -113,11 +113,24 @@ ngx_event_pipe_read_upstream(ngx_event_pipe_t *p)
     }
 
 #if (NGX_THREADS)
+
     if (p->aio) {
         ngx_log_debug0(NGX_LOG_DEBUG_EVENT, p->log, 0,
                        "pipe read upstream: aio");
         return NGX_AGAIN;
     }
+
+    if (p->writing) {
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, p->log, 0,
+                       "pipe read upstream: writing");
+
+        rc = ngx_event_pipe_write_chain_to_temp_file(p);
+
+        if (rc != NGX_OK) {
+            return rc;
+        }
+    }
+
 #endif
 
     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, p->log, 0,
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 1386bdb95..168f6b48f 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -3744,9 +3744,24 @@ ngx_http_upstream_process_request(ngx_http_request_t *r,
     p = u->pipe;
 
 #if (NGX_THREADS)
+
+    if (p->writing && !p->aio) {
+
+        /*
+         * make sure to call ngx_event_pipe()
+         * if there is an incomplete aio write
+         */
+
+        if (ngx_event_pipe(p, 1) == NGX_ABORT) {
+            ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
+            return;
+        }
+    }
+
     if (p->writing) {
         return;
     }
+
 #endif
 
     if (u->peer.connection) {