passenger: No default temp path in nginx module causes segfault.

Issue report

Question 1: What is the problem? Your answer:

With nginx 1:1.15.8-8.6.0.1~xenial1 on a Rails 5.2.2.1 app I can use Rails send_file without a problem. When upgrading to nginx/xenial 1:1.15.8-8.6.0.2~xenial1 this doesn’t work anymore (for most file, not all of them. For example thumbnails of images work, but the originals don’t).

nginx’ error.log shows:

2019/03/22 13:10:47 [alert] 21227#21227: worker process 2032 exited on signal 11
2019/03/22 13:10:47 [alert] 21227#21227: worker process 2031 exited on signal 11
2019/03/22 13:10:47 [alert] 21227#21227: worker process 23789 exited on signal 11
2019/03/22 13:12:02 [alert] 21227#21227: worker process 23788 exited on signal 11
2019/03/22 13:12:03 [alert] 21227#21227: worker process 23790 exited on signal 11
2019/03/22 13:12:03 [alert] 21227#21227: worker process 23898 exited on signal 11
2019/03/22 13:12:53 [alert] 21227#21227: worker process 23901 exited on signal 11
2019/03/22 13:16:02 [alert] 21227#21227: worker process 23902 exited on signal 11
2019/03/22 13:16:02 [alert] 21227#21227: worker process 23976 exited on signal 11
2019/03/22 13:16:02 [alert] 21227#21227: worker process 24219 exited on signal 11

I can reproduce this by upgrading nginx, nginx-common, nginx-extras to 1:1.15.8-8.6.0.2~xenial1 and then downgrading again to 1:1.15.8-8.6.0.1~xenial1.

Since I am using the passenger provided nginx packages, I believe this to be a passenger problem, but that’s just an assumption. I couldn’t find the source repo or changelog of these releases.

I’m not sure if I can provide a reproduction case since it just happens on our staging server after the upgrade of the packages and not for all files. I’m happy to provide additional information!

Question 2: Passenger version and integration mode:

For example: open source 5.0.26 standalone; enterprise 5.0.21/nginx

$ passenger --version
Phusion Passenger 6.0.2
$ nginx -v
nginx version: nginx/1.15.8

Question 3: OS or Linux distro, platform (including version):

Ubuntu 16.04 LTS

Question 4: Passenger installation method:

Phusion APT repo

# /etc/apt/sources.list.d/phusionpassenger.list
deb      "https://oss-binaries.phusionpassenger.com/apt/passenger" xenial main
deb-src  "https://oss-binaries.phusionpassenger.com/apt/passenger" xenial main

Question 5: Your app’s programming language (including any version managers) and framework (including versions):

Ruby 2.6.2, rbenv, Rails 5.2.2.1

Question 6: Are you using a PaaS and/or containerization? If so which one?

No.

Question 7: Anything else about your setup that we should know?

Using letsencrypt and the following nginx config (don’t mind nginx 1.14.0 being shown there, it’s just what the page generates): https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.14.0&openssl=1.0.2g&hsts=yes&profile=modern

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 2
Comments: 30 (17 by maintainers)

Most upvoted comments

6.0.3 released

CamJN on Sep 12, 2019

This issue is affecting me as well (Passenger; send_file; nginx 1.17.0). Backtrace:

(gdb) bt
#0  ngx_create_temp_file (file=file@entry=0xf8f898, path=0x0, pool=0xf91130, persistent=0, clean=0, access=0) at src/core/ngx_file.c:159
#1  0x00000000004548ab in ngx_write_chain_to_temp_file (tf=0xf8f898, chain=chain@entry=0xf8f9a0) at src/core/ngx_file.c:114
#2  0x000000000046e126 in ngx_event_pipe_write_chain_to_temp_file (p=p@entry=0xf92968) at src/event/ngx_event_pipe.c:839
#3  0x000000000046eec1 in ngx_event_pipe_read_upstream (p=0xf92968) at src/event/ngx_event_pipe.c:273
#4  ngx_event_pipe (p=p@entry=0xf92968, do_write=<optimized out>, do_write@entry=0) at src/event/ngx_event_pipe.c:49
#5  0x000000000049e4eb in ngx_http_upstream_process_upstream (r=0xf91180, u=0xf92520) at src/http/ngx_http_upstream.c:3924
#6  0x000000000049d4f2 in ngx_http_upstream_handler (ev=0xfa1e00) at src/http/ngx_http_upstream.c:1289
#7  0x000000000047662e in ngx_epoll_process_events (cycle=0xf26b10, timer=<optimized out>, flags=<optimized out>) at src/event/modules/ngx_epoll_module.c:902
#8  0x000000000046b9b2 in ngx_process_events_and_timers (cycle=cycle@entry=0xf26b10) at src/event/ngx_event.c:242
#9  0x0000000000474398 in ngx_worker_process_cycle (cycle=0xf26b10, data=<optimized out>) at src/os/unix/ngx_process_cycle.c:750
#10 0x00000000004728f3 in ngx_spawn_process (cycle=cycle@entry=0xf26b10, proc=proc@entry=0x474283 <ngx_worker_process_cycle>, data=data@entry=0x0, name=name@entry=0x5b39de "worker process", respawn=respawn@entry=-3)
    at src/os/unix/ngx_process.c:199
#11 0x0000000000473456 in ngx_start_worker_processes (cycle=cycle@entry=0xf26b10, n=1, type=type@entry=-3) at src/os/unix/ngx_process_cycle.c:359
#12 0x0000000000474c40 in ngx_master_process_cycle (cycle=cycle@entry=0xf26b10) at src/os/unix/ngx_process_cycle.c:131
#13 0x000000000044b98c in main (argc=1, argv=<optimized out>) at src/core/nginx.c:382

The SIGSEGV is because path is NULL:

(gdb) frame 0
#0  ngx_create_temp_file (file=file@entry=0xf8f898, path=0x0, pool=0xf91130, persistent=0, clean=0, access=0) at src/core/ngx_file.c:159
159             name = path->name;

The path comes from tf->path which is NULL:

(gdb) frame 1
#1  0x00000000004548ab in ngx_write_chain_to_temp_file (tf=0xf8f898, chain=chain@entry=0xf8f9a0) at src/core/ngx_file.c:114
114             rc = ngx_create_temp_file(&tf->file, tf->path, tf->pool,
(gdb) print *tf
$1 = {file = {fd = -1, name = {len = 0, data = 0x0}, info = {st_dev = 0, st_ino = 0, st_nlink = 0, st_mode = 0, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 0, st_blksize = 0, st_blocks = 0, st_atim = {tv_sec = 0, 
        tv_nsec = 0}, st_mtim = {tv_sec = 0, tv_nsec = 0}, st_ctim = {tv_sec = 0, tv_nsec = 0}, __glibc_reserved = {0, 0, 0}}, offset = 0, sys_offset = 0, log = 0xf24900, valid_info = 0, directio = 0}, offset = 0, path = 0x0, 
  pool = 0xf91130, warn = 0x5ba390 "an upstream response is buffered to a temporary file", access = 0, log_level = 5, persistent = 0, clean = 0, thread_write = 0}

My location directive has proxy_temp_path set:

  location / {
    passenger_enabled on;
    proxy_temp_path /tmp/;
  }

Let me know if you need anything else.

kevgrig on Jun 21, 2019

@CamJN I tried with proxy_temp_path set to custom path and it still crashes.

sauliusgrigaitis on Apr 18, 2019

Core was generated by `nginx: worker pr’. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00000000004424d8 in ngx_create_temp_file () (gdb) backtrace #0 0x00000000004424d8 in ngx_create_temp_file () #1 0x00000000004425ae in ngx_write_chain_to_temp_file () #2 0x000000000045c31f in ?? () #3 0x000000000045d46a in ngx_event_pipe () #4 0x000000000048d7aa in ?? () #5 0x000000000048c5cf in ?? () #6 0x0000000000464679 in ?? () #7 0x0000000000459ae7 in ngx_process_events_and_timers () #8 0x00000000004626c5 in ?? () #9 0x0000000000460d0c in ngx_spawn_process () #10 0x0000000000461e84 in ?? () #11 0x000000000046330f in ngx_master_process_cycle () #12 0x00000000004381c8 in main ()

jhill on Apr 2, 2019

@aried3r since you indicated you were interested, here’s our ubuntu/debian nginx repo source: https://github.com/phusion/passenger_apt_automation/tree/master/debian_specs/nginx

CamJN on Mar 26, 2019