mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-20 19:27:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Core: invalidated shared memory addresses after unmapping.

Browse Source 
As we unmap the unused shared zones before destroying the cycle pool, it
was possible to access already unmapped address from a cleanup handler.
The change gives such handlers a way to determine that the memory is
unavailable and any processing should be skipped.
This commit is contained in:
Aleksei Bavshin 2025-06-12 10:36:30 -07:00
parent 5b8a5c08ce
commit d2dfb3d37f
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/os/unix/ngx_shmem.c
View File

@ -19,6 +19,7 @@ ngx_shm_alloc(ngx_shm_t *shm)
MAP_ANON|MAP_SHARED, -1, 0); MAP_ANON|MAP_SHARED, -1, 0);
if (shm->addr == MAP_FAILED) { if (shm->addr == MAP_FAILED) {
shm->addr = NULL;
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno,
"mmap(MAP_ANON|MAP_SHARED, %uz) failed", shm->size); "mmap(MAP_ANON|MAP_SHARED, %uz) failed", shm->size);
return NGX_ERROR; return NGX_ERROR;
@ -35,6 +36,8 @@ ngx_shm_free(ngx_shm_t *shm)
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno,
"munmap(%p, %uz) failed", shm->addr, shm->size); "munmap(%p, %uz) failed", shm->addr, shm->size);
} }
shm->addr = NULL;
} }
#elif (NGX_HAVE_MAP_DEVZERO) #elif (NGX_HAVE_MAP_DEVZERO)
@ -56,6 +59,7 @@ ngx_shm_alloc(ngx_shm_t *shm)
MAP_SHARED, fd, 0); MAP_SHARED, fd, 0);
if (shm->addr == MAP_FAILED) { if (shm->addr == MAP_FAILED) {
shm->addr = NULL;
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno,
"mmap(/dev/zero, MAP_SHARED, %uz) failed", shm->size); "mmap(/dev/zero, MAP_SHARED, %uz) failed", shm->size);
} }
@ -65,7 +69,7 @@ ngx_shm_alloc(ngx_shm_t *shm)
"close(\"/dev/zero\") failed"); "close(\"/dev/zero\") failed");
} }
return (shm->addr == MAP_FAILED) ? NGX_ERROR : NGX_OK; return (shm->addr == NULL) ? NGX_ERROR : NGX_OK;
} }
@ -76,6 +80,8 @@ ngx_shm_free(ngx_shm_t *shm)
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno,
"munmap(%p, %uz) failed", shm->addr, shm->size); "munmap(%p, %uz) failed", shm->addr, shm->size);
} }
shm->addr = NULL;
} }
#elif (NGX_HAVE_SYSVSHM) #elif (NGX_HAVE_SYSVSHM)
@ -102,6 +108,7 @@ ngx_shm_alloc(ngx_shm_t *shm)
shm->addr = shmat(id, NULL, 0); shm->addr = shmat(id, NULL, 0);
if (shm->addr == (void *) -1) { if (shm->addr == (void *) -1) {
shm->addr = NULL;
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, "shmat() failed"); ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, "shmat() failed");
} }
@ -110,7 +117,7 @@ ngx_shm_alloc(ngx_shm_t *shm)
"shmctl(IPC_RMID) failed"); "shmctl(IPC_RMID) failed");
} }
return (shm->addr == (void *) -1) ? NGX_ERROR : NGX_OK; return (shm->addr == NULL) ? NGX_ERROR : NGX_OK;
} }
@ -121,6 +128,8 @@ ngx_shm_free(ngx_shm_t *shm)
ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno, ngx_log_error(NGX_LOG_ALERT, shm->log, ngx_errno,
"shmdt(%p) failed", shm->addr); "shmdt(%p) failed", shm->addr);
} }
shm->addr = NULL;
} }
#endif #endif

2
src/os/win32/ngx_shmem.c
View File

@ -158,4 +158,6 @@ ngx_shm_free(ngx_shm_t *shm)
"CloseHandle() of file mapping \"%V\" failed", "CloseHandle() of file mapping \"%V\" failed",
&shm->name); &shm->name);
} }
shm->addr = NULL;
} }