net/haproxy/patches/000-BUG-MAJOR-listener-Make-sure-the-listener-exist-before-using-it.patch

   1 commit 7c3fd37724c58cf09359e0d381a9be305dd7869b
   2 Author: Olivier Houchard <cognet@ci0.org>
   3 Date:   Mon Feb 25 16:18:16 2019 +0100
   4
   5     BUG/MAJOR: listener: Make sure the listener exist before using it.
   6
   7     In listener_accept(), make sure we have a listener before attempting to
   8     use it.
   9     An another thread may have closed the FD meanwhile, and set fdtab[fd].owner
  10     to NULL.
  11     As the listener is not free'd, it is ok to attempt to accept() a new
  12     connection even if the listener was closed. At worst the fd has been
  13     reassigned to another connection, and accept() will fail anyway.
  14
  15     Many thanks to Richard Russo for reporting the problem, and suggesting the
  16     fix.
  17
  18     This should be backported to 1.9 and 1.8.
  19
  20     (cherry picked from commit d16a9dfed80e75d730754b717370515265698cdd)
  21     Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
  22     (cherry picked from commit a2511ed1fcdfa8047dbe2268fc0259f9b06cf891)
  23     Signed-off-by: William Lallemand <wlallemand@haproxy.org>
  24
  25 diff --git a/src/listener.c b/src/listener.c
  26 index a30efe03..5f6fafbc 100644
  27 --- a/src/listener.c
  28 +++ b/src/listener.c
  29 @@ -441,8 +441,8 @@ void delete_listener(struct listener *listener)
  30  void listener_accept(int fd)
  31  {
  32         struct listener *l = fdtab[fd].owner;
  33 -       struct proxy *p = l->bind_conf->frontend;
  34 -       int max_accept = l->maxaccept ? l->maxaccept : 1;
  35 +       struct proxy *p;
  36 +       int max_accept;
  37         int expire;
  38         int cfd;
  39         int ret;
  40 @@ -450,6 +450,10 @@ void listener_accept(int fd)
  41         static int accept4_broken;
  42  #endif
  43
  44 +       if (!l)
  45 +               return;
  46 +       p = l->bind_conf->frontend;
  47 +       max_accept = l->maxaccept ? l->maxaccept : 1;
  48         if (HA_SPIN_TRYLOCK(LISTENER_LOCK, &l->lock))
  49                 return;
  50