From 2fd8b271c4ff1474ac52f06051829513169eae17 Mon Sep 17 00:00:00 2001
From: Ruslan Ermilov <ru@nginx.com>
Date: Mon, 25 Mar 2013 13:16:55 +0000
Subject: [PATCH] Upstream: removed double-free workarounds in peer.free()
 methods.

---
 .../modules/ngx_http_upstream_keepalive_module.c     | 12 +-----------
 .../modules/ngx_http_upstream_least_conn_module.c    |  4 ----
 src/http/ngx_http_upstream_round_robin.c             |  4 ----
 3 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/src/http/modules/ngx_http_upstream_keepalive_module.c b/src/http/modules/ngx_http_upstream_keepalive_module.c
index a2ad5aa8d..eed117404 100644
--- a/src/http/modules/ngx_http_upstream_keepalive_module.c
+++ b/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -37,8 +37,6 @@ typedef struct {
     ngx_event_save_peer_session_pt     original_save_session;
 #endif
 
-    ngx_uint_t                         failed;       /* unsigned:1 */
-
 } ngx_http_upstream_keepalive_peer_data_t;
 
 
@@ -220,8 +218,6 @@ ngx_http_upstream_get_keepalive_peer(ngx_peer_connection_t *pc, void *data)
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "get keepalive peer");
 
-    kp->failed = 0;
-
     /* ask balancer */
 
     rc = kp->original_get_peer(pc, kp->data);
@@ -282,18 +278,12 @@ ngx_http_upstream_free_keepalive_peer(ngx_peer_connection_t *pc, void *data,
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "free keepalive peer");
 
-    /* remember failed state - peer.free() may be called more than once */
-
-    if (state & NGX_PEER_FAILED) {
-        kp->failed = 1;
-    }
-
     /* cache valid connections */
 
     u = kp->upstream;
     c = pc->connection;
 
-    if (kp->failed
+    if (state & NGX_PEER_FAILED
         || c == NULL
         || c->read->eof
         || c->read->error
diff --git a/src/http/modules/ngx_http_upstream_least_conn_module.c b/src/http/modules/ngx_http_upstream_least_conn_module.c
index bd2f1bc9e..6066ed2bb 100644
--- a/src/http/modules/ngx_http_upstream_least_conn_module.c
+++ b/src/http/modules/ngx_http_upstream_least_conn_module.c
@@ -353,10 +353,6 @@ ngx_http_upstream_free_least_conn_peer(ngx_peer_connection_t *pc,
         return;
     }
 
-    if (state == 0 && pc->tries == 0) {
-        return;
-    }
-
     lcp->conns[lcp->rrp.current]--;
 
     lcp->free_rr_peer(pc, &lcp->rrp, state);
diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c
index b48039414..ec7b2897e 100644
--- a/src/http/ngx_http_upstream_round_robin.c
+++ b/src/http/ngx_http_upstream_round_robin.c
@@ -584,10 +584,6 @@ ngx_http_upstream_free_round_robin_peer(ngx_peer_connection_t *pc, void *data,
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "free rr peer %ui %ui", pc->tries, state);
 
-    if (state == 0 && pc->tries == 0) {
-        return;
-    }
-
     /* TODO: NGX_PEER_KEEPALIVE */
 
     if (rrp->peers->single) {