On Wednesday 26 March 2014 12:30:11 Xiaochen Wang wrote:
> In our production, sometimes, the disk was full. In which case, the requests
> after the POST request were handled wrongly in one spdy connection.
>
> Because the input body (DATA frame) of POST request could not be written to disk,
> then ngx_http_spdy_state_read_data() tried to skip this DATA frame with wrong
> sc->length, which broke spdy stream.
>
>
> # HG changeset patch
> # User Xiaochen Wang <wangxiaochen0@gmail.com>
> # Date 1395807655 -28800
> # Node ID c18a0115c6027ad0ad475061d2984d90544d8449
> # Parent bd91f286ee0ade98e9c0f8f55bfef54a122adaf2
> SPDY: fixed handling of sc->length in ngx_http_spdy_state_read_data()
>
> diff -r bd91f286ee0a -r c18a0115c602 src/http/ngx_http_spdy.c
> --- a/src/http/ngx_http_spdy.c Mon Mar 24 16:35:44 2014 -0700
> +++ b/src/http/ngx_http_spdy.c Wed Mar 26 12:20:55 2014 +0800
> @@ -1519,7 +1519,6 @@
> complete = 1;
>
> } else {
> - sc->length -= size;
> complete = 0;
> }
>
> @@ -1567,6 +1566,7 @@
> buf->pos = pos;
>
> pos += size;
> + sc->length -= size;
>
> buf->end = pos;
> buf->last = pos;
> @@ -1585,6 +1585,7 @@
> } else {
> buf->last = ngx_cpymem(buf->last, pos, size);
> pos += size;
> + sc->length -= size;
> }
>
> r->request_length += size;
>

Thank you for the report. I'd prefer a slightly smaller patch:

diff -r e45fa57ef725 src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c Thu Mar 06 23:15:10 2014 +0400
+++ b/src/http/ngx_http_spdy.c Wed Mar 26 10:55:33 2014 +0400
@@ -1496,7 +1496,6 @@ ngx_http_spdy_state_read_data(ngx_http_s
complete = 1;

} else {
- sc->length -= size;
complete = 0;
}

@@ -1539,6 +1538,8 @@ ngx_http_spdy_state_read_data(ngx_http_s
}
}

+ sc->length -= size;
+
if (tf) {
buf->start = pos;
buf->pos = pos;

--

wbr, Valentin V. Bartenev

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel