mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: ring: tcp forward on ring can break the reader counter.

Browse Source 
If the session is not established, the applet handler could leave
with the applet detached from the ring. At next call, the attach
counter will be decreased again causing unpredectable behavior.

This patch should be backported on branches >=2.2
This commit is contained in:
Emeric Brun 2020-12-02 17:02:09 +01:00 committed by Willy Tarreau
parent fd1831499e
commit fdabf49548
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/sink.c
View File

@ -348,6 +348,11 @@ static void sink_forward_io_handler(struct appctx *appctx)
ofs += ring->ofs; ofs += ring->ofs;
} }
/* in this loop, ofs always points to the counter byte that precedes
* the message so that we can take our reference there if we have to
* stop before the end (ret=0).
*/
if (si_opposite(si)->state == SI_ST_EST) {
/* we were already there, adjust the offset to be relative to /* we were already there, adjust the offset to be relative to
* the buffer's head and remove us from the counter. * the buffer's head and remove us from the counter.
*/ */
@ -355,11 +360,6 @@ static void sink_forward_io_handler(struct appctx *appctx)
BUG_ON(ofs >= buf->size); BUG_ON(ofs >= buf->size);
HA_ATOMIC_SUB(b_peek(buf, ofs), 1); HA_ATOMIC_SUB(b_peek(buf, ofs), 1);
/* in this loop, ofs always points to the counter byte that precedes
* the message so that we can take our reference there if we have to
* stop before the end (ret=0).
*/
if (si_opposite(si)->state == SI_ST_EST) {
ret = 1; ret = 1;
while (ofs + 1 < b_data(buf)) { while (ofs + 1 < b_data(buf)) {
cnt = 1; cnt = 1;
@ -488,6 +488,11 @@ static void sink_forward_oc_io_handler(struct appctx *appctx)
ofs += ring->ofs; ofs += ring->ofs;
} }
/* in this loop, ofs always points to the counter byte that precedes
* the message so that we can take our reference there if we have to
* stop before the end (ret=0).
*/
if (si_opposite(si)->state == SI_ST_EST) {
/* we were already there, adjust the offset to be relative to /* we were already there, adjust the offset to be relative to
* the buffer's head and remove us from the counter. * the buffer's head and remove us from the counter.
*/ */
@ -495,11 +500,6 @@ static void sink_forward_oc_io_handler(struct appctx *appctx)
BUG_ON(ofs >= buf->size); BUG_ON(ofs >= buf->size);
HA_ATOMIC_SUB(b_peek(buf, ofs), 1); HA_ATOMIC_SUB(b_peek(buf, ofs), 1);
/* in this loop, ofs always points to the counter byte that precedes
* the message so that we can take our reference there if we have to
* stop before the end (ret=0).
*/
if (si_opposite(si)->state == SI_ST_EST) {
ret = 1; ret = 1;
while (ofs + 1 < b_data(buf)) { while (ofs + 1 < b_data(buf)) {
cnt = 1; cnt = 1;