mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: map/acl: real fix segfault during show map/acl on CLI

Browse Source 
A previous commit 8d85aa44d ("BUG/MAJOR: map: fix segfault during
'show map/acl' on cli.") was provided to address a concurrency issue
between "show acl" and "clear acl" on the CLI. Sadly the code placed
there was copy-pasted without changing the element type (which was
struct stream in the original code) and not tested since the crash
is still present.

The reproducer is simple : load a large ACL file (e.g. geolocation
addresses), issue "show acl #0" in loops in one window and issue a
"clear acl #0" in the other one, haproxy crashes.

This fix was also tested with threads enabled and looks good since
the locking seems to work correctly in these areas though. It will
have to be backported as far as 1.6 since the commit above went
that far as well...
This commit is contained in:
Willy Tarreau 2019-04-30 11:43:43 +02:00
parent 85a7ea0740
commit 49ee3b2f9a
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/pattern.c
View File

@ -1652,7 +1652,7 @@ int pat_ref_delete_by_id(struct pat_ref *ref, struct pat_ref_elt *refelt)
LIST_DEL(&bref->users); LIST_DEL(&bref->users);
LIST_INIT(&bref->users); LIST_INIT(&bref->users);
if (elt->list.n != &ref->head) if (elt->list.n != &ref->head)
LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users);
bref->ref = elt->list.n; bref->ref = elt->list.n;
} }
list_for_each_entry(expr, &ref->pat, list) list_for_each_entry(expr, &ref->pat, list)
@ -1692,7 +1692,7 @@ int pat_ref_delete(struct pat_ref *ref, const char *key)
LIST_DEL(&bref->users); LIST_DEL(&bref->users);
LIST_INIT(&bref->users); LIST_INIT(&bref->users);
if (elt->list.n != &ref->head) if (elt->list.n != &ref->head)
LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users);
bref->ref = elt->list.n; bref->ref = elt->list.n;
} }
list_for_each_entry(expr, &ref->pat, list) list_for_each_entry(expr, &ref->pat, list)
@ -2087,7 +2087,7 @@ void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace)
LIST_DEL(&bref->users); LIST_DEL(&bref->users);
LIST_INIT(&bref->users); LIST_INIT(&bref->users);
if (elt->list.n != &ref->head) if (elt->list.n != &ref->head)
LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users);
bref->ref = elt->list.n; bref->ref = elt->list.n;
} }
LIST_DEL(&elt->list); LIST_DEL(&elt->list);
@ -2176,7 +2176,7 @@ void pat_ref_prune(struct pat_ref *ref)
LIST_DEL(&bref->users); LIST_DEL(&bref->users);
LIST_INIT(&bref->users); LIST_INIT(&bref->users);
if (elt->list.n != &ref->head) if (elt->list.n != &ref->head)
LIST_ADDQ(&LIST_ELEM(elt->list.n, struct stream *, list)->back_refs, &bref->users); LIST_ADDQ(&LIST_ELEM(elt->list.n, typeof(elt), list)->back_refs, &bref->users);
bref->ref = elt->list.n; bref->ref = elt->list.n;
} }
LIST_DEL(&elt->list); LIST_DEL(&elt->list);