need luaL_checkstack?

siddontang · 2013-03-20T09:19:30+00:00

I think it's easier to install the lua module without openresty.Simply install LuaJIT, then download the nginx source, nginx development kit and lua nginx so...

need luaL_checkstack?

siddontang

Hello !

I use openresty 1.2.6 with luajit and test a simple example:

location /test1 {
content_by_lua '
local res = ngx.location.capture("/test2/auth", {args = ngx.var.args})
ngx.say(res.body)
';
}
location /test2 {
content_by_lua '
ngx.say(ngx.var.args)
';
}

I request a url like "http://127.0.0.1:80/test1?parent=29&name=2013031816214284300707&footprint=dsfasfwefklds"

Surprise, the args return "parent=29&name=2013031816214284300707&footprint=dsfasfweX", the footprint arg was changed somewhere.

I think maybe some memory corruption occur. I dive into the ngx_lua source and find that there is no luaL_checkstack, so I think maybe stack overflow when lua call c function.

Now I change LUA_MINSTACK to 50 and all is OK.

Is it need to add luaL_checkstack to control stack overflow when lua call c function?

agentzh

Hello!

On Tue, Mar 19, 2013 at 6:19 PM, Siddon Tang wrote:
>
> I use openresty 1.2.6 with luajit and test a simple example:
>

To be clear, ngx_openresty releases use 4-section version numbers like
1.2.6.6 and 1.2.7.1. What exact release version of the openresty are
you using? There are quite a few different releases in the 1.2.6.x
series, from 1.2.6.1 to 1.2.6.6.

You can provide the output of the "nginx -V" command, for example,

    /path/to/your/openresty/nginx/sbin/nginx -V

>>        location /test1 {
>>                  content_by_lua '
>>                         local res = ngx.location.capture("/test2/auth",
>> {args = ngx.var.args})
>>                         ngx.say(res.body)
>>                  ';
>>         }
>>         location /test2 {
>>         content_by_lua '
>>                         ngx.say(ngx.var.args)
>>                  ';
>>         }
>
>
> I request a url like
> "http://127.0.0.1:80/test1?parent=29&name=2013031816214284300707&footprint=dsfasfwefklds";
>
> Surprise, the args return
> "parent=29&name=2013031816214284300707&footprint=dsfasfweX", the footprint
> arg was changed somewhere.
>

I cannot reproduce the issue with your sample configuration on Linux
x86_64 with ngx_lua 0.7.9 ~ 0.7.17 + nginx 1.2.6 + LuaJIT 2.0.1
(hotfix #1 patch).

Could you provide the information of your operating system? The output
of the command "uname -a" could be helpful. Also, providing the
complete nginx.conf file could be helpful too.

> I think maybe some memory corruption occur.

Could you run valgrind's memcheck tool against your nginx?

> I dive into the ngx_lua source
> and find that there is no luaL_checkstack, so I think maybe stack overflow
> when lua call c function.
>
> Now I change LUA_MINSTACK to 50 and all is OK.
>
> Is it need to add luaL_checkstack to control stack overflow when lua call c
> function?
>

Most of the C API functions only require a very small and limited Lua
stack. We can add such checks to places that really need it.

Best regards,
-agentzh

siddontang

Thank you for your reply!

nginx -V

nginx version: ngx_openresty/1.2.6.6

built by gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.11.00)

TLS SNI support enabled

uname -a

Darwin karamatoMacBook-Air.local 11.4.2 Darwin Kernel Version 11.4.2: Thu Aug 23 16:25:48 PDT 2012; root:xnu-1699.32.7~1/RELEASE_X86_64 x86_64

my test is:

url = "" href="http://127.0.0.1:80/test1" target="_blank">http://127.0.0.1:80/test1?"
for i in xrange(10000):
args = "parent=%d&name=2013031816214284300707&footprint=dsfasfwefklds" % i
newUrl = url + args
res = urllib2.urlopen(newUrl).read()
res = res.strip()
if res != args:
print res

I request with different url many times, and it may sometime occurs randomly, so I guess lua stack overflow!

2013/3/20 agentzh <age...@gmail.com>

Hello!

On Tue, Mar 19, 2013 at 6:19 PM, Siddon Tang wrote:
>
> I use openresty 1.2.6 with luajit and test a simple example:
>

To be clear, ngx_openresty releases use 4-section version numbers like
1.2.6.6 and 1.2.7.1. What exact release version of the openresty are
you using? There are quite a few different releases in the 1.2.6.x
series, from 1.2.6.1 to 1.2.6.6.

You can provide the output of the "nginx -V" command, for example,

/path/to/your/openresty/nginx/sbin/nginx -V

>> location /test1 {
>> content_by_lua '
>> local res = ngx.location.capture("/test2/auth",
>> {args = ngx.var.args})
>> ngx.say(res.body)
>> ';
>> }
>> location /test2 {
>> content_by_lua '
>> ngx.say(ngx.var.args)
>> ';
>> }
>
>
> I request a url like
> "http://127.0.0.1:80/test1?parent=29&name=2013031816214284300707&footprint=dsfasfwefklds"
>
> Surprise, the args return
> "parent=29&name=2013031816214284300707&footprint=dsfasfweX", the footprint
> arg was changed somewhere.
>

I cannot reproduce the issue with your sample configuration on Linux
x86_64 with ngx_lua 0.7.9 ~ 0.7.17 + nginx 1.2.6 + LuaJIT 2.0.1
(hotfix #1 patch).

Could you provide the information of your operating system? The output
of the command "uname -a" could be helpful. Also, providing the
complete nginx.conf file could be helpful too.

> I think maybe some memory corruption occur.

Could you run valgrind's memcheck tool against your nginx?

> I dive into the ngx_lua source
> and find that there is no luaL_checkstack, so I think maybe stack overflow
> when lua call c function.
>
> Now I change LUA_MINSTACK to 50 and all is OK.
>
> Is it need to add luaL_checkstack to control stack overflow when lua call c
> function?
>

Most of the C API functions only require a very small and limited Lua
stack. We can add such checks to places that really need it.

Best regards,
-agentzh

.

agentzh

Hello!

On Tue, Mar 19, 2013 at 10:31 PM, Siddon Tang wrote:
>
> my test is:
>
>> url = "http://127.0.0.1:80/test1?";
>> for i in xrange(10000):
>>     args = "parent=%d&name=2013031816214284300707&footprint=dsfasfwefklds"
>> % i
>>     newUrl = url + args
>>     res = urllib2.urlopen(newUrl).read()
>>     res = res.strip()
>>     if res != args:
>>         print res
>

Okay, I reproduced the issue with your Python script and committed a
patch to fix this:

    https://github.com/chaoslawful/lua-nginx-module/commit/b582064

Given that you're using the ngx_openresty bundle, you can try out the
following prerelease of the bundle which includes this fix:

    http://openresty.org/download/ngx_openresty-1.2.7.3rc3.tar.gz

>
> I request with different url many times, and it may sometime occurs
> randomly, so I guess lua stack overflow!
>

It is not a stack overflow, but rather a (mis)use of an internal
string pointer from the Lua VM on the Nginx side, regarding the
implementation of ngx.location.capture for the "args" option value
handling.

Thank you for the report!

Best regards,
-agentzh

siddontang

Thank you. I will try the patch later.

2013/3/21 agentzh <age...@gmail.com>

Hello!

On Tue, Mar 19, 2013 at 10:31 PM, Siddon Tang wrote:
>
> my test is:
>
>> url = "" href="http://127.0.0.1:80/test1" target="_blank">http://127.0.0.1:80/test1?"
>> for i in xrange(10000):
>> args = "parent=%d&name=2013031816214284300707&footprint=dsfasfwefklds"
>> % i
>> newUrl = url + args
>> res = urllib2.urlopen(newUrl).read()
>> res = res.strip()
>> if res != args:
>> print res
>

Okay, I reproduced the issue with your Python script and committed a
patch to fix this:

https://github.com/chaoslawful/lua-nginx-module/commit/b582064

Given that you're using the ngx_openresty bundle, you can try out the
following prerelease of the bundle which includes this fix:

http://openresty.org/download/ngx_openresty-1.2.7.3rc3.tar.gz

>
> I request with different url many times, and it may sometime occurs
> randomly, so I guess lua stack overflow!
>

It is not a stack overflow, but rather a (mis)use of an internal
string pointer from the Lua VM on the Nginx side, regarding the
implementation of ngx.location.capture for the "args" option value
handling.

Thank you for the report!

Best regards,
-agentzh.