From d38b918da1c8deece731e2fba36576f0b077ed76 Mon Sep 17 00:00:00 2001 From: Aurelien DARRAGON Date: Tue, 13 Jan 2026 19:15:07 +0100 Subject: [PATCH] BUG/MINOR: server: ensure server is detached from proxy list before being freed There remained some cases (on error paths) were a server could be freed while still attached on the parent proxy server list. In 3.3 this can be problematic because new_server() automatically adds the server to the parent proxy list. The bug is insignificant because it is on errors paths during init and often haproxy exits right after. But let's fix that to ensure no UAF or undefined behavior occurs because of that. This patch depends on ("MINOR: cli: use srv_drop() when server was created using new_server()") It must be backported in 3.3 with the above mentioned patch. --- src/cli.c | 4 +++- src/server.c | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/cli.c b/src/cli.c index ebf47cea7..1d187da67 100644 --- a/src/cli.c +++ b/src/cli.c @@ -3737,8 +3737,10 @@ int mworker_cli_attach_server(char **errmsg) error: - list_for_each_entry(child, &proc_list, list) + list_for_each_entry(child, &proc_list, list) { + srv_detach(child->srv); srv_drop(child->srv); + } free(msg); return -1; diff --git a/src/server.c b/src/server.c index a86047fdf..db098a800 100644 --- a/src/server.c +++ b/src/server.c @@ -3433,6 +3433,7 @@ static int _srv_parse_tmpl_init(struct server *srv, struct proxy *px) free_check(&newsrv->agent); free_check(&newsrv->check); MT_LIST_DELETE(&newsrv->global_list); + srv_detach(newsrv); } srv_drop(newsrv); return i - srv->tmpl_info.nb_low;