nginx keepalive fix for memory corruption caused by nginx-upstream-dynamic-servers

From ad13d2c326c2e0ee44f7a2653a06786bf6f65477 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kipras=20Mancevi=C4=8Dius?= <[email protected]>
Date: Fri, 5 Aug 2016 17:25:04 +0300
Subject: [PATCH] Attempt to fix infinite loop and memory leaks caused by dynamic servers module

---
 .../http/modules/ngx_http_upstream_keepalive_module.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/bundle/nginx-1.9.7/src/http/modules/ngx_http_upstream_keepalive_module.c b/bundle/nginx-1.9.7/src/http/modules/ngx_http_upstream_keepalive_module.c
index 51887b4..ae0bcc3 100644
--- a/bundle/nginx-1.9.7/src/http/modules/ngx_http_upstream_keepalive_module.c
+++ b/bundle/nginx-1.9.7/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -11,6 +11,7 @@
 
 
 typedef struct {
+    ngx_uint_t                         id;
     ngx_uint_t                         max_cached;
 
     ngx_queue_t                        cache;
@@ -24,6 +25,7 @@ typedef struct {
 
 typedef struct {
     ngx_http_upstream_keepalive_srv_conf_t  *conf;
+    ngx_uint_t                               conf_id;
 
     ngx_queue_t                        queue;
     ngx_connection_t                  *connection;
@@ -141,6 +143,8 @@ ngx_http_upstream_init_keepalive(ngx_conf_t *cf,
 
     us->peer.init = ngx_http_upstream_init_keepalive_peer;
 
+    kcf->id++;
+
     /* allocate cache items and add to free queue */
 
     cached = ngx_pcalloc(cf->pool,
@@ -153,6 +157,7 @@ ngx_http_upstream_init_keepalive(ngx_conf_t *cf,
     ngx_queue_init(&kcf->free);
 
     for (i = 0; i < kcf->max_cached; i++) {
+        cached[i].conf_id = kcf->id;
         ngx_queue_insert_head(&kcf->free, &cached[i].queue);
         cached[i].conf = kcf;
     }
@@ -229,6 +234,12 @@ ngx_http_upstream_get_keepalive_peer(ngx_peer_connection_t *pc, void *data)
 
     cache = &kp->conf->cache;
 
+    q = ngx_queue_head(cache);
+    item = ngx_queue_data(q, ngx_http_upstream_keepalive_cache_t, queue);
+    if (item->conf_id != kp->conf->id) {
+      return NGX_OK;
+    }
+
     for (q = ngx_queue_head(cache);
          q != ngx_queue_sentinel(cache);
          q = ngx_queue_next(q))
@@ -411,8 +422,10 @@ ngx_http_upstream_keepalive_close_handler(ngx_event_t *ev)
 
     ngx_http_upstream_keepalive_close(c);
 
-    ngx_queue_remove(&item->queue);
-    ngx_queue_insert_head(&conf->free, &item->queue);
+    if (item->conf_id == conf->id) {
+        ngx_queue_remove(&item->queue);
+        ngx_queue_insert_head(&conf->free, &item->queue);
+    }
 }
 
 
@@ -473,6 +486,8 @@ ngx_http_upstream_keepalive_create_conf(ngx_conf_t *cf)
         return NULL;
     }
 
+    conf->id = 0;
+
     /*
      * set by ngx_pcalloc():
      *