mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-23 14:51:27 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: tcp-check: don't call tcpcheck_main() from the I/O handlers!

Browse Source 
This function can destroy a socket and create a new one, resulting in a
change of FD on the connection between recv() and send() for example,
which is absolutely not permitted, and can result in various funny games
like polling not being properly updated (or with the flags from a previous
fd) etc.

Let's only call this from the wake() callback which is more tolerant.
Ideally the operations should be made even more reliable by returning
a specific value to indicate that the connection was released and that
another one was created. But this is hasardous for stable releases as
it may reveal other issues.

This fix should be backported to 1.7 and 1.6.
This commit is contained in:
Willy Tarreau 2017-10-04 11:58:22 +02:00
parent 82feaaf042
commit c09572fd8b
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/checks.c
View File

@ -757,10 +757,9 @@ static void event_srv_chk_w(struct connection *conn)
if (!check->type) if (!check->type)
goto out_wakeup; goto out_wakeup;
if (check->type == PR_O2_TCPCHK_CHK) { /* wake() will take care of calling tcpcheck_main() */
tcpcheck_main(conn); if (check->type == PR_O2_TCPCHK_CHK)
return; return;
}
if (check->bo->o) { if (check->bo->o) {
conn->xprt->snd_buf(conn, check->bo, 0); conn->xprt->snd_buf(conn, check->bo, 0);
@ -815,10 +814,9 @@ static void event_srv_chk_r(struct connection *conn)
if (conn->flags & CO_FL_HANDSHAKE) if (conn->flags & CO_FL_HANDSHAKE)
return; return;
if (check->type == PR_O2_TCPCHK_CHK) { /* wake() will take care of calling tcpcheck_main() */
tcpcheck_main(conn); if (check->type == PR_O2_TCPCHK_CHK)
return; return;
}
/* Warning! Linux returns EAGAIN on SO_ERROR if data are still available /* Warning! Linux returns EAGAIN on SO_ERROR if data are still available
* but the connection was closed on the remote end. Fortunately, recv still * but the connection was closed on the remote end. Fortunately, recv still
@ -1379,6 +1377,10 @@ static int wake_srv_chk(struct connection *conn)
{ {
struct check *check = conn->owner; struct check *check = conn->owner;
/* we may have to make progress on the TCP checks */
if (check->type == PR_O2_TCPCHK_CHK)
tcpcheck_main(conn);
if (unlikely(conn->flags & CO_FL_ERROR)) { if (unlikely(conn->flags & CO_FL_ERROR)) {
/* We may get error reports bypassing the I/O handlers, typically /* We may get error reports bypassing the I/O handlers, typically
* the case when sending a pure TCP check which fails, then the I/O * the case when sending a pure TCP check which fails, then the I/O