Fix segfaults caused by race condition between ntlm close handler and client conn cleanup

ngx_http_upstream_ntlm_module.c

@@ -370,20 +370,27 @@ static void ngx_http_upstream_free_ntlm_peer(ngx_peer_connection_t *pc,
 
 static void ngx_http_upstream_client_conn_cleanup(void *data) {
     ngx_http_upstream_ntlm_cache_t *item = data;
-
+    ngx_connection_t *c;
+
     ngx_log_debug2(
         NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
-        "ntlm client connection closed %p, droping peer connection %p",
+        "ntlm client connection closed %p, dropping peer connection %p",
         item->client_connection, item->peer_connection);
 
     // Check if the item was removed previously from the queue (backend drop)
     if (item->peer_connection != NULL) {
+        c = item->peer_connection;
 
-        item->peer_connection->read->timedout = 1;
-        ngx_post_event(item->peer_connection->read,&ngx_posted_events);
+        // Null out peer_connection BEFORE closing so the close_handler
+        // won't double-process this item
+        item->peer_connection = NULL;
 
+        // Remove from cache queue and move to free queue
         ngx_queue_remove(&item->queue);
         ngx_queue_insert_head(&item->conf->free, &item->queue);
+
+        // Close the peer connection directly instead of posting an event
+        ngx_http_upstream_ntlm_close(c);
     }
 }
 
@@ -425,9 +432,14 @@ static void ngx_http_upstream_ntlm_close_handler(ngx_event_t *ev) {
 
     item = c->data;
     conf = item->conf;
-
-    // set the item peer connection to null to make sure we don't close it again
-    // when the client connection cleanup is triggered
+
+    // Guard: if peer_connection is already NULL, the cleanup handler
+    // already processed this item — just close the connection.
+    if (item->peer_connection == NULL) {
+        ngx_http_upstream_ntlm_close(c);
+        return;
+    }
+
     item->peer_connection = NULL;
     ngx_http_upstream_ntlm_close(c);