# Nginx 0.8.41 segfaults in ngx\_list\_push **URL:** \ **Category:** NGINX\ **Created:** [June 19, 2010, 3:27am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396 "2010-06-19T03:27:43Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 19, 2010, 3:27am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/1 "2010-06-19T03:27:43Z")
Hi, I’ve found few coredumps in /tmp/ from nginx. #0 0x00000000004055b8 in ngx\_list\_push (l=0xdf18e98) at src/core/ngx\_list.c:45 45 if (last-\>nelts == l-\>nalloc) { (gdb) bt #0 0x00000000004055b8 in ngx\_list\_push (l=0xdf18e98) at src/core/ngx\_list.c:45 #1 0x0000000000459643 in ngx\_http\_header\_add (r=0xdf18e30, key=0x4686b1 “X-AF-Serial”, value=…) at /usr/src/redhat/SOURCES/af-headers/ngx\_af\_headers\_module.c:370 #2 0x0000000000459789 in ngx\_http\_af\_header\_filter (r=0xdf18e30) at /usr/src/redhat/SOURCES/af-headers/ngx\_af\_headers\_module.c:422 #3 0x000000000042536c in ngx\_http\_core\_generic\_phase (r=0xdf18e98, ph=0x4686b1) at src/http/ngx\_http\_core\_module.c:874 … … … … (gdb) print last $2 = (ngx\_list\_part\_t \*) 0x0 (gdb) list 40 void \*elt; 41 ngx\_list\_part\_t _last; 42 43 last = l-\>last; 44 45 if (last-\>nelts == l-\>nalloc) { 46 47 /_ the last part is full, allocate a new list part \*/ 48 49 last = ngx\_palloc(l-\>pool, sizeof(ngx\_list\_part\_t)); seems like in this function sometimes l-\>last could be NULL. Is it will help if I’ll send patch to fix this problem? ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 19, 2010, 4:11am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/2 "2010-06-19T04:11:37Z")
Hi, > seems like in this function sometimes l-\>last could be NULL. Not likely, but you’re probably misusing ngx\_list. Are you sure that your “AF headers” module uses either ngx\_list\_create() or ngx\_list\_init()? Best regards, Piotr S. \< [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) \> ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 7:57pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/3 "2010-06-21T19:57:47Z")
Hi, I’m not using any of this functions and as I can see mod\_gzip not calling this functions too but is uses ngx\_list\_push. here is parts of my code: ``` static ngx_int_t ngx_http_header_add(ngx_http_request_t *r, char ``` \*key, ngx\_str\_t value) { ngx\_table\_elt\_t \*h; ``` if (!key || value.len==0) return -1; h = ngx_list_push(&r->headers_in.headers); <== if (h == NULL) { return -1; } ``` … … … static ngx\_int\_t ngx\_http\_af\_header\_filter(ngx\_http\_request\_t \*r) { ngx\_http\_af\_headers\_loc\_conf\_t \*afcf = ngx\_http\_get\_module\_loc\_conf( r, ngx\_http\_af\_headers\_module ); if (!afcf-\>headers\_enabled) return NGX\_OK; ``` if (afcf->path && r->connection->sockaddr->sa_family == AF_INET) { struct sockaddr_in *sin = (struct sockaddr_in *) ``` r-\>connection-\>sockaddr; af\_struct\_t \*ret=af\_struct\_get(r, afcf-\>path, sin-\>sin\_addr.s\_addr); if (!ret) return NGX\_OK; ngx\_http\_header\_add(r, “AF”, ret-\>af); … … … static ngx\_int\_t ngx\_http\_af\_headers\_init(ngx\_conf\_t \*cf) { ngx\_http\_core\_main\_conf\_t \*cmcf = ngx\_http\_conf\_get\_module\_main\_conf(cf, ngx\_http\_core\_module); ngx\_http\_handler\_pt \*h = ngx\_array\_push(&cmcf-\>phases[NGX\_HTTP\_REWRITE\_PHASE].handlers); if (h == NULL) { return NGX\_ERROR; } \*h = ngx\_http\_af\_header\_filter; ngx\_http\_next\_header\_filter = ngx\_http\_top\_header\_filter; ngx\_http\_top\_header\_filter = ngx\_http\_sub\_header\_filter; ngx\_http\_next\_body\_filter = ngx\_http\_top\_body\_filter; ngx\_http\_top\_body\_filter = ngx\_http\_af\_filter; return NGX\_OK; } ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 8:19pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/4 "2010-06-21T20:19:26Z")
Hello! On Mon, Jun 21, 2010 at 10:57:06AM -0700, Roman V. wrote: > ``` > ngx_table_elt_t *h; > > if (!key || value.len==0) > return -1; > > h = ngx_list_push(&r->headers_in.headers); <== > > ``` You shouldn’t attempt to modify r-\>headers\_in, it’s not safe operation to do. And r-\>headers\_in are known to sometimes be in an inconsistent state - e.g. in subrequests, where they are partially copied from parent request, but members needed for manipulations aren’t correctly initialized (as request headers were already parsed and no further manipulations expected). Further reading: > **[unparsed\_uri setting in ngx\_http\_subrequest?](http://mailman.nginx.org/pipermail/nginx-devel/2010-February/000132.html)** > **[unparsed\_uri setting in ngx\_http\_subrequest?](http://mailman.nginx.org/pipermail/nginx-devel/2010-February/000133.html)** Maxim D. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 8:35pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/5 "2010-06-21T20:35:50Z")
Hello Maxim, my module is generating some extra headers for PHP scripts. If I’m registering input headers generator not correctly how better to do that? PS: I’ve took this code from mod\_rewrite. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 9:34pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/6 "2010-06-21T21:34:23Z")
Hello! On Mon, Jun 21, 2010 at 11:34:33AM -0700, Roman V. wrote: > my module is generating some extra headers for PHP scripts. If I’m > registering input headers generator not correctly how better to do > that? There is no such thing as “input headers generator”. Input headers are parsed from client’s request. If you want to pass to backend something different from what you got from client - you have to do it by means provided by appropriate backend module. It’s proxy\_set\_header for proxy, fastcgi\_param for fastcgi, uwsgi\_param for uwsgi, scgi\_param for fastcgi. Please follow thread I’ve already linked: > **[unparsed\_uri setting in ngx\_http\_subrequest?](http://mailman.nginx.org/pipermail/nginx-devel/2010-February/000135.html)** > PS: I’ve took this code from mod\_rewrite. There are no r-\>headers\_in manipulations in nginx rewrite module. Maxim D. p.s. Please do not top post. Thank you. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 11:45pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/7 "2010-06-21T23:45:30Z")
Thank you Maxim for extended description. Seems like I need some extra advice 🙂 Let me describe my architecture and may be you will see better solution. I have openvpn server which storing some information at login time to some temp file and sending throw DHCP local IP address to client. All 80 port transparently goes throw nginx as forward proxy, results from nginx in comparing with apache even without keep-alive support on highly loaded server MUCH better. No problems with memory usage, cpu utilization, and we have 10% faster browsing. Thank you guys for perfect web/proxy server. So… temp file is simple comma separated fields. From nginx part I’m getting this file by file name which is equals to local IP address, parsing it and providing to some scripts like input headers. If this method is unsafe could you recommend me best way to give this fast changeable session data to my scripts? Thank you again for fast and full answer. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 21, 2010, 8:14pm UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/8 "2010-06-21T20:14:46Z")
Hi, patch below are fixing this problem: diff -Naur nginx-0.8.42/src/core/ngx\_list.c nginx-0.8.42.new/src/core/ngx\_list.c — nginx-0.8.42/src/core/ngx\_list.c 2006-10-11 05:47:11.000000000 -0700 +++ nginx-0.8.42.new/src/core/ngx\_list.c 2010-06-21 11:11:04.000000000 -0700 @@ -42,7 +42,7 @@ ``` last = l->last; ``` - if (last-\>nelts == l-\>nalloc) { - if (last && (last-\>nelts == l-\>nalloc)) { ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 22, 2010, 2:33am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/9 "2010-06-22T02:33:00Z")
Sounds good, just one extra question about nginx variables. I’m using for storage of 6 variables 1 file and then splitting this data by strsep. All what I can find about variable callbacks working revers direction: 1. I’m requesting some variable; 2. Callback making some calculations and filling memory with variable In my case I have to open this file 6 times and make splitting 6 times. Is it possible to define 6 variables at one step or is possible to save parsed data in some kind of cache? ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 22, 2010, 3:39am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/10 "2010-06-22T03:39:45Z")
Hello! On Mon, Jun 21, 2010 at 05:32:00PM -0700, Roman V. wrote: > save parsed data in some kind of cache? > Just cache parsed data in module context once first variable > request comes, it’s fairy trivial. Maxim D. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 22, 2010, 12:11am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/11 "2010-06-22T00:11:16Z")
Hello! On Mon, Jun 21, 2010 at 02:44:17PM -0700, Roman V. wrote: > Thank you Maxim for extended description. > > Seems like I need some extra advice 🙂 > Let me describe my architecture and may be you will see better solution. > I have openvpn server which storing some information at login time > to some temp file and sending throw DHCP local IP address to client. > All 80 port transparently goes throw nginx as forward proxy, results First of all - it’s not a good idea to use nginx as forward proxy. It was never designed to be used as forward proxy and issues including security ones are expected. > from nginx in comparing with apache even without keep-alive support > on highly loaded server MUCH better. No problems with memory usage, > cpu utilization, and we have 10% faster browsing. Thank you guys for > perfect web/proxy server. > So… temp file is simple comma separated fields. From nginx part > I’m getting this file by file name which is equals to local IP > address, parsing it and providing to some scripts like input > headers. If this method is unsafe could you recommend me best way to > give this fast changeable session data to my scripts? The unsafe part is direct modification of r-\>headers\_in. As long as you’ll use something like proxy\_set\_header X-Your-Header $variable\_from\_your\_module; instead - you are on the safe side. Maxim D. ---
**Author:** ![Roman\_V](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@Roman\_V](https://www.ruby-forum.com/u/Roman_V)\ **Post date:** [June 23, 2010, 12:03am UTC](https://www.ruby-forum.com/t/nginx-0-8-41-segfaults-in-ngx-list-push/190396/12 "2010-06-23T00:03:53Z")
On 06/21/2010 06:39 PM, Maxim D. wrote: > > 1. I’m requesting some variable; > > 2. Callback making some calculations and filling memory with variable > > > > In my case I have to open this file 6 times and make splitting 6 times. > > Is it possible to define 6 variables at one step or is possible to > > save parsed data in some kind of cache? > > Just cache parsed data in module context once first variable > request comes, it’s fairy trivial. Can I cache some data in request or connection context?