On Fri, Nov 14, 2014 at 1:04 PM, <cove...@apache.org> wrote: > Author: covener > Date: Fri Nov 14 12:04:46 2014 > New Revision: 1639614 > > URL: http://svn.apache.org/r1639614 > Log: > don't call notify_suspend() in a worker thread after > start_lingering_close_common may have put the socket back > into the pollset. > > If it becomes readable too quickly, cs can be > free'ed or accessed concurrently. > > Modified: > httpd/httpd/trunk/server/mpm/event/event.c > [] > @@ -1138,7 +1141,6 @@ read_request: > > if (cs->pub.state == CONN_STATE_LINGER) { > start_lingering_close_blocking(cs); > - notify_suspend(cs); > }
Also, the old code notified unconditionally (too late, but always), whereas now it will not should ap_start_lingering_close() fail in start_lingering_close_blocking(). Shouldn't we : Index: server/mpm/event/event.c =================================================================== --- server/mpm/event/event.c (revision 1642684) +++ server/mpm/event/event.c (working copy) @@ -895,6 +895,8 @@ static int start_lingering_close_common(event_conn static int start_lingering_close_blocking(event_conn_state_t *cs) { if (ap_start_lingering_close(cs->c)) { + cs->c->sbh = NULL; + notify_suspend(cs); ap_push_pool(worker_queue_info, cs->p); return 0; } return start_lingering_close_common(cs, 1); } ?