commit 2fd8b271c4ff1474ac52f06051829513169eae17
author Ruslan Ermilov <ru@nginx.com> Mon Mar 25 13:16:55 2013 +0000
committer Ruslan Ermilov <ru@nginx.com> Mon Mar 25 13:16:55 2013 +0000
tree cd71bb11895d800e535e16dbc59ffee2e3c73b54
parent 46b469a8ee0aa0837e7b2cbab5341674783cc967

Upstream: removed double-free workarounds in peer.free() methods.

src/http/modules/ngx_http_upstream_keepalive_module.c

diff --git a/src/http/modules/ngx_http_upstream_keepalive_module.c b/src/http/modules/ngx_http_upstream_keepalive_module.c
index a2ad5aa..eed1174 100644
--- a/src/http/modules/ngx_http_upstream_keepalive_module.c
+++ b/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -37,8 +37,6 @@
     ngx_event_save_peer_session_pt     original_save_session;
 #endif
 
-    ngx_uint_t                         failed;       /* unsigned:1 */
-
 } ngx_http_upstream_keepalive_peer_data_t;
 
 
@@ -220,8 +218,6 @@
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "get keepalive peer");
 
-    kp->failed = 0;
-
     /* ask balancer */
 
     rc = kp->original_get_peer(pc, kp->data);
@@ -282,18 +278,12 @@
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "free keepalive peer");
 
-    /* remember failed state - peer.free() may be called more than once */
-
-    if (state & NGX_PEER_FAILED) {
-        kp->failed = 1;
-    }
-
     /* cache valid connections */
 
     u = kp->upstream;
     c = pc->connection;
 
-    if (kp->failed
+    if (state & NGX_PEER_FAILED
         || c == NULL
         || c->read->eof
         || c->read->error

src/http/modules/ngx_http_upstream_least_conn_module.c

diff --git a/src/http/modules/ngx_http_upstream_least_conn_module.c b/src/http/modules/ngx_http_upstream_least_conn_module.c
index bd2f1bc..6066ed2 100644
--- a/src/http/modules/ngx_http_upstream_least_conn_module.c
+++ b/src/http/modules/ngx_http_upstream_least_conn_module.c
@@ -353,10 +353,6 @@
         return;
     }
 
-    if (state == 0 && pc->tries == 0) {
-        return;
-    }
-
     lcp->conns[lcp->rrp.current]--;
 
     lcp->free_rr_peer(pc, &lcp->rrp, state);

src/http/ngx_http_upstream_round_robin.c

diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c
index b480394..ec7b289 100644
--- a/src/http/ngx_http_upstream_round_robin.c
+++ b/src/http/ngx_http_upstream_round_robin.c
@@ -584,10 +584,6 @@
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, pc->log, 0,
                    "free rr peer %ui %ui", pc->tries, state);
 
-    if (state == 0 && pc->tries == 0) {
-        return;
-    }
-
     /* TODO: NGX_PEER_KEEPALIVE */
 
     if (rrp->peers->single) {