core: Cleanup the request soon/even if some output filter fails to

handle the EOR bucket.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1666998 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 416240ad5a6d4a7d07ce014a4341a6943d0b9366..b19045cead9c7a3b438ce4c4debf8337b32092c8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@ Changes with Apache 2.5.0
      to a local URL-path with the INCLUDES filter active, introduced
      in 2.4.11. PR 57531. [Yann Ylavic]
 
+  *) core: Cleanup the request soon/even if some output filter fails to
+     handle the EOR bucket.  [Yann Ylavic]
+
   *) mpm_event: Allow for timer events duplicates. [Jim Jagielski, Yann Ylavic]
 
   *) mod_dav: Avoid a potential integer underflow in the lock timeout value sent

diff --git a/modules/http/http_request.c b/modules/http/http_request.c
index 79179787c62bcbcc5dee202fe876dca269c778c2..7b06def9405573da04ff7712b038c24ac67f7bc0 100644 (file)
--- a/modules/http/http_request.c
+++ b/modules/http/http_request.c
@@ -228,12 +228,12 @@ AP_DECLARE(void) ap_die(int type, request_rec *r)
     ap_die_r(type, r, r->status);
 }
 
-static void check_pipeline(conn_rec *c)
+static void check_pipeline(conn_rec *c, apr_bucket_brigade *bb)
 {
-    if (c->keepalive != AP_CONN_CLOSE) {
+    if (c->keepalive != AP_CONN_CLOSE && !c->aborted) {
         apr_status_t rv;
-        apr_bucket_brigade *bb = apr_brigade_create(c->pool, c->bucket_alloc);
 
+        AP_DEBUG_ASSERT(APR_BRIGADE_EMPTY(bb));
         rv = ap_get_brigade(c->input_filters, bb, AP_MODE_SPECULATIVE,
                             APR_NONBLOCK_READ, 1);
         if (rv != APR_SUCCESS || APR_BRIGADE_EMPTY(bb)) {
@@ -246,7 +246,6 @@ static void check_pipeline(conn_rec *c)
         else {
             c->data_in_input_filters = 1;
         }
-        apr_brigade_destroy(bb);
     }
 }
 
@@ -261,20 +260,30 @@ AP_DECLARE(void) ap_process_request_after_handler(request_rec *r)
      * this bucket is destroyed, the request will be logged and
      * its pool will be freed
      */
-    bb = apr_brigade_create(r->connection->pool, r->connection->bucket_alloc);
-    b = ap_bucket_eor_create(r->connection->bucket_alloc, r);
+    bb = apr_brigade_create(c->pool, c->bucket_alloc);
+    b = ap_bucket_eor_create(c->bucket_alloc, r);
     APR_BRIGADE_INSERT_HEAD(bb, b);
 
-    ap_pass_brigade(r->connection->output_filters, bb);
+    ap_pass_brigade(c->output_filters, bb);
+    
+    /* The EOR bucket has either been handled by an output filter (eg.
+     * deleted or moved to a buffered_bb => no more in bb), or an error
+     * occured before that (eg. c->aborted => still in bb) and we ought
+     * to destroy it now. So cleanup any remaining bucket along with
+     * the orphan request (if any).
+     */
+    apr_brigade_cleanup(bb);
 
     /* From here onward, it is no longer safe to reference r
      * or r->pool, because r->pool may have been destroyed
      * already by the EOR bucket's cleanup function.
      */
 
+    check_pipeline(c, bb);
+    apr_brigade_destroy(bb);
     if (c->cs)
-        c->cs->state = CONN_STATE_WRITE_COMPLETION;
-    check_pipeline(c);
+        c->cs->state = (c->aborted) ? CONN_STATE_LINGER
+                                    : CONN_STATE_WRITE_COMPLETION;
     AP_PROCESS_REQUEST_RETURN((uintptr_t)r, r->uri, r->status);
     if (ap_extended_status) {
         ap_time_process_request(c->sbh, STOP_PREQUEST);

diff --git a/server/core_filters.c b/server/core_filters.c
index 92eb216f2323032c79b9b81d38fad4fbb583d00c..1d7470b27f2e45bb7bd121a068a5d1f3afd50c56 100644 (file)
--- a/server/core_filters.c
+++ b/server/core_filters.c
@@ -468,17 +468,16 @@ apr_status_t ap_core_output_filter(ap_filter_t *f, apr_bucket_brigade *new_bb)
     if (new_bb == NULL) {
         rv = send_brigade_nonblocking(net->client_socket, bb,
                                       &(ctx->bytes_written), c);
-        if (APR_STATUS_IS_EAGAIN(rv)) {
-            rv = APR_SUCCESS;
-        }
-        else if (rv != APR_SUCCESS) {
+        if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) {
             /* The client has aborted the connection */
             ap_log_cerror(APLOG_MARK, APLOG_TRACE1, rv, c,
                           "core_output_filter: writing data to the network");
+            apr_brigade_cleanup(bb);
             c->aborted = 1;
+            return rv;
         }
         setaside_remaining_output(f, ctx, bb, c);
-        return rv;
+        return APR_SUCCESS;
     }
 
     bytes_in_brigade = 0;
@@ -560,6 +559,7 @@ apr_status_t ap_core_output_filter(ap_filter_t *f, apr_bucket_brigade *new_bb)
             /* The client has aborted the connection */
             ap_log_cerror(APLOG_MARK, APLOG_TRACE1, rv, c,
                           "core_output_filter: writing data to the network");
+            apr_brigade_cleanup(bb);
             c->aborted = 1;
             return rv;
         }
@@ -587,6 +587,7 @@ apr_status_t ap_core_output_filter(ap_filter_t *f, apr_bucket_brigade *new_bb)
             /* The client has aborted the connection */
             ap_log_cerror(APLOG_MARK, APLOG_TRACE1, rv, c,
                           "core_output_filter: writing data to the network");
+            apr_brigade_cleanup(bb);
             c->aborted = 1;
             return rv;
         }