VTS segfault on nginx reload with SIGHUP

[kainswor]

I was careful to give enough time between reloads for any workers that needed to die to die, but this causes a failure to bind error from nginx, not a segfault. I think maybe the init conf method isn't hardened for repeated re-cycling?

Repro steps:
service nginx start
gdb -p

signal SIGHUP
ctrl-c
signal SIGHUP
ctrl-c
signal SIGHUP
segfault
backtrace full:
#0  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:33

No locals.
#1  0x00000000004ad46b in memcpy (__len=, __src=, __dest=0x7f03996f2029) at /usr/include/x86_64-linux-gnu/bits/string3.h:51

No locals.
#2  ngx_http_vhost_traffic_status_filter_unique (pool=0x1100190, keys=keys@entry=0x1103780) at ./modules/nginx-module-vts/src/ngx_http_vhost_traffic_status_module.c:3184

        hash =
        p = 0x7f03996f2029 ""
        key = {len = 4976979, data = 0x7f03996f2010 "$server_addr:$server_port"}
        i = 0
        n = 1
        uniqs = 0x1196488
        filter_keys = 0x0
        filter =
        filters = 0x1157648
        filter_uniqs =
#3  0x00000000004ad975 in ngx_http_vhost_traffic_status_init_main_conf (cf=0x7ffe12032d40, conf=0x1103778) at ./modules/nginx-module-vts/src/ngx_http_vhost_traffic_status_module.c:4779

        ctx = 0x1103778
        rc =
        vtscf = 0x11037c8
#4  0x0000000000432e34 in ngx_http_block (cf=0x7ffe12032d40, cmd=0xa, conf=0x4bf13a) at src/http/ngx_http.c:269

        rv = 0xffff80fc6644eea7 <error: Cannot access memory at address 0xffff80fc6644eea7>
        ctx = 0x117b9e0
        s = 7487744
        clcf = 0x5
#5  0x0000000000419f33 in ngx_conf_handler (last=1, cf=0x7ffe12032d40) at src/core/ngx_conf_file.c:427

        rv =
        conf =
        i = 9
        confp =
        found = 1
        name = 0x1101220
        cmd = 0x70aae0 <ngx_http_commands>
#6  ngx_conf_parse (cf=cf@entry=0x7ffe12032d40, filename=filename@entry=0x1100390) at src/core/ngx_conf_file.c:283

        rv =
        p =
        size =
        fd = 4
        rc =
        buf = {
          pos = 0x10fafec "\n", ' ' <repeats 17 times>, "tcl tk;\n    application/x-x509-ca-cert", ' ' <repeats 12 times>, "der pem crt;\n    application/x-xpinstall", ' ' <repeats 15 times>, "xpi;\n    application/xhtml+xml", ' ' <repeats 17 times>, "xhtml;\n    application/xspf+xm"...,
          last = 0x10fafed ' ' <repeats 17 times>, "tcl tk;\n    application/x-x509-ca-cert", ' ' <repeats 12 times>, "der pem crt;\n    application/x-xpinstall", ' ' <repeats 15 times>, "xpi;\n    application/xhtml+xml", ' ' <repeats 17 times>, "xhtml;\n    application/xspf+xml"..., file_pos = 8602557481092212992, file_last = 3544386174626525807,
          start = 0x10fa6c0 "user www-data;\nworker_rlimit_core 500m;\nworking_directory /tmp/nginxcores/;\nworker_rlimit_nofile 1000000;\nworker_processes 16;\nworker_cpu_affinity\n", ' ' <repeats 20 times>, '0' <repeats 15 times>, "100000000\n        "...,
          end = 0x10fb6c0 "\020\020", tag = 0xffff8001edfcd401, file = 0x401, shadow = 0x100, temporary = 1, memory = 0, mmap = 0, recycled = 0, in_file = 1, flush = 1, sync = 0, last_buf = 0, last_in_chain = 1, last_shadow = 0, temp_file = 0, num = 0}
        tbuf =
        prev = 0x0
        conf_file = {file = {fd = 4, name = {len = 21, data = 0x1100406 "/etc/nginx/nginx.conf"}, info = {st_dev = 2049, st_ino = 133886, st_nlink = 1, st_mode = 33188, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 2349, st_blksize = 4096, st_blocks = 8,
              st_atim = {tv_sec = 1468545661, tv_nsec = 100448752}, st_mtim = {tv_sec = 1468545433, tv_nsec = 231630832}, st_ctim = {tv_sec = 1468545433, tv_nsec = 231630832}, __glibc_reserved = {0, 0, 0}}, offset = 2349, sys_offset = 17826272, log = 0x11904b8,
            thread_handler = 0x7ffe12032c98, thread_ctx = 0x7ffe12032c98, aio = 0x4000, valid_info = 0, directio = 1}, buffer = 0x7ffe12032b50, dump = 0x0, line = 87}
        cd =
        type = parse_file
#7  0x00000000004177a1 in ngx_init_cycle (old_cycle=old_cycle@entry=0x11904a0) at src/core/ngx_cycle.c:268

        rv =
        senv = 0x7ffe12033358
        env =
        i =
        n =
        log = 0x11904b8
        conf = {name = 0x0, args = 0x1100fe8, cycle = 0x11001e0, pool = 0x1100190, temp_pool = 0x11325b0, conf_file = 0x7ffe12032ba0, log = 0x11904b8, ctx = 0x1101550, module_type = 1347703880, cmd_type = 33554432, handler = 0x0, handler_conf = 0x0}
        pool = 0x1100190
        cycle = 0x11001e0
        old =
        shm_zone =
        oshm_zone =
        part =
        opart =
        file =
        ls =
        nls =
        ccf =
        old_ccf =
        module =
hostname = "omitted.com'
#8 0x0000000000428a22 in ngx_master_process_cycle (cycle=0x11904a0, cycle@entry=0x10f4340) at src/os/unix/ngx_process_cycle.c:234

    title = <optimized out>
    p = <optimized out>
    size = <optimized out>
    i = <optimized out>
    n = <optimized out>
    sigio = 0
    set = {__val = {0 <repeats 16 times>}}
    itv = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 0, tv_usec = 0}}
    live = <optimized out>
    delay = 0
    ls = <optimized out>
    ccf = 0x11910b0

#9 0x0000000000407b9f in main (argc=, argv=) at src/core/nginx.c:359

    b = <optimized out>
    log = 0x7251c0 <ngx_log>
    i = <optimized out>
    cycle = 0x10f4340
    init_cycle = {conf_ctx = 0x0, pool = 0x10f3d90, log = 0x7251c0 <ngx_log>, new_log = {log_level = 0, file = 0x0, connection = 0, disk_full_time = 0, handler = 0x0, data = 0x0, writer = 0x0, wdata = 0x0, action = 0x0, next = 0x0}, log_use_stderr = 0, files = 0x0, 
      free_connections = 0x0, free_connection_n = 0, reusable_connections_queue = {prev = 0x0, next = 0x0}, listening = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, paths = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, config_dump = {
        elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, open_files = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, shared_memory = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, 
        pool = 0x0}, connection_n = 0, files_n = 0, connections = 0x0, read_events = 0x0, write_events = 0x0, old_cycle = 0x0, conf_file = {len = 21, data = 0x4b6749 "/etc/nginx/nginx.conf"}, conf_param = {len = 0, data = 0x0}, conf_prefix = {len = 11, 
        data = 0x4b6749 "/etc/nginx/nginx.conf"}, prefix = {len = 11, data = 0x4b673d "/etc/nginx/"}, lock_file = {len = 0, data = 0x0}, hostname = {len = 0, data = 0x0}}
    cd = <optimized out>
    ccf = <optimized out>

[kainswor]

I'm currently working around this by setting in the nginx conf:
vhost_traffic_status_filter_check_duplicate off;

But this seems like a feature that would be good to enable.

[vozlt]

Hi, Thanks for reporting.
Are you using the latest version(v0.1.10 now tagged :) )?
Because the debug line doesn't match compared to latest code.

#2  ngx_http_vhost_traffic_status_filter_unique (pool=0x1100190, keys=keys@entry=0x1103780) at ./modules/nginx-module-vts/src/ngx_http_vhost_traffic_status_module.c:3184

The latest code has patched that similar problem.(0cb444e)

The vhost_traffic_status_filter_check_duplicate directive just removes duplicates if vhost_traffic_status_filter_by_set_key directive has a same keys(key + name) only at initialzation(start or reload ... ).

FYI. There has been similar issues.(#35, #33)