From 1f89b1805b308df51a1329aea9a81d2ba55dfedc Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Wed, 22 Nov 2017 16:53:53 +0100 Subject: [PATCH] BUG/MEDIUM: deinit: correctly deinitialize the proxy and global listener tasks While using mmap() to allocate pools for debugging purposes, kill -USR1 caused libc aborts in deinit() on two calls to free() on proxies' tasks and the global listener task. The issue comes from the fact that we're using free() to release a task instead of task_free(), so the task was allocated from a pool and released using a different method. This bug has been there since at least 1.5, so a backport is desirable to all maintained versions. --- src/haproxy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/haproxy.c b/src/haproxy.c index 4596dbded..dca2a3392 100644 --- a/src/haproxy.c +++ b/src/haproxy.c @@ -2181,7 +2181,7 @@ void deinit(void) free_http_req_rules(&p->http_req_rules); free_http_res_rules(&p->http_res_rules); - free(p->task); + task_free(p->task); pool_destroy2(p->req_cap_pool); pool_destroy2(p->rsp_cap_pool); @@ -2228,7 +2228,7 @@ void deinit(void) free(global.node); global.node = NULL; free(global.desc); global.desc = NULL; free(oldpids); oldpids = NULL; - free(global_listener_queue_task); global_listener_queue_task = NULL; + task_free(global_listener_queue_task); global_listener_queue_task = NULL; list_for_each_entry_safe(log, logb, &global.logsrvs, list) { LIST_DEL(&log->list);