# Nginx-1.9.2 + ssl + spdy segfault

**URL:** <https://www.ruby-forum.com/t/nginx-1-9-2-ssl-spdy-segfault/242543>\
**Category:** NGINX\
**Created:** [July 1, 2015, 1:29pm UTC](https://www.ruby-forum.com/t/nginx-1-9-2-ssl-spdy-segfault/242543 "2015-07-01T13:29:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\
**Post date:** [July 1, 2015, 1:29pm UTC](https://www.ruby-forum.com/t/nginx-1-9-2-ssl-spdy-segfault/242543/1 "2015-07-01T13:29:30Z")

</div>

Segfault in nginx-1.9.2 with ssl and spdy module

# nginx -V

nginx version: nginx/1.9.2  
built by gcc 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC)  
built with OpenSSL 1.0.1e-fips 11 Feb 2013  
TLS SNI support enabled  
configure arguments: --user=nginx --group=nginx  
–prefix=/usr/local/nginx  
–sbin-path=/usr/local/nginx/sbin/nginx  
–conf-path=/usr/local/nginx/conf/nginx.conf --with-http\_ssl\_module  
–with-http\_gzip\_static\_module --with-http\_stub\_status\_module  
–with-http\_realip\_module --with-debug --with-ipv6  
–with-http\_spdy\_module  
–add-module=/home/buildbot/rpm//BUILD/lua-nginx-module-0.9.16  
–add-module=/home/buildbot/rpm//BUILD/ngx\_devel\_kit-0.2.14

# gdb nginx nginx.core

GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6\_4.1)  
Copyright (C) 2010 Free Software Foundation, Inc.  
License GPLv3+: GNU GPL version 3 or later  
[http://gnu.org/licenses/gpl.html](http://gnu.org/licenses/gpl.html)  
This is free software: you are free to change and redistribute it.  
There is NO WARRANTY, to the extent permitted by law. Type “show  
copying”  
and “show warranty” for details.  
This GDB was configured as “x86\_64-redhat-linux-gnu”.  
For bug reporting instructions, please see:  
[http://www.gnu.org/software/gdb/bugs/](http://www.gnu.org/software/gdb/bugs/)…  
Reading symbols from /usr/local/nginx/sbin/nginx…done.  
[New Thread 24331]

…

# #0 ngx\_http\_spdy\_close\_stream\_handler (ev=0x754eb58) at src/http/ngx\_http\_spdy.c:3353 3353 src/http/ngx\_http\_spdy.c: No such file or directory. in src/http/ngx\_http\_spdy.c Missing separate debuginfos, use: debuginfo-install nginx-rb-1.9.52-1.x86\_64 (gdb) directory nginx-1.9.2 Source directories searched: nginx-1.9.2:$cdir:$cwd (gdb) bt #0 ngx\_http\_spdy\_close\_stream\_handler (ev=0x754eb58) at src/http/ngx\_http\_spdy.c:3353 #1 0x0000000000482562 in ngx\_http\_spdy\_write\_handler (wev=) at src/http/ngx\_http\_spdy.c:649 #2 0x0000000000435f26 in ngx\_event\_process\_posted (cycle=0xcc6a20, posted=0x76fcd0) at src/event/ngx\_event\_posted.c:33 #3 0x000000000043ce85 in ngx\_worker\_process\_cycle (cycle=0xcc6a20, data=) at src/os/unix/ngx\_process\_cycle.c:769 #4 0x000000000043b234 in ngx\_spawn\_process (cycle=0xcc6a20, proc=0x43cdb0 \<ngx\_worker\_process\_cycle\>, data=0x10, name=0x4f98b3 “worker process”, respawn=-4) at src/os/unix/ngx\_process.c:198 #5 0x000000000043c1cc in ngx\_start\_worker\_processes (cycle=0xcc6a20, n=23, type=-4) at src/os/unix/ngx\_process\_cycle.c:358 #6 0x000000000043dbd8 in ngx\_master\_process\_cycle (cycle=0xcc6a20) at src/os/unix/ngx\_process\_cycle.c:243 #7 0x000000000041b856 in main (argc=, argv=) at src/core/nginx.c:415 (gdb) list 3348 ngx\_http\_request\_t \*r; 3349 3350 fc = ev-\>data; 3351 r = fc-\>data; 3352 3353 ngx\_log\_debug0(NGX\_LOG\_DEBUG\_HTTP, r-\>connection-\>log, 0, 3354 “spdy close stream handler”); 3355 3356 ngx\_http\_spdy\_close\_stream(r-\>spdy\_stream, 0); 3357 } (gdb) p r $1 = (ngx\_http\_request\_t \*) 0x0 (gdb) p fc $2 = (ngx\_connection\_t \*) 0x754ea20 (gdb) p \*fc $3 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv = 0x4424e0 \<ngx\_ssl\_recv\>, send = 0x441e90 \<ngx\_ssl\_write\>, recv\_chain = 0x442990 \<ngx\_ssl\_recv\_chain\>, send\_chain = 0x484830 \<ngx\_http\_spdy\_send\_chain\>, listening = 0xcc6f00, sent = 16770, log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16, addr\_text = {len = 11, data = 0x1edba50 “83.149.9.264”}, proxy\_protocol\_addr = {len = 0, data = 0x0}, ssl = 0x53307b8, local\_sockaddr = 0xe773e0, local\_socklen = 16, buffer = 0x0, queue = { prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2, log\_error = 2, unexpected\_eof = 0, timedout = 0, error = 1, destroyed = 1, idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp\_nodelay = 2, tcp\_nopush = 0, need\_last\_buf = 1} (gdb) p ev $4 = (ngx\_event\_t \*) 0x754eb58 (gdb) p \*ev $5 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0, disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0, timedout = 0, timer\_set = 0, delayed = 0, deferred\_accept = 0, pending\_eof = 0, posted = 0, closed = 0, channel = 0, resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90 \<ngx\_http\_spdy\_close\_stream\_handler\>, index = 0, log = 0x754ebb8, timer

# {key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 ‘\000’, data = 0 ‘\000’}, queue = {prev = 0x0, next = 0x0}} (gdb) f 1 #1 0x0000000000482562 in ngx\_http\_spdy\_write\_handler (wev=) at src/http/ngx\_http\_spdy.c:649 649 wev-\>handler(wev); (gdb) list 644 645 ngx\_log\_debug1(NGX\_LOG\_DEBUG\_HTTP, c-\>log, 0, 646 “run spdy stream %ui”, stream-\>id); 647 648 wev = stream-\>request-\>connection-\>write; 649 wev-\>handler(wev); 650 } 651 652 sc-\>blocked = 0; 653 (gdb) p wev $6 = (gdb) p stream $7 = (ngx\_http\_spdy\_stream\_t \*) 0x66a7150 (gdb) p \*stream $8 = {id = 13, request = 0x66a64c0, connection = 0x39861e0, index = 0x0, header\_buffers = 0, queued = 0, send\_window = 40500, recv\_window = 2147483647, free\_frames = 0x10ec518, free\_data\_headers = 0x10ec558, free\_bufs = 0x10ec4b8, queue = {prev = 0x0, next = 0x0}, priority = 4, handled = 0, blocked = 0, exhausted = 0, in\_closed = 1, out\_closed = 1, skip\_data = 1} (gdb) p stream-\>request $9 = (ngx\_http\_request\_t \*) 0x66a64c0 (gdb) p \*stream-\>request $10 = {signature = 1347703880, connection = 0x754ea20, ctx = 0x66a6df8, main\_conf = 0xcc76e0, srv\_conf = 0xd2a178, loc\_conf = 0xd3a0c0, read\_event\_handler = 0x454ee0 \<ngx\_http\_test\_reading\>, write\_event\_handler = 0x4521f0 \<ngx\_http\_terminate\_handler\>, cache = 0x0, upstream = 0x0, upstream\_states = 0x0, pool = 0x0, header\_in = 0x66a7100, headers\_in = {headers = {last = 0x66a6530, part = {elts = 0x10ebb50, nelts = 5, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, host = 0x10ebb50, connection = 0x0, if\_modified\_since = 0x0, if\_unmodified\_since = 0x0, if\_match = 0x0, if\_none\_match = 0x0, user\_agent = 0x10ebc10, referer = 0x0, content\_length = 0x0, content\_type = 0x0, range = 0x0, if\_range = 0x0, transfer\_encoding

# 0x0, expect = 0x0, upgrade = 0x0, accept\_encoding = 0x10ebbb0, via = 0x0, authorization = 0x0, keep\_alive = 0x0, x\_forwarded\_for = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, x\_real\_ip = 0x0, user = {len = 0, data = 0x0}, passwd = {len = 0, data = 0x0}, cookies = {elts = 0x66a71c0, nelts = 0, size = 8, nalloc = 2, pool = 0x66a6470}, server = {len

# 11, data = 0x10eb761 “[r.mradx.net](http://r.mradx.net)”}, content\_length\_n = -1, keep\_alive\_n

# -1, connection\_type = 1, chunked = 0, msie = 0, msie6 = 0, opera = 0, gecko = 0, chrome = 0, safari = 0, konqueror = 0}, headers\_out = {headers = {last = 0x66a66a0, part = {elts = 0x66a6a38, nelts = 4, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, status = 200, status\_line = {len = 0, data = 0x0}, server = 0x0, date = 0x0, content\_length = 0x0, content\_encoding = 0x0, location = 0x0, refresh = 0x0, last\_modified = 0x0, content\_range = 0x0, accept\_ranges = 0x66a6ac8, www\_authenticate = 0x0, expires = 0x66a6a68, etag = 0x66a6a38, override\_charset = 0x0, content\_type\_len = 10, content\_type

# {len = 10, data = 0xd84f60 “image/jpeg”}, charset = {len = 0, data = 0x0}, content\_type\_lowcase = 0x0, content\_type\_hash = 0, cache\_control = {elts

# 0x66a7468, nelts = 1, size = 8, nalloc = 1, pool = 0x66a6470}, content\_length\_n = 25036, date\_time = 0, last\_modified\_time = 1434536173}, request\_body = 0x0, lingering\_time

# 0, start\_sec = 1435303301, start\_msec = 143, method = 2, http\_version = 1001, request\_line = {len = 0, data = 0x66a71d0 “GET /img/BA/1F3F84.jpg HTTP/1.1”}, uri = {len = 18, data = 0x10eb78b “/img/BA/1F3F84.jpg”}, args = {len = 0, data = 0x0}, exten = {len = 3, data = 0x10eb79a “jpg”}, unparsed\_uri = {len = 18, data = 0x10eb78b “/img/BA/1F3F84.jpg”}, method\_name = {len = 3, data = 0x66a71d0 “GET /img/BA/1F3F84.jpg HTTP/1.1”}, http\_protocol = {len = 8, data = 0x10eb7c1 “HTTP/1.1”}, out = 0x0, main = 0x66a64c0, parent = 0x0, postponed = 0x0, post\_subrequest = 0x0, posted\_requests = 0x0, phase\_handler = 18, content\_handler = 0, access\_code = 0, variables = 0x66a6fa0, ncaptures = 0, captures = 0x66a71f0, captures\_data = 0x0, limit\_rate = 0, limit\_rate\_after = 0, header\_size = 386, request\_length = 301, err\_status = 0, http\_connection = 0x5330770, spdy\_stream = 0x66a7150, log\_handler = 0x452510 \<ngx\_http\_log\_error\_handler\>, cleanup = 0x0, subrequests = 201, count = 0, blocked = 0, aio = 0, http\_state = 6, complex\_uri = 0, quoted\_uri = 0, plus\_in\_uri = 0, space\_in\_uri = 0, invalid\_header = 0, add\_uri\_to\_alias = 0, valid\_location = 1, valid\_unparsed\_uri = 1, uri\_changed = 0, uri\_changes = 11, request\_body\_in\_single\_buf = 0, request\_body\_in\_file\_only = 0, request\_body\_in\_persistent\_file = 0, request\_body\_in\_clean\_file = 0, request\_body\_file\_group\_access = 0, request\_body\_file\_log\_level = 5, request\_body\_no\_buffering = 0, subrequest\_in\_memory = 0, waited = 0, cached = 0, gzip\_tested = 0, gzip\_ok = 0, gzip\_vary = 0, proxy = 0, bypass\_cache = 0, no\_cache = 0, limit\_conn\_set = 0, limit\_req\_set = 0, pipeline = 0, chunked = 0, header\_only = 0, keepalive = 0, lingering\_close = 0, discard\_body = 0, reading\_body = 0, internal = 0, error\_page = 0, filter\_finalize = 0, post\_action = 0, request\_complete = 0, request\_output = 1, header\_sent = 1, expect\_tested

# 0, root\_tested = 1, done = 0, logged = 0, buffered = 0, main\_filter\_need\_in\_memory = 1, filter\_need\_in\_memory = 0, filter\_need\_temporary = 0, allow\_ranges = 1, single\_range = 0, disable\_not\_modified = 0, stat\_reading = 0, stat\_writing = 1, state = 0, header\_hash = 3194399592611459, lowcase\_index = 18446744073709551615, lowcase\_header = ‘\000’ \<repeats 31 times\>, header\_name\_start = 0x10eb81b “user-agent”, header\_name\_end = 0x10eb825 “”, header\_start = 0x10eb829 “CFNetwork/711.3.18 Darwin/14.0.0”, header\_end = 0x10eb861 “”, uri\_start = 0x66a64c0 “HTTP”, uri\_end = 0x0, uri\_ext = 0x10eb79a “jpg”, args\_start = 0x0, request\_start = 0x0, request\_end = 0x0, method\_end = 0x0, schema\_start = 0x10eb7ac “https”, schema\_end = 0x10eb7b1 “”, host\_start = 0x0, host\_end = 0x0, port\_start = 0x0, port\_end = 0x0, http\_minor = 1, http\_major = 1, content\_start\_sec = 0, content\_start\_msec = 0, content\_end\_sec = 0, content\_end\_msec = 0, gzip\_process = 0, gzip\_start\_sec = 0, gzip\_start\_msec = 0, gzip\_end\_sec = 0, gzip\_end\_msec = 0} (gdb) p stream-\>request-\>connection $11 = (ngx\_connection\_t \*) 0x754ea20 (gdb) p \*stream-\>request-\>connection $12 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv

# 0x4424e0 \<ngx\_ssl\_recv\>, send = 0x441e90 \<ngx\_ssl\_write\>, recv\_chain = 0x442990 \<ngx\_ssl\_recv\_chain\>, send\_chain = 0x484830 \<ngx\_http\_spdy\_send\_chain\>, listening = 0xcc6f00, sent = 16770, log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16, addr\_text = {len = 11, data = 0x1edba50 “83.149.9.264”}, proxy\_protocol\_addr = {len = 0, data = 0x0}, ssl = 0x53307b8, local\_sockaddr = 0xe773e0, local\_socklen = 16, buffer = 0x0, queue = { prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2, log\_error = 2, unexpected\_eof = 0, timedout = 0, error = 1, destroyed = 1, idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp\_nodelay = 2, tcp\_nopush = 0, need\_last\_buf = 1} (gdb) p stream-\>request-\>connection-\>write $13 = (ngx\_event\_t \*) 0x754eb58 (gdb) p \*stream-\>request-\>connection-\>write $14 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0, disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0, timedout = 0, timer\_set = 0, delayed = 0, deferred\_accept = 0, pending\_eof = 0, posted = 0, closed = 0, channel = 0, resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90 \<ngx\_http\_spdy\_close\_stream\_handler\>, index = 0, log = 0x754ebb8, timer

{key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 ‘\000’, data  
= 0  
‘\000’}, queue = {prev = 0x0, next = 0x0}}  
(gdb)

Posted at Nginx Forum:

> **[nginx-1.9.2 + ssl + spdy segfault](https://forum.nginx.org/read.php?2,260010,260010#msg-260010)**
>
> Segfault in nginx-1.9.2 with ssl and spdy module # nginx -V nginx version: nginx/1.9.2 built by gcc 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) built with OpenSSL 1.0.1e-fips 11 Feb 2013 TLS SNI support enabled configure arguments: --user=nginx --group=n

---

<div class="post-metadata">

**Author:** ![kirimedia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bbe5ce/32.png) [@kirimedia](https://www.ruby-forum.com/u/kirimedia)\
**Post date:** [July 4, 2015, 7:12am UTC](https://www.ruby-forum.com/t/nginx-1-9-2-ssl-spdy-segfault/242543/2 "2015-07-04T07:12:41Z")

</div>

Hello!

On Wed, Jul 01, 2015 at 07:28:59AM -0400, kirimedia wrote:

> –with-http\_gzip\_static\_module --with-http\_stub\_status\_module  
> –with-http\_realip\_module --with-debug --with-ipv6 --with-http\_spdy\_module  
> –add-module=/home/buildbot/rpm//BUILD/lua-nginx-module-0.9.16  
> –add-module=/home/buildbot/rpm//BUILD/ngx\_devel\_kit-0.2.14

As already suggested on the Russian mailing list, please try  
without 3rd party modules.

(Note well that cross-posting isn’t really a good idea.)

[…]

–  
Maxim D.

> **[nginx](http://nginx.org/)**