mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 06:11:32 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: quic: fix crash on qc_new_conn alloc failure

Browse Source 
A new counter was recently introduced to comptabilize the current number
of active QUIC handshakes. This counter is stored on the listener
instance.

This counter is incremented at the beginning of qc_new_conn() to check
if limit is not reached prior to quic_conn allocation. If quic_conn or
one of its inner member allocation fails, special care is taken to
decrement the counter as the connection instance is released. However,
it relies on <l> variable which is initialized too late to cover
pool_head_quic_conn allocation failure.

To fix this, simply initialize <l> at the beginning of qc_new_conn().

This issue was reproduced using -dMfail argument.

This issue was introduced by the following commit
  commit 3df6a60113773d8abff3457c7a06e30c1892b7dc
  MEDIUM: quic: limit handshake per listener

No need to backport.
This commit is contained in:
Amaury Denoyelle 2023-11-13 10:54:33 +01:00
parent 76acde9107
commit 92da3accfd
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/quic_conn.c
View File

@ -1174,7 +1174,7 @@ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
{ {
int i; int i;
struct quic_conn *qc = NULL; struct quic_conn *qc = NULL;
struct listener *l = NULL; struct listener *l = server ? owner : NULL;
struct quic_cc_algo *cc_algo = NULL; struct quic_cc_algo *cc_algo = NULL;
unsigned int next_actconn = 0, next_sslconn = 0, next_handshake = 0; unsigned int next_actconn = 0, next_sslconn = 0, next_handshake = 0;
@ -1194,7 +1194,7 @@ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
} }
if (server) { if (server) {
next_handshake = quic_increment_curr_handshake(owner); next_handshake = quic_increment_curr_handshake(l);
if (!next_handshake) { if (!next_handshake) {
TRACE_STATE("max handshake reached", QUIC_EV_CONN_INIT); TRACE_STATE("max handshake reached", QUIC_EV_CONN_INIT);
goto err; goto err;
@ -1264,7 +1264,6 @@ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
if (server) { if (server) {
struct proxy *prx; struct proxy *prx;
l = owner;
prx = l->bind_conf->frontend; prx = l->bind_conf->frontend;
cc_algo = l->bind_conf->quic_cc_algo; cc_algo = l->bind_conf->quic_cc_algo;