SIGSEGV on init_worker_by_lua_file with non-existent file

The NGINX worker process crashes through a null pointer dereference when using init_worker_by_lua_file with a non-existent file.

Environment

• NGINX core version: 1.18.0-6ubuntu2 hirsute/universe
• ngx_lua version: 1.18.0-6ubuntu2 hirsute/universe
• LuaJIT 2.1.0~beta3+dfsg-5.1build1

Backtrace

Disassembly:
 => 0x5603da2bb5aa:	mov    0x10(%rax),%rdx
    0x5603da2bb5ae:	movq   $0xffffffffffffffff,0x60(%r12)
    0x5603da2bb5b7:	mov    0xf8(%rax),%rax
    0x5603da2bb5be:	movq   $0xffffffffffffffff,0x80(%r12)
    0x5603da2bb5ca:	mov    %rax,0x38(%r12)
    0x5603da2bb5cf:	mov    %r12,%rax
    0x5603da2bb5d2:	movq   $0xffffffffffffffff,0x88(%r12)
    0x5603da2bb5de:	movq   $0xffffffffffffffff,0x90(%r12)
    0x5603da2bb5ea:	mov    %rdx,0x30(%r12)
    0x5603da2bb5ef:	add    $0x8,%rsp
    0x5603da2bb5f3:	pop    %rbx
    0x5603da2bb5f4:	pop    %r12
    0x5603da2bb5f6:	ret    
    0x5603da2bb5f7:	nopw   0x0(%rax,%rax,1)
    0x5603da2bb600:	xor    %r12d,%r12d
    0x5603da2bb603:	add    $0x8,%rsp
Package: nginx-extras 1.18.0-6ubuntu2
PackageArchitecture: amd64
ProcVersionSignature: Ubuntu 5.8.0-26.27-generic 5.8.14
Registers:
 rax            0x0                 0
 rbx            0x7ffe027eb030      140728940277808
 rcx            0x3fb0              16304
 rdx            0x5603daeba350      94574557766480
 rsi            0x5603daeba420      94574557766688
 rdi            0x5603daeba350      94574557766480
 rbp            0x5603dae98888      0x5603dae98888
 rsp            0x7ffe027eafc0      0x7ffe027eafc0
 r8             0x5603daeae458      94574557717592
 r9             0x0                 0
 r10            0x7ffe027ea5c2      140728940275138
 r11            0x246               582
 r12            0x5603daeae458      94574557717592
 r13            0x5603dae8fe00      94574557593088
 r14            0x5603da373280      94574545941120
 r15            0x7ffe027eb030      140728940277808
 rip            0x5603da2bb5aa      0x5603da2bb5aa
 eflags         0x10206             [ PF IF RF ]
 cs             0x33                51
 ss             0x2b                43
 ds             0x0                 0
 es             0x0                 0
 fs             0x0                 0
 gs             0x0                 0
SegvAnalysis:
 Segfault happened at: 0x5603da2bb5aa:	mov    0x10(%rax),%rdx
 PC (0x5603da2bb5aa) ok
 source "0x10(%rax)" (0x00000010) not located in a known VMA region (needed readable region)!
 destination "%rdx" ok
SegvReason: reading NULL VMA
SourcePackage: nginx
Stacktrace:
 #0  0x00005603da2bb5aa in ?? ()
 No symbol table info available.
 #1  0x00007f426528c361 in ngx_http_lua_init_worker (cycle=0x5603dae8e480) at ./debian/modules/http-lua/src/ngx_http_lua_initworkerby.c:195
         rv = <optimized out>
         cur = <optimized out>
         prev = <optimized out>
         i = <optimized out>
         conf = {name = 0x0, args = 0x0, cycle = 0x5603daeadc10, pool = 0x5603dae8e430, temp_pool = 0x5603daeba350, conf_file = 0x0, log = 0x5603dae8e498, ctx = 0x7ffe027eb010, module_type = 0, cmd_type = 0, handler = 0x0, handler_conf = 0x0}
         fake_cycle = 0x5603daeadc10
         modules = <optimized out>
         file = <optimized out>
         ofile = <optimized out>
         part = <optimized out>
         c = <optimized out>
         module = 0x5603da373280
         r = <optimized out>
         ctx = <optimized out>
         conf_ctx = <optimized out>
         http_ctx = {main_conf = 0x5603dae90fe0, srv_conf = 0x5603daeae268, loc_conf = 0x5603daeae078}
         top_llcf = <optimized out>
         lmcf = 0x5603dae98888
         clcf = <optimized out>
         top_clcf = <optimized out>
         failed = <optimized out>
 #2  0x00005603da2ab926 in ngx_single_process_cycle ()
 No symbol table info available.
 #3  0x00005603da27d956 in main ()
 No symbol table info available.
StacktraceAddressSignature: /usr/sbin/nginx:11:/usr/sbin/nginx+415aa:/usr/lib/nginx/modules/ngx_http_lua_module.so+37361:/usr/sbin/nginx+31926:/usr/sbin/nginx+3956
StacktraceTop:
 ?? ()
 ngx_http_lua_init_worker (cycle=0x5603dae8e480) at ./debian/modules/http-lua/src/ngx_http_lua_initworkerby.c:195
 ngx_single_process_cycle ()
 main ()
Tags: hirsute third-party-packages
ThreadStacktrace:
 .
 Thread 1 (Thread 0x7f42652b8b80 (LWP 115099)):
 #0  0x00005603da2bb5aa in ?? ()
 No symbol table info available.
 #1  0x00007f426528c361 in ngx_http_lua_init_worker (cycle=0x5603dae8e480) at ./debian/modules/http-lua/src/ngx_http_lua_initworkerby.c:195
         rv = <optimized out>
         cur = <optimized out>
         prev = <optimized out>
         i = <optimized out>
         conf = {name = 0x0, args = 0x0, cycle = 0x5603daeadc10, pool = 0x5603dae8e430, temp_pool = 0x5603daeba350, conf_file = 0x0, log = 0x5603dae8e498, ctx = 0x7ffe027eb010, module_type = 0, cmd_type = 0, handler = 0x0, handler_conf = 0x0}
         fake_cycle = 0x5603daeadc10
         modules = <optimized out>
         file = <optimized out>
         ofile = <optimized out>
         part = <optimized out>
         c = <optimized out>
         module = 0x5603da373280
         r = <optimized out>
         ctx = <optimized out>
         conf_ctx = <optimized out>
         http_ctx = {main_conf = 0x5603dae90fe0, srv_conf = 0x5603daeae268, loc_conf = 0x5603daeae078}
         top_llcf = <optimized out>
         lmcf = 0x5603dae98888
         clcf = <optimized out>
         top_clcf = <optimized out>
         failed = <optimized out>
 #2  0x00005603da2ab926 in ngx_single_process_cycle ()
 No symbol table info available.
 #3  0x00005603da27d956 in main ()
 No symbol table info available.
Title: nginx crashed with SIGSEGV in ngx_http_lua_init_worker()
UpgradeStatus: Upgraded to hirsute on 2020-11-03 (24 days ago)

Test case

use Test::Nginx::Socket 'no_plan';

run_tests();

__DATA__

=== TEST 1: Crash NGINX
--- main_config
    load_module /usr/share/nginx/modules/ndk_http_module.so;
    load_module /usr/share/nginx/modules/ngx_http_lua_module.so;
--- http_config
    init_worker_by_lua_file "gone";
--- config
--- request
    GET /test
--- error_code: 404

Can't attach coredump for privacy reasons, but should be easy enough to reproduce.

Start in debian/modules/http-lua/src/ngx_http_lua_initworkerby.c at line 195, where the backtrace places the crash. Run the supplied Test::Nginx::Socket case using init_worker_by_lua_file "gone" and inspect the initialization path. Done means the missing file no longer causes SIGSEGV and the test reaches its expected 404 response.