mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-21 05:41:26 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()

Browse Source 
mux_pt_wake() calls data->wake() which can return -1 indicating that the
connection was just destroyed. We need to check for this condition and
immediately exit in this case otherwise we dereference a just freed
connection. Note that this mainly happens on idle connections between
two HTTP requests. It can have random implications between requests as
it may lead a wrong connection's polling to be re-enabled or disabled
for example, especially with threads.

This patch must be backported to 1.8.
This commit is contained in:
Willy Tarreau 2018-08-24 15:48:59 +02:00
parent b083c8316b
commit ad7f0ad1c3
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mux_pt.c
View File

@ -51,6 +51,9 @@ static int mux_pt_wake(struct connection *conn)
ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0; ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
if (ret < 0)
return ret;
/* If we had early data, and we're done with the handshake /* If we had early data, and we're done with the handshake
* then whe know the data are safe, and we can remove the flag. * then whe know the data are safe, and we can remove the flag.
*/ */