Releasing shm buffers for large body requests.

This fixes memory and shm file descriptor leakage that occurred when a large
request body was passed via shared memory.  The leakage was caught with the
"test_settings_body_buffer_size" test.  The main condition is the
"body_buffer_size" value exceeding 10 Mb (a shm segment).  Thus, the router was
forced to split the body into several shm segments, but these buffers were not
freed because of dummy completion handlers.

2 files changed, 4 insertions, 12 deletions

diff --git a/src/nxt_router.c b/src/nxt_router.c
index 0ecaefa1..8524b358 100644
--- a/src/nxt_router.c
+++ b/src/nxt_router.c
@@ -523,12 +523,11 @@ nxt_router_msg_cancel(nxt_task_t *task, nxt_request_rpc_data_t *req_rpc_data)
         next = b->next;
         b->next = NULL;
 
-        b->completion_handler = msg_info->completion_handler;
-
         if (b->is_port_mmap_sent) {
             b->is_port_mmap_sent = cancelled == 0;
-            b->completion_handler(task, b, b->parent);
         }
+
+        b->completion_handler(task, b, b->parent);
     }
 
     msg_info->buf = NULL;
@@ -4113,6 +4112,8 @@ nxt_router_req_headers_ack_handler(nxt_task_t *task,
     if (b != NULL) {
         /* First buffer is already sent.  Start from second. */
         b = b->next;
+
+        req_rpc_data->msg_info.buf->next = NULL;
     }
 
     if (req_rpc_data->msg_info.body_fd != -1 || b != NULL) {
@@ -5025,14 +5026,6 @@ nxt_router_app_prepare_request(nxt_task_t *task,
                     port->socket.fd);
 
     req_rpc_data->msg_info.buf = buf;
-    req_rpc_data->msg_info.completion_handler = buf->completion_handler;
-
-    do {
-        buf->completion_handler = nxt_router_dummy_buf_completion;
-        buf = buf->next;
-    } while (buf != NULL);
-
-    buf = req_rpc_data->msg_info.buf;
 
     body = req_rpc_data->request->body;
 
diff --git a/src/nxt_router_request.h b/src/nxt_router_request.h
index 95044dbb..6e226bae 100644
--- a/src/nxt_router_request.h
+++ b/src/nxt_router_request.h
@@ -11,7 +11,6 @@ typedef struct {
     nxt_buf_t                 *buf;
     nxt_fd_t                  body_fd;
     uint32_t                  tracking_cookie;
-    nxt_work_handler_t        completion_handler;
 } nxt_msg_info_t;