[PATCH 2 of 3] Fixed r->main->blocked overflow with many subrequests

[Maxim Dounin]

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1793076899 -10800
#      Tue Oct 27 07:54:59 2026 +0300
# Node ID 19f937a6a6bf0c24dacfce1068d4153656b9f995
# Parent  d08712494b7af0e2611c4b5148129fd4c5bc9c50
Fixed r->main->blocked overflow with many subrequests.

Similarly to r->main->count overflow by subrequests as addressed by
6238:8c6e71722aff (which became possible after subrequest limiting
changes in 6237:06e850859a26), r->main->blocked might overflow if there
are multiple AIO operations.  This could result in a request being freed
prematurely, followed by accesses to already freed memory when an AIO
operation completes (known as CVE-2026-97205, though security impact is
questionable).

The fix is to use 16 bits for the r->main->blocked counter, so the
subrequest limit introduced in 6238:8c6e71722aff ensures that it does
not overflow.

See also:
https://github.com/nginx/nginx/commit/6adfc05ece48f92446383ec1f145446848694698

diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -473,8 +473,8 @@ struct ngx_http_request_s {
     ngx_http_cleanup_t               *cleanup;
 
     unsigned                          count:16;
+    unsigned                          blocked:16;
     unsigned                          subrequests:8;
-    unsigned                          blocked:8;
 
     unsigned                          aio:1;