From dd56616067d19060425940f6906cefe6efcd1955 Mon Sep 17 00:00:00 2001 From: Aurelien DARRAGON Date: Fri, 29 Nov 2024 08:42:01 +0100 Subject: [PATCH] BUG/MEDIUM: event_hdl: fix uninitialized value in async mode when no data is provided In _event_hdl_publish(), when we prepare the asynchronous event and no was provided (set to NULL), we forgot to initialize the _data event_hdl_async_event struct member to NULL, which leads to uninitialized reads in event_hdl_async_free_event() when the event is freed: ==1002331== Conditional jump or move depends on uninitialised value(s) ==1002331== at 0x35D9D1: event_hdl_async_free_event (event_hdl.c:224) ==1002331== by 0x1CC8EC: hlua_event_runner (hlua.c:9917) ==1002331== by 0x39AD3F: run_tasks_from_lists (task.c:641) ==1002331== by 0x39B7B4: process_runnable_tasks (task.c:883) ==1002331== by 0x314B48: run_poll_loop (haproxy.c:2976) ==1002331== by 0x315218: run_thread_poll_loop (haproxy.c:3190) ==1002331== by 0x18061D: main (haproxy.c:3747) The bug severity was set to MEDIUM because of its nature, and it's best if this patch can be backported up to 2.8. But in practise it can only be triggered with events that don't provide optional data: since PAT_REF events are the first native events making use of this feature, this bug shouldn't be an issue before f72a66e ("MINOR: pattern: publish event_hdl events on pat_ref updates") --- src/event_hdl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/event_hdl.c b/src/event_hdl.c index ad480f59f..51553b082 100644 --- a/src/event_hdl.c +++ b/src/event_hdl.c @@ -890,8 +890,10 @@ static int _event_hdl_publish(event_hdl_sub_list *sub_list, struct event_hdl_sub * use the same async_data */ HA_ATOMIC_INC(&async_data->refcount); - } else + } else { + new_event->_data = NULL; new_event->data = NULL; + } /* appending new event to event hdl queue */ MT_LIST_INIT(&new_event->mt_list);