RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-02-28 16:40:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: queue: fix unsafe proxy pointer when counting nbpend

Browse Source 
As reported by Coverity in issue #917, commit 96bca33 ("OPTIM: queue:
decrement the nbpend and totpend counters outside of the lock")
introduced a bug when moving the increments outside of the loop,
because we can't always rely on the pendconn "p" here as it may
be null. We can retrieve the proxy pointer directly from s->proxy
instead. The same is true for pendconn_redistribute(), though the
last "p" pointer there was still valid. This patch fixes both.

No backport is needed, this was introduced just before 2.3-dev8.
This commit is contained in:
Willy Tarreau 2020-10-24 12:57:41 +02:00
parent e2370307be
commit 5472aa50f1
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/queue.c
View File

@ -465,8 +465,8 @@ int pendconn_redistribute(struct server *s)
xferred++; xferred++;
} }
if (xferred) { if (xferred) {
_HA_ATOMIC_SUB(&p->srv->nbpend, xferred); _HA_ATOMIC_SUB(&s->nbpend, xferred);
_HA_ATOMIC_SUB(&p->px->totpend, xferred); _HA_ATOMIC_SUB(&s->proxy->totpend, xferred);
} }
return xferred; return xferred;
} }
@ -508,8 +508,8 @@ int pendconn_grab_from_px(struct server *s)
} }
HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &s->proxy->lock); HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &s->proxy->lock);
if (xferred) { if (xferred) {
_HA_ATOMIC_SUB(&p->px->nbpend, xferred); _HA_ATOMIC_SUB(&s->proxy->nbpend, xferred);
_HA_ATOMIC_SUB(&p->px->totpend, xferred); _HA_ATOMIC_SUB(&s->proxy->totpend, xferred);
} }
return xferred; return xferred;
} }