Skip to content

fix(port): plug NULL-deref in port read handlers under buf-alloc OOM #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
andypost wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

fix(port): plug NULL-deref in port read handlers under buf-alloc OOM #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions src/nxt_port_socket.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -746,7 +746,13 @@ nxt_port_read_handler(nxt_task_t *task, void *obj, void *data)
b = nxt_port_buf_alloc(port);

if (nxt_slow_path(b == NULL)) {
/* TODO: disable event for some time */
nxt_log(task, NXT_LOG_INFO,
"port{%d,%d} %d: read-buf alloc failed; "
"blocking read event",
(int) port->pid, (int) port->id, port->socket.fd);

nxt_fd_event_block_read(task->thread->engine, &port->socket);
return;
}

iov[0].iov_base = &msg.port_msg;
Expand Down Expand Up @@ -889,7 +895,14 @@ nxt_port_queue_read_handler(nxt_task_t *task, void *obj, void *data)
b = nxt_port_buf_alloc(port);

if (nxt_slow_path(b == NULL)) {
/* TODO: disable event for some time */
nxt_log(task, NXT_LOG_INFO,
"port{%d,%d} %d: read-buf alloc failed; "
"blocking queue read event",
(int) port->pid, (int) port->id, port->socket.fd);

nxt_atomic_fetch_add(&queue->nitems, -1);
nxt_fd_event_block_read(task->thread->engine, &port->socket);
return;
}
Comment on lines 897 to 906
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

In nxt_port_queue_read_handler, if nxt_port_buf_alloc(port) fails at line 895, any message already dequeued from the shared memory queue at line 841 (via nxt_port_queue_recv) will be lost. This is because the message data is currently held only in the local qmsg buffer, which is discarded when the function returns. To avoid losing IPC messages during memory pressure, consider allocating the buffer before consuming the message from the shared queue. Additionally, using NXT_LOG_INFO for a condition that effectively halts IPC for the process might be too low; NXT_LOG_WARN or NXT_LOG_ERR would be more appropriate to signal the severity of the resource exhaustion.


if (n >= (ssize_t) sizeof(nxt_port_msg_t)) {
Expand Down Expand Up @@ -1342,7 +1355,6 @@ nxt_port_error_handler(nxt_task_t *task, void *obj, void *data)
nxt_port_send_msg_t *msg;

nxt_debug(task, "port error handler %p", obj);
/* TODO */

port = nxt_container_of(obj, nxt_port_t, socket);

Expand Down
Loading